1079a613057f32e18e2f94db6e6451bb83eff68771297aeb8bc11919085c52a0

Analysis

max time kernel
1778s
max time network
1823s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/03/2024, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
KinitoPET.v1.1.0-P2P/_CommonRedist/DotNet/4.7/Microsoft .NET Framework 4.7.2.cmd
Size 142B
Sample240302-q5efgsec53
SHA256 485d17282dacbe3b5182c76830d05609371f4718d89b9fba99a34f96bbc521b6
MD5 ef99b6c5d62c9e6ab34b9a6eb305c8ce
SHA1 caeeb86a73217cc51025607f4c84522b9764123b
SHA512 61fddf3d81aad061c596170b5f873375226659113ea19f0ac1b9582cbcaeeab9e7fec340109faab3967bea298c47adead7ba1d291d5ccfb07d732940512c6337
MD5 SHA1 SHA512

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 5 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System\clr_optimization_v4.0.30319_64-2 = "V2.0\|Action=Block\|Dir=Out\|App=C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\|Svc=clr_optimization_v4.0.30319_64\|Name=Block traffic for clr_optimization_v4.0.30319_64\|"	msiexec.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System\clr_optimization_v4.0.30319_32-1 = "V2.0\|Action=Block\|Dir=In\|App=C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\|Svc=clr_optimization_v4.0.30319_32\|Name=Block traffic for clr_optimization_v4.0.30319_32\|"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System\clr_optimization_v4.0.30319_32-2 = "V2.0\|Action=Block\|Dir=Out\|App=C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsvw.exe\|Svc=clr_optimization_v4.0.30319_32\|Name=Block traffic for clr_optimization_v4.0.30319_32\|"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System\clr_optimization_v4.0.30319_64-1 = "V2.0\|Action=Block\|Dir=In\|App=C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsvw.exe\|Svc=clr_optimization_v4.0.30319_64\|Name=Block traffic for clr_optimization_v4.0.30319_64\|"	msiexec.exe

Manipulates Digital Signatures 1 TTPs 24 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "SoftpubLoadMessage"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "SoftpubCheckCert"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "WINTRUST.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "WintrustCertificateTrust"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\mscorsecimpl.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "CORPolicyEE"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "SoftpubInitialize"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Message\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "WINTRUST.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "SoftpubLoadSignature"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "WINTRUST.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "WINTRUST.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\mscorsecimpl.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "WINTRUST.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "CORPolicyEE"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "WINTRUST.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "SoftpubInitialize"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "WINTRUST.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "WINTRUST.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "SoftpubCheckCert"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "WINTRUST.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "SoftpubLoadMessage"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "SoftpubLoadSignature"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "WintrustCertificateTrust"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$DLL = "WINTRUST.DLL"	msiexec.exe

Modifies Installed Components in the registry 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}\Version = "4,0,30319,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}\Locale	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}\ = ".NET Framework"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}\Locale	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}\Version = "4,0,30319,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}\ComponentID = ".NETFramework"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}\ComponentID = ".NETFramework"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{09CCBE8E-B964-30EF-AE84-6537AB4197F9}\ = ".NET Framework"	msiexec.exe

Executes dropped EXE 64 IoCs

pid	Process
272	Setup.exe
2692	SetupUtility.exe
1204	ServiceModelReg.exe
2080	ServiceModelReg.exe
2976	regtlibv12.exe
2308	regtlibv12.exe
1728	regtlibv12.exe
972	regtlibv12.exe
884	regtlibv12.exe
2152	regtlibv12.exe
2300	regtlibv12.exe
2208	regtlibv12.exe
1748	regtlibv12.exe
556	regtlibv12.exe
2576	regtlibv12.exe
868	regtlibv12.exe
932	regtlibv12.exe
2436	regtlibv12.exe
1988	aspnet_regiis.exe
2056	aspnet_regiis.exe
2908	ngen.exe
1904	mscorsvw.exe
1956	ngen.exe
2180	mscorsvw.exe
1380	mscorsvw.exe
1684	ngen.exe
1936	mscorsvw.exe
2768	ngen.exe
2496	mscorsvw.exe
3064	mscorsvw.exe
688	mscorsvw.exe
1704	mscorsvw.exe
3044	mscorsvw.exe
2220	mscorsvw.exe
1616	mscorsvw.exe
868	mscorsvw.exe
1680	mscorsvw.exe
2428	mscorsvw.exe
1432	mscorsvw.exe
1204	mscorsvw.exe
268	mscorsvw.exe
2868	mscorsvw.exe
2920	mscorsvw.exe
2264	mscorsvw.exe
1500	mscorsvw.exe
628	mscorsvw.exe
1484	mscorsvw.exe
2032	mscorsvw.exe
1092	mscorsvw.exe
2020	mscorsvw.exe
1188	mscorsvw.exe
2748	mscorsvw.exe
1628	mscorsvw.exe
2536	mscorsvw.exe
1720	mscorsvw.exe
1820	mscorsvw.exe
1644	mscorsvw.exe
1564	mscorsvw.exe
2880	mscorsvw.exe
1464	mscorsvw.exe
1572	mscorsvw.exe
1080	mscorsvw.exe
2040	mscorsvw.exe
2188	mscorsvw.exe

Loads dropped DLL 64 IoCs

pid	Process
2780	NDP472-KB4054530-x86-x64-AllOS-ENU.exe
272	Setup.exe
272	Setup.exe
272	Setup.exe
2856	MsiExec.exe
1528	MsiExec.exe
2856	MsiExec.exe
1528	MsiExec.exe
1528	MsiExec.exe
2856	MsiExec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\InprocServer32\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\InprocServer32\4.0.0.0\Assembly = "AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\InprocServer32\Class = "Microsoft.Aspnet.Snapin.AspNetManagementUtility"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{4E9963B7-B2BF-4685-9378-8FEBEA364EF8}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32\Class = "System.ServiceModel.ServiceMoniker40.ServiceMoniker40"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\InprocServer32\Assembly = "AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A7B042D-578A-4366-9A3D-154C0498458E}\InprocServer32\ = "C:\\Windows\\system32\\mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5C8422A6-F64B-4AA6-8D3C-78A3E988AA9E}\InprocServer32\ = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WPF\\PenIMC2_v0400.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\InprocServer32\4.0.0.0\Class = "Microsoft.Aspnet.Snapin.AspNetManagementUtility"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E9963B7-B2BF-4685-9378-8FEBEA364EF8}\InprocServer32\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A7B042D-578A-4366-9A3D-154C0498458E}\InprocServer32\4.0.0.0\Assembly = "System.Management.Instrumentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFFECCA7-4069-49F9-B5AB-7CCBB078ED91}\InprocServer32\4.0.0.0\Class = "System.ServiceModel.Internal.TransactionBridge"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BFFECCA7-4069-49F9-B5AB-7CCBB078ED91}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BFFECCA7-4069-49F9-B5AB-7CCBB078ED91}\InprocServer32\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20C6F4C2-80A8-4310-A59A-1CC487334236}\InprocServer32\ = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WPF\\PenIMC2_v0400.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{215B68E5-0E78-4505-BE40-962EE3A0C379}\InProcServer32\ = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WPF\\PenIMC2_v0400.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2A7B042D-578A-4366-9A3D-154C0498458E}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFFECCA7-4069-49F9-B5AB-7CCBB078ED91}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{215B68E5-0E78-4505-BE40-962EE3A0C379}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E9963B7-B2BF-4685-9378-8FEBEA364EF8}\InprocServer32\ = "C:\\Windows\\system32\\mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45FB4600-E6E8-4928-B25E-50476FF79425}\InprocServer32\4.0.30319\ImplementedInThisVersion	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{45FB4600-E6E8-4928-B25E-50476FF79425}\InprocServer32\4.0.30319	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A7B042D-578A-4366-9A3D-154C0498458E}\InprocServer32\4.0.0.0\Class = "System.Management.Instrumentation.ManagedCommonProvider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\InprocServer32\4.0.0.0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{59856830-3ECB-4D29-9CFE-DDD0F74B96A2}\InprocServer32\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{59856830-3ECB-4D29-9CFE-DDD0F74B96A2}\InprocServer32\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32\4.0.0.0\Class = "System.ServiceModel.ServiceMoniker40.ServiceMoniker40"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\InprocServer32\ = "C:\\Windows\\system32\\mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E9963B7-B2BF-4685-9378-8FEBEA364EF8}\InprocServer32\Assembly = "AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{215B68E5-0E78-4505-BE40-962EE3A0C379}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2A7B042D-578A-4366-9A3D-154C0498458E}\InprocServer32\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A7B042D-578A-4366-9A3D-154C0498458E}\InprocServer32\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E9963B7-B2BF-4685-9378-8FEBEA364EF8}\InprocServer32\4.0.0.0\Class = "Microsoft.Aspnet.Snapin.About"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32\ = "C:\\Windows\\system32\\mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E9963B7-B2BF-4685-9378-8FEBEA364EF8}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFFECCA7-4069-49F9-B5AB-7CCBB078ED91}\InprocServer32\ = "C:\\Windows\\system32\\mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32\Assembly = "System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFFECCA7-4069-49F9-B5AB-7CCBB078ED91}\InprocServer32\4.0.0.0\Assembly = "Microsoft.Transactions.Bridge, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{59856830-3ECB-4D29-9CFE-DDD0F74B96A2}\InprocServer32\4.0.0.0\Class = "System.ServiceModel.ComIntegration.DllHostInitializer"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32\4.0.0.0\Assembly = "System.ServiceModel.ServiceMoniker40, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45FB4600-E6E8-4928-B25E-50476FF79425}\InprocServer32\ = "C:\\Windows\\system32\\mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20C6F4C2-80A8-4310-A59A-1CC487334236}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32\4.0.0.0\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A7B042D-578A-4366-9A3D-154C0498458E}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{20C6F4C2-80A8-4310-A59A-1CC487334236}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A7B042D-578A-4366-9A3D-154C0498458E}\InprocServer32\Class = "System.Management.Instrumentation.ManagedCommonProvider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5C8422A6-F64B-4AA6-8D3C-78A3E988AA9E}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{4E9963B7-B2BF-4685-9378-8FEBEA364EF8}\InprocServer32\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45FB4600-E6E8-4928-B25E-50476FF79425}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5C8422A6-F64B-4AA6-8D3C-78A3E988AA9E}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{59856830-3ECB-4D29-9CFE-DDD0F74B96A2}\InprocServer32\4.0.0.0\Assembly = "System.ServiceModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFFECCA7-4069-49F9-B5AB-7CCBB078ED91}\InprocServer32\Class = "System.ServiceModel.Internal.TransactionBridge"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E9963B7-B2BF-4685-9378-8FEBEA364EF8}\InprocServer32\4.0.0.0\Assembly = "AspNetMMCExt, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2A7B042D-578A-4366-9A3D-154C0498458E}\InprocServer32\Assembly = "System.Management.Instrumentation, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BFFECCA7-4069-49F9-B5AB-7CCBB078ED91}\InprocServer32\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4E9963B7-B2BF-4685-9378-8FEBEA364EF8}\InprocServer32\Class = "Microsoft.Aspnet.Snapin.About"	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\wbem\AutoRecover\E6195BA9E153534E5472835E2F29A5B0.mof	mofcomp.exe
File created	C:\Windows\system32\perfc009.dat	aspnet_regiis.exe
File created	C:\Windows\system32\PerfStringBackup.TMP	aspnet_regiis.exe
File created	C:\Windows\system32\perfc007.dat	aspnet_regiis.exe
File opened for modification	C:\Windows\system32\msvcp110_clr0400.dll	msiexec.exe
File opened for modification	C:\Windows\system32\en-US\dfshim.dll.mui	msiexec.exe
File created	C:\Windows\system32\msvcp120_clr0400.dll	msiexec.exe
File created	C:\Windows\system32\perfh00A.dat	aspnet_regiis.exe
File created	C:\Windows\system32\perfh011.dat	aspnet_regiis.exe
File opened for modification	C:\Windows\SysWOW64\msvcp110_clr0400.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp120_clr0400.dll	msiexec.exe
File opened for modification	C:\Windows\system32\wbem\AutoRecover\716FDC254E211F547A560E1A71D0E6CA.mof	mofcomp.exe
File created	C:\Windows\system32\perfh009.dat	aspnet_regiis.exe
File created	C:\Windows\system32\msvcr100_clr0400.dll	msiexec.exe
File created	C:\Windows\system32\perfc00C.dat	aspnet_regiis.exe
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	aspnet_regiis.exe
File created	C:\Windows\SysWOW64\msvcr120_clr0400.dll	msiexec.exe
File created	C:\Windows\system32\perfh00A.dat	aspnet_regiis.exe
File created	C:\Windows\system32\aspnet_counters.dll	msiexec.exe
File created	C:\Windows\SysWOW64\en-US\dfshim.dll.mui	msiexec.exe
File created	C:\Windows\system32\msvcr120_clr0400.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\PerfStringBackup.INI	aspnet_regiis.exe
File created	C:\Windows\system32\perfh010.dat	aspnet_regiis.exe
File created	C:\Windows\system32\perfc00C.dat	aspnet_regiis.exe
File created	C:\Windows\system32\perfc011.dat	aspnet_regiis.exe
File created	C:\Windows\system32\perfh00C.dat	aspnet_regiis.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	C:\Windows\system32\wbem\AutoRecover\6F8564A71977AE6B940705DCC4847A8D.mof	mofcomp.exe
File created	C:\Windows\system32\perfh00C.dat	aspnet_regiis.exe
File opened for modification	C:\Windows\system32\wbem\AutoRecover\7073EBB8E2F3C70E0FA1F650B7DEA970.mof	mofcomp.exe
File opened for modification	C:\Windows\system32\aspnet_counters.dll	msiexec.exe
File created	C:\Windows\system32\msvcp110_clr0400.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp110_clr0400.dll	msiexec.exe
File opened for modification	C:\Windows\system32\wbem\AutoRecover\7073EBB8E2F3C70E0FA1F650B7DEA970.mof	mofcomp.exe
File created	C:\Windows\system32\perfc00A.dat	aspnet_regiis.exe
File opened for modification	C:\Windows\SysWOW64\msvcr110_clr0400.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\en-US\dfshim.dll.mui	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp120_clr0400.dll	msiexec.exe
File created	C:\Windows\system32\perfc010.dat	aspnet_regiis.exe
File created	C:\Windows\system32\perfh011.dat	aspnet_regiis.exe
File opened for modification	C:\Windows\SysWOW64\msvcr120_clr0400.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr120_clr0400.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr100_clr0400.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcr110_clr0400.dll	msiexec.exe
File created	C:\Windows\SysWOW64\aspnet_counters.dll	msiexec.exe
File created	C:\Windows\system32\msvcr110_clr0400.dll	msiexec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B2238AACCEDC3F1FFE8E7EB5F575EC9	mscorsvw.exe
File opened for modification	C:\Windows\system32\msvcr100_clr0400.dll	msiexec.exe
File created	C:\Windows\system32\en-US\dfshim.dll.mui	msiexec.exe
File created	C:\Windows\system32\perfc009.dat	aspnet_regiis.exe
File created	C:\Windows\system32\perfh009.dat	aspnet_regiis.exe
File created	C:\Windows\system32\perfc010.dat	aspnet_regiis.exe
File created	C:\Windows\SysWOW64\PerfStringBackup.TMP	aspnet_regiis.exe
File opened for modification	C:\Windows\SysWOW64\aspnet_counters.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcr110_clr0400.dll	msiexec.exe
File created	C:\Windows\system32\perfc007.dat	aspnet_regiis.exe
File created	C:\Windows\system32\perfc00A.dat	aspnet_regiis.exe
File created	C:\Windows\system32\perfc011.dat	aspnet_regiis.exe
File created	C:\Windows\system32\perfh010.dat	aspnet_regiis.exe
File created	C:\Windows\system32\perfh007.dat	aspnet_regiis.exe
File opened for modification	C:\Windows\SysWOW64\msvcp120_clr0400.dll	msiexec.exe
File opened for modification	C:\Windows\system32\wbem\AutoRecover\D361F8B496FD6DAF7BEEF497E09C0DC1.mof	mofcomp.exe
File created	C:\Windows\system32\perfh007.dat	aspnet_regiis.exe
File opened for modification	C:\Windows\SysWOW64\msvcr100_clr0400.dll	msiexec.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml	msiexec.exe
File created	C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_client.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\RedistList\AssemblyList_4_extended.xml	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\UninstallCommon.sql	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\navigationBar.ascx	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\en-US\WorkflowServiceHostPerformanceCounters.dll.mui	msiexec.exe
File created	C:\Windows\inf\ASP.NET_4.0.30319\0816\aspnet_perf.ini	aspnet_regiis.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Reflection.Emit\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Reflection.Emit.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\App_Code\SecurityPage.cs	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\web.config	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WorkflowServiceHostPerformanceCounters.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Xml.XmlDocument.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_rc.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security.Cryptography.Primitives\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.Cryptography.Primitives.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Device.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallPersonalization.sql	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Web\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Web.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web_mediumtrust.config	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\normnfc.nlp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Console\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Console.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Security\Wizard\App_LocalResources\wizardFinish.ascx.resx	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\AspNetMMCExt.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll	msiexec.exe
File created	C:\Windows\inf\SMSvcHost 4.0.0.0\001D\_SMSvcHostPerfCounters.ini	lodctr.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\UIAutomationTypes.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\NlsLexicons0009.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\locale.nlp	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\App_Code\ProvidersPage.cs	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Data.Common.dll	msiexec.exe
File created	C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0816\PerfCounters.ini	lodctr.exe
File opened for modification	C:\Windows\Installer\MSI318D.tmp	msiexec.exe
File created	C:\Windows\assembly\GACLock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\home1.aspx	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\Graphics\Rotate3.ico	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsecimpl.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.WorkflowBuildExtensions.targets	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Net.Requests.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Device.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Xaml.Hosting\v4.0_4.0.0.0__31bf3856ad364e35\System.Xaml.Hosting.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.Design.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Numerics.Vectors.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Threading.Thread.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Resources.ResourceManager\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Resources.ResourceManager.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Messaging\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll	msiexec.exe
File created	C:\Windows\inf\MSDTC Bridge 4.0.0.0\000A\_TransactionBridgePerfCounters.ini	lodctr.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP12C6.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Common.targets	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualC\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Instrumentation\v4.0_4.0.0.0__b77a5c561934e089\System.Management.Instrumentation.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI254C.tmp	msiexec.exe
File created	C:\Windows\assembly\ngenlock.dat	mscorsvw.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\index158.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.VisualBasic.targets	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.Formatters.Soap.dll	msiexec.exe
File created	C:\Windows\inf\SMSvcHost 4.0.0.0\0005\_SMSvcHostPerfCounters.ini	lodctr.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms.DataVisualization.Design\v4.0_4.0.0.0__31bf3856ad364e35\System.Windows.Forms.DataVisualization.Design.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\Fonts\GlobalSerif.CompositeFont	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Net.WebSockets.Client.dll	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.NETFramework.targets	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Runtime.Serialization.Xml.dll	msiexec.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe

Modifies Internet Explorer settings 1 TTPs 18 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F1E561D-AF17-4510-B996-351BBA0862A7}\CLSID = "{20FD4E26-8E0F-4F73-A0E0-F27B8C57BE6F}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AED-AECE-4E27-9BCB-5358B13F9FF9}\AppPath = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}\AppName = "dfsvc.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}\AppPath = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F1E561D-AF17-4510-B996-351BBA0862A7}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F1E561D-AF17-4510-B996-351BBA0862A7}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F1E561D-AF17-4510-B996-351BBA0862A7}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}\AppName = "dfsvc.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AED-AECE-4E27-9BCB-5358B13F9FF9}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AED-AECE-4E27-9BCB-5358B13F9FF9}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AED-AECE-4E27-9BCB-5358B13F9FF9}\AppName = "dfsvc.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F1E561D-AF17-4510-B996-351BBA0862A7}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1F1E561D-AF17-4510-B996-351BBA0862A7}\CLSID = "{20FD4E26-8E0F-4F73-A0E0-F27B8C57BE6F}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}\AppPath = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\"	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	mscorsvw.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	mscorsvw.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{11D31042-14C0-3B5C-87D0-A2CD40803CB5}\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32\Class = "System.ServiceModel.ServiceMoniker40.ServiceMoniker40"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F75B6772-91E4-4D2F-9D44-61A447109C2B}\DllSurrogate	aspnet_regiis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E8EBCC90469BFE03EA485673BA14799F\KB2468871v2 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{62ECB562-B92A-37E7-8D5B-84036A1A4348}\4.0.0.0\Class = "Microsoft.Win32.RegistryValueKind"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5C8422A6-F64B-4AA6-8D3C-78A3E988AA9E}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45FB4600-E6E8-4928-B25E-50476FF79425}\NotInsertable\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{56ABB41C-4516-30F6-882E-57F234AB5028}\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9ABE23BD-D5D5-30F6-B127-9B3AB98F7DBB}\4.0.0.0\Class = "System.Runtime.InteropServices.LayoutKind"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{3E4D0EE1-9F86-3CF4-9E00-59873F6BDF86}\4.0.0.0\Class = "System.EnterpriseServices.SynchronizationOption"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5C8422A6-F64B-4AA6-8D3C-78A3E988AA9E}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{11472518-C3B8-3BF4-9705-2135E1709883}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{C5D299AC-63B0-3448-BCB7-6AA9B5EB598E}\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2A7B042D-578A-4366-9A3D-154C0498458E}\InprocServer32\Class = "System.Management.Instrumentation.ManagedCommonProvider"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{BFFECCA7-4069-49F9-B5AB-7CCBB078ED91}\InprocServer32\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{215B68E5-0E78-4505-BE40-962EE3A0C379}\InProcServer32\ = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\WPF\\PenIMC2_v0400.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{A2D18600-D187-399C-B2ED-6FA8ED5D2A59}\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C335350A-892D-37F7-967C-99B3C4C4A301}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C888351B-5DFD-3A9F-8D36-96E7770D0EBF}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F680A48A-2D6C-33F1-AFF7-6273B785B035}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{F768EC63-95ED-35FC-9876-7BCF01A14919}\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D3295D87-D604-11D4-A704-00C04FA137E4}\a.0	regtlibv12.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E8EBCC90469BFE03EA485673BA14799F\KB2889889 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{CFB98CA9-8121-35BE-AF40-C176C616A16B}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{20C6F4C2-80A8-4310-A59A-1CC487334236}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{308E1610-86B9-3F48-9F85-8CD715CB68B0}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\AppId = "{F75B6772-91E4-4D2F-9D44-61A447109C2B}"	aspnet_regiis.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{18C327E4-E4BA-3C3C-9942-274272626278}\4.0.0.0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{513B8B77-4930-36BA-9A22-0DAEB293E109}\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{513B8B77-4930-36BA-9A22-0DAEB293E109}\4.0.0.0\Class = "System.Reflection.MemberTypes"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{C660D7A6-D1DD-3E9D-85EB-F844791E2DAE}\4.0.0.0	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{2A7B042D-578A-4366-9A3D-154C0498458E}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FEDB2179-2335-48F1-AA28-5CDA35A2B36D}\InprocServer32\ = "C:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\MmcAspExt.dll"	aspnet_regiis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{11D31042-14C0-3B5C-87D0-A2CD40803CB5}\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{96E0DEE8-C1CA-38A5-A3C9-52DA9B5440EF}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D533D4E5-8654-3F82-81DC-E751CB792593}\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PenIMC4v2.PimcManager2.4\ = "PimcManager2 Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{5437FDFA-9EC9-4CCC-8531-42F8D9C19AF7}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F75B6772-91E4-4D2F-9D44-61A447109C2B}\ = "Microsoft.Aspnet.Snapin.AspNetManagementUtility.4"	aspnet_regiis.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{70446B90-F93B-3578-9B7B-95D05A12DA60}\4.0.0.0\Class = "System.Security.Cryptography.X509Certificates.X509ContentType"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{9C5923E9-DE52-33EA-88DE-7EBC8633B9CC}\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{FD67EBE2-30DE-3FBE-896B-81DA2E455137}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{EEC01711-50DE-36E8-ABA5-DAA1D74E0C32}\4.0.0.0\Class = "System.ConsoleKey"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{20C6F4C2-80A8-4310-A59A-1CC487334236}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{20C6F4C2-80A8-4310-A59A-1CC487334236}\InprocServer32\ = "C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\WPF\\PenIMC2_v0400.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{148540D3-E67F-36DC-A55D-2C8DEC53B9D3}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6EE96102-3657-3D66-867A-26B63AAAAF78}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{74CAA246-BE0E-3AE5-A17C-946E10D89626}\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{9ABE23BD-D5D5-30F6-B127-9B3AB98F7DBB}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{C71DCE2B-B87F-37A9-89ED-F1145955BCD6}\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{CFB98CA9-8121-35BE-AF40-C176C616A16B}\4.0.0.0\Class = "System.Reflection.Emit.ParameterToken"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Application.Reference	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{68DB6E95-F774-3AE3-B1DE-B0CC80F6E174}\4.0.0.0\Assembly = "mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Record\{B6B91160-2ABF-352B-A74D-1174CC324E18}\4.0.0.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E8EBCC90469BFE03EA485673BA14799F\KB3099874 = "Servicing_Key"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E8EBCC90469BFE03EA485673BA14799F\KB3142037 = "Servicing_Key"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{DC516615-47BE-477e-8B55-C5ABE0D76B8F}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BFFECCA7-4069-49F9-B5AB-7CCBB078ED91}\InprocServer32\ = "C:\\Windows\\SysWOW64\\mscoree.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F4E1E7F6-A035-41B3-9856-A3C3A1C4684F}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E8EBCC90469BFE03EA485673BA14799F\NetFx_Full_Common	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{AB8E1300-F46A-3FFD-BCEF-A45DE1C55458}\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{CFB98CA9-8121-35BE-AF40-C176C616A16B}\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{D535A40B-83C0-36FC-82D1-7EF2DE252ECC}\4.0.0.0\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E8EBCC90469BFE03EA485673BA14799F\F_compilers_extended_amd64 = "NetFx_Full_amd64"	msiexec.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs

pid	Process
2780	NDP472-KB4054530-x86-x64-AllOS-ENU.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
272	Setup.exe
272	Setup.exe
272	Setup.exe
272	Setup.exe
272	Setup.exe
272	Setup.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe
2784	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	272	Setup.exe
Token: SeIncreaseQuotaPrivilege	272	Setup.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeSecurityPrivilege	2784	msiexec.exe
Token: SeCreateTokenPrivilege	272	Setup.exe
Token: SeAssignPrimaryTokenPrivilege	272	Setup.exe
Token: SeLockMemoryPrivilege	272	Setup.exe
Token: SeIncreaseQuotaPrivilege	272	Setup.exe
Token: SeMachineAccountPrivilege	272	Setup.exe
Token: SeTcbPrivilege	272	Setup.exe
Token: SeSecurityPrivilege	272	Setup.exe
Token: SeTakeOwnershipPrivilege	272	Setup.exe
Token: SeLoadDriverPrivilege	272	Setup.exe
Token: SeSystemProfilePrivilege	272	Setup.exe
Token: SeSystemtimePrivilege	272	Setup.exe
Token: SeProfSingleProcessPrivilege	272	Setup.exe
Token: SeIncBasePriorityPrivilege	272	Setup.exe
Token: SeCreatePagefilePrivilege	272	Setup.exe
Token: SeCreatePermanentPrivilege	272	Setup.exe
Token: SeBackupPrivilege	272	Setup.exe
Token: SeRestorePrivilege	272	Setup.exe
Token: SeShutdownPrivilege	272	Setup.exe
Token: SeDebugPrivilege	272	Setup.exe
Token: SeAuditPrivilege	272	Setup.exe
Token: SeSystemEnvironmentPrivilege	272	Setup.exe
Token: SeChangeNotifyPrivilege	272	Setup.exe
Token: SeRemoteShutdownPrivilege	272	Setup.exe
Token: SeUndockPrivilege	272	Setup.exe
Token: SeSyncAgentPrivilege	272	Setup.exe
Token: SeEnableDelegationPrivilege	272	Setup.exe
Token: SeManageVolumePrivilege	272	Setup.exe
Token: SeImpersonatePrivilege	272	Setup.exe
Token: SeCreateGlobalPrivilege	272	Setup.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe
Token: SeRestorePrivilege	2784	msiexec.exe
Token: SeTakeOwnershipPrivilege	2784	msiexec.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 2780	2948	cmd.exe	31
PID 2948 wrote to memory of 2780	2948	cmd.exe	31
PID 2948 wrote to memory of 2780	2948	cmd.exe	31
PID 2948 wrote to memory of 2780	2948	cmd.exe	31
PID 2948 wrote to memory of 2780	2948	cmd.exe	31
PID 2948 wrote to memory of 2780	2948	cmd.exe	31
PID 2948 wrote to memory of 2780	2948	cmd.exe	31
PID 2780 wrote to memory of 272	2780	NDP472-KB4054530-x86-x64-AllOS-ENU.exe	32
PID 2780 wrote to memory of 272	2780	NDP472-KB4054530-x86-x64-AllOS-ENU.exe	32
PID 2780 wrote to memory of 272	2780	NDP472-KB4054530-x86-x64-AllOS-ENU.exe	32
PID 2780 wrote to memory of 272	2780	NDP472-KB4054530-x86-x64-AllOS-ENU.exe	32
PID 2780 wrote to memory of 272	2780	NDP472-KB4054530-x86-x64-AllOS-ENU.exe	32
PID 2780 wrote to memory of 272	2780	NDP472-KB4054530-x86-x64-AllOS-ENU.exe	32
PID 2780 wrote to memory of 272	2780	NDP472-KB4054530-x86-x64-AllOS-ENU.exe	32
PID 272 wrote to memory of 2692	272	Setup.exe	33
PID 272 wrote to memory of 2692	272	Setup.exe	33
PID 272 wrote to memory of 2692	272	Setup.exe	33
PID 272 wrote to memory of 2692	272	Setup.exe	33
PID 272 wrote to memory of 2692	272	Setup.exe	33
PID 272 wrote to memory of 2692	272	Setup.exe	33
PID 272 wrote to memory of 2692	272	Setup.exe	33
PID 2784 wrote to memory of 2856	2784	msiexec.exe	35
PID 2784 wrote to memory of 2856	2784	msiexec.exe	35
PID 2784 wrote to memory of 2856	2784	msiexec.exe	35
PID 2784 wrote to memory of 2856	2784	msiexec.exe	35
PID 2784 wrote to memory of 2856	2784	msiexec.exe	35
PID 2784 wrote to memory of 1528	2784	msiexec.exe	36
PID 2784 wrote to memory of 1528	2784	msiexec.exe	36
PID 2784 wrote to memory of 1528	2784	msiexec.exe	36
PID 2784 wrote to memory of 1528	2784	msiexec.exe	36
PID 2784 wrote to memory of 1528	2784	msiexec.exe	36
PID 2784 wrote to memory of 1528	2784	msiexec.exe	36
PID 2784 wrote to memory of 1528	2784	msiexec.exe	36
PID 2784 wrote to memory of 2276	2784	msiexec.exe	37
PID 2784 wrote to memory of 2276	2784	msiexec.exe	37
PID 2784 wrote to memory of 2276	2784	msiexec.exe	37
PID 2784 wrote to memory of 2276	2784	msiexec.exe	37
PID 2784 wrote to memory of 2276	2784	msiexec.exe	37
PID 2276 wrote to memory of 1204	2276	MsiExec.exe	38
PID 2276 wrote to memory of 1204	2276	MsiExec.exe	38
PID 2276 wrote to memory of 1204	2276	MsiExec.exe	38
PID 1204 wrote to memory of 1992	1204	ServiceModelReg.exe	40
PID 1204 wrote to memory of 1992	1204	ServiceModelReg.exe	40
PID 1204 wrote to memory of 1992	1204	ServiceModelReg.exe	40
PID 1204 wrote to memory of 2056	1204	ServiceModelReg.exe	41
PID 1204 wrote to memory of 2056	1204	ServiceModelReg.exe	41
PID 1204 wrote to memory of 2056	1204	ServiceModelReg.exe	41
PID 2784 wrote to memory of 2072	2784	msiexec.exe	42
PID 2784 wrote to memory of 2072	2784	msiexec.exe	42
PID 2784 wrote to memory of 2072	2784	msiexec.exe	42
PID 2784 wrote to memory of 2072	2784	msiexec.exe	42
PID 2784 wrote to memory of 2072	2784	msiexec.exe	42
PID 2784 wrote to memory of 2072	2784	msiexec.exe	42
PID 2784 wrote to memory of 2072	2784	msiexec.exe	42
PID 2072 wrote to memory of 2080	2072	MsiExec.exe	43
PID 2072 wrote to memory of 2080	2072	MsiExec.exe	43
PID 2072 wrote to memory of 2080	2072	MsiExec.exe	43
PID 2072 wrote to memory of 2080	2072	MsiExec.exe	43
PID 2072 wrote to memory of 2080	2072	MsiExec.exe	43
PID 2072 wrote to memory of 2080	2072	MsiExec.exe	43
PID 2072 wrote to memory of 2080	2072	MsiExec.exe	43
PID 2856 wrote to memory of 952	2856	MsiExec.exe	45
PID 2856 wrote to memory of 952	2856	MsiExec.exe	45
PID 2856 wrote to memory of 952	2856	MsiExec.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\KinitoPET.v1.1.0-P2P\_CommonRedist\DotNet\4.7\Microsoft .NET Framework 4.7.2.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Users\Admin\AppData\Local\Temp\KinitoPET.v1.1.0-P2P\_CommonRedist\DotNet\4.7\NDP472-KB4054530-x86-x64-AllOS-ENU.exe
  "C:\Users\Admin\AppData\Local\Temp\KinitoPET.v1.1.0-P2P\_CommonRedist\DotNet\4.7\\NDP472-KB4054530-x86-x64-AllOS-ENU.exe" /q /norestart
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: CmdExeWriteProcessMemorySpam
  - Suspicious use of WriteProcessMemory
  PID:2780
- - C:\6c3dfc7293b5537f042c271533\Setup.exe
    C:\6c3dfc7293b5537f042c271533\\Setup.exe /q /norestart /x86 /x64 /redist
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:272
  - - C:\6c3dfc7293b5537f042c271533\SetupUtility.exe
      SetupUtility.exe /screboot
      4⤵
      Executes dropped EXE
      PID:2692

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies firewall policy service
- Manipulates Digital Signatures
- Modifies Installed Components in the registry
- Loads dropped DLL
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding B6B75796D9DB5215A024A171B62086FC
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Windows\system32\lodctr.exe
    "C:\Windows\system32\lodctr.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\netmemorycache.ini"
    3⤵
    PID:952
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe" -iru
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Modifies registry class
    PID:1988
  - - C:\Windows\system32\wbem\mofcomp.exe
      mofcomp C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet.mof
      4⤵
      Drops file in System32 directory
      PID:1496
- - C:\Windows\system32\lodctr.exe
    "C:\Windows\system32\lodctr.exe" /m:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelPerformanceCounters.man"
    3⤵
    PID:1684
- - C:\Windows\system32\lodctr.exe
    "C:\Windows\system32\lodctr.exe" /m:"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WorkflowServiceHostPerformanceCounters.man"
    3⤵
    PID:2684
- - C:\Windows\system32\lodctr.exe
    "C:\Windows\system32\lodctr.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\_SMSvcHostPerfCounters.ini"
    3⤵
    - Drops file in Windows directory
    PID:2456
- - C:\Windows\system32\lodctr.exe
    "C:\Windows\system32\lodctr.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\_TransactionBridgePerfCounters.ini"
    3⤵
    PID:1652
- - C:\Windows\system32\lodctr.exe
    "C:\Windows\system32\lodctr.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\PerfCounters.ini"
    3⤵
    - Drops file in Windows directory
    PID:1632
- - C:\Windows\system32\lodctr.exe
    "C:\Windows\system32\lodctr.exe" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\_Networkingperfcounters.ini
    3⤵
    PID:2260
- - C:\Windows\system32\lodctr.exe
    "C:\Windows\system32\lodctr.exe" C:\Windows\Microsoft.NET\Framework64\v4.0.30319\_DataOracleClientPerfCounters_shared12_neutral.ini
    3⤵
    PID:2752
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    - Executes dropped EXE
    PID:2908
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems 1
    3⤵
    - Executes dropped EXE
    PID:1956
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 130 -InterruptEvent 0 -NGENProcess e8 -Pipe f4 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:2180
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 130 -InterruptEvent 0 -NGENProcess f0 -Pipe e8 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:1380
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F8461CD46EA442813885777EAD34D9FE
  2⤵
  - Loads dropped DLL
  PID:1528
- - C:\Windows\SysWOW64\lodctr.exe
    "C:\Windows\SysWOW64\lodctr.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\netmemorycache.ini"
    3⤵
    PID:1916
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis.exe" -iru
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    PID:2056
  - - C:\Windows\SysWOW64\wbem\mofcomp.exe
      mofcomp C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet.mof
      4⤵
      Drops file in System32 directory
      PID:2268
- - C:\Windows\SysWOW64\lodctr.exe
    "C:\Windows\SysWOW64\lodctr.exe" /m:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelPerformanceCounters.man"
    3⤵
    PID:1028
- - C:\Windows\SysWOW64\lodctr.exe
    "C:\Windows\SysWOW64\lodctr.exe" /m:"C:\Windows\Microsoft.NET\Framework\v4.0.30319\WorkflowServiceHostPerformanceCounters.man"
    3⤵
    PID:1972
- - C:\Windows\SysWOW64\lodctr.exe
    "C:\Windows\SysWOW64\lodctr.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\_SMSvcHostPerfCounters.ini"
    3⤵
    - Drops file in Windows directory
    PID:1232
- - C:\Windows\SysWOW64\lodctr.exe
    "C:\Windows\SysWOW64\lodctr.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\_TransactionBridgePerfCounters.ini"
    3⤵
    - Drops file in Windows directory
    PID:1640
- - C:\Windows\SysWOW64\lodctr.exe
    "C:\Windows\SysWOW64\lodctr.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\PerfCounters.ini"
    3⤵
    PID:2384
- - C:\Windows\SysWOW64\lodctr.exe
    "C:\Windows\SysWOW64\lodctr.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\_Networkingperfcounters.ini
    3⤵
    PID:2084
- - C:\Windows\SysWOW64\lodctr.exe
    "C:\Windows\SysWOW64\lodctr.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\_DataOracleClientPerfCounters_shared12_neutral.ini
    3⤵
    PID:2396
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    - Executes dropped EXE
    PID:1684
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe executeQueuedItems 1
    3⤵
    - Executes dropped EXE
    PID:2768
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 144 -InterruptEvent 0 -NGENProcess 104 -Pipe 110 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:2496
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 10c -InterruptEvent 0 -NGENProcess 1a4 -Pipe 1a8 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:3064
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 190 -InterruptEvent 0 -NGENProcess 1ac -Pipe 1a4 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:688
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1b0 -InterruptEvent 0 -NGENProcess 1b4 -Pipe 190 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:1704
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 19c -InterruptEvent 0 -NGENProcess 1a0 -Pipe 1b4 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:3044
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 0 -NGENProcess 1b0 -Pipe 1a0 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:2220
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 0 -NGENProcess 19c -Pipe 1b0 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:1616
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 19c -InterruptEvent 0 -NGENProcess 144 -Pipe 1bc -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:868
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 144 -InterruptEvent 0 -NGENProcess 1c0 -Pipe 19c -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:1680
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 104 -InterruptEvent 0 -NGENProcess 1b8 -Pipe 1c0 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:2428
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 0 -NGENProcess 144 -Pipe 1b8 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:1432
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 0 -NGENProcess 104 -Pipe 144 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:1204
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 0 -NGENProcess 1cc -Pipe 104 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:268
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 0 -NGENProcess 1d0 -Pipe 1cc -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:2868
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 0 -NGENProcess 1d4 -Pipe 1d0 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:2920
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 0 -NGENProcess 1d8 -Pipe 1d4 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:2264
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 0 -NGENProcess 1dc -Pipe 1d8 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:1500
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 0 -NGENProcess 1ec -Pipe 1e4 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:628
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 0 -NGENProcess 1dc -Pipe 1e8 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:1484
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 0 -NGENProcess 1ac -Pipe 1ec -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:2032
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 0 -NGENProcess 1c8 -Pipe 1dc -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:1092
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 0 -NGENProcess 1c4 -Pipe 1ac -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:2020
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 0 -NGENProcess 1e0 -Pipe 1c8 -Comment "NGen Worker Process"
      4⤵
      Executes dropped EXE
      PID:1188
- C:\Windows\system32\MsiExec.exe
  C:\Windows\system32\MsiExec.exe -Embedding 5C0F2EA8E1C105C9F1A74E3209D23134 M Global\MSI0000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe" -msi -ia -v
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Windows\system32\wevtutil.exe
      um C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.45.man
      4⤵
      PID:1992
  - - C:\Windows\system32\wevtutil.exe
      im C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Windows.ApplicationServer.Applications.45.man
      4⤵
      PID:2056
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.JScript.tlb"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:2976
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoree.tlb"
    3⤵
    - Executes dropped EXE
    PID:1728
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorlib.tlb"
    3⤵
    - Executes dropped EXE
    PID:884
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Drawing.tlb"
    3⤵
    - Executes dropped EXE
    PID:2300
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.EnterpriseServices.tlb"
    3⤵
    - Executes dropped EXE
    PID:1748
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.tlb"
    3⤵
    - Executes dropped EXE
    PID:2576
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.Windows.Forms.tlb"
    3⤵
    - Executes dropped EXE
    PID:932
- - C:\Windows\system32\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MOF\ServiceModel.mof"
    3⤵
    - Drops file in System32 directory
    PID:2652
- - C:\Windows\system32\wbem\mofcomp.exe
    "C:\Windows\system32\wbem\mofcomp.exe" "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MOF\ServiceModel35.mof"
    3⤵
    - Drops file in System32 directory
    PID:696
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FEDF717418D054C08699178059E9175E M Global\MSI0000
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2072
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe" -msi -ia -v
    3⤵
    - Executes dropped EXE
    PID:2080
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.JScript.tlb"
    3⤵
    - Executes dropped EXE
    PID:2308
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.tlb"
    3⤵
    - Executes dropped EXE
    PID:972
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorlib.tlb"
    3⤵
    - Executes dropped EXE
    PID:2152
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Drawing.tlb"
    3⤵
    - Executes dropped EXE
    PID:2208
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.EnterpriseServices.tlb"
    3⤵
    - Executes dropped EXE
    PID:556
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.tlb"
    3⤵
    - Executes dropped EXE
    PID:868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\System.Windows.Forms.tlb"
    3⤵
    - Executes dropped EXE
    PID:2436
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\SysWOW64\wbem\mofcomp.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MOF\ServiceModel.mof"
    3⤵
    - Drops file in System32 directory
    PID:2248
- - C:\Windows\SysWOW64\wbem\mofcomp.exe
    "C:\Windows\SysWOW64\wbem\mofcomp.exe" "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MOF\ServiceModel35.mof"
    3⤵
    - Drops file in System32 directory
    PID:1380

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:1904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 198 -InterruptEvent 184 -NGENProcess 188 -Pipe 194 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 190 -InterruptEvent 1fc -NGENProcess 204 -Pipe 208 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 200 -NGENProcess 1f4 -Pipe 1fc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 184 -NGENProcess 1a0 -Pipe 198 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 188 -InterruptEvent 184 -NGENProcess 1f8 -Pipe 200 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1f8 -NGENProcess 204 -Pipe 210 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 214 -NGENProcess 220 -Pipe 1e8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 214 -NGENProcess 1f4 -Pipe 14c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2880
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f8 -InterruptEvent 20c -NGENProcess 1e4 -Pipe 21c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1464
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1a0 -InterruptEvent 224 -NGENProcess 218 -Pipe 1f8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 184 -InterruptEvent 1f4 -NGENProcess 228 -Pipe 1a0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:1080
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 1e4 -NGENProcess 22c -Pipe 184 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 1e4 -NGENProcess 220 -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:2188
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 150 -NGENProcess 234 -Pipe 204 -Comment "NGen Worker Process"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 22c -NGENProcess 238 -Pipe 214 -Comment "NGen Worker Process"
  2⤵
  PID:2080
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 20c -NGENProcess 23c -Pipe 220 -Comment "NGen Worker Process"
  2⤵
  PID:3028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 20c -InterruptEvent 1f4 -NGENProcess 238 -Pipe 218 -Comment "NGen Worker Process"
  2⤵
  PID:1908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 20c -NGENProcess 224 -Pipe 22c -Comment "NGen Worker Process"
  2⤵
  PID:776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 230 -NGENProcess 248 -Pipe 1f4 -Comment "NGen Worker Process"
  2⤵
  PID:2456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 240 -NGENProcess 24c -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  PID:1932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 250 -NGENProcess 248 -Pipe 150 -Comment "NGen Worker Process"
  2⤵
  PID:848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 248 -NGENProcess 234 -Pipe 20c -Comment "NGen Worker Process"
  2⤵
  PID:2288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 230 -NGENProcess 258 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  PID:1664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 244 -NGENProcess 25c -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  PID:2172
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 260 -NGENProcess 258 -Pipe 224 -Comment "NGen Worker Process"
  2⤵
  PID:1496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 238 -NGENProcess 264 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:2824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 230 -InterruptEvent 238 -NGENProcess 24c -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:2832
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 234 -NGENProcess 26c -Pipe 230 -Comment "NGen Worker Process"
  2⤵
  PID:660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 234 -NGENProcess 23c -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  PID:1736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 268 -NGENProcess 274 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  PID:2992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 26c -NGENProcess 278 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  - Drops file in Windows directory
  PID:2028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 23c -NGENProcess 27c -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  PID:1792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 274 -NGENProcess 280 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  PID:1656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 278 -NGENProcess 284 -Pipe 238 -Comment "NGen Worker Process"
  2⤵
  PID:1560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 234 -InterruptEvent 27c -NGENProcess 288 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  PID:1912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 280 -NGENProcess 28c -Pipe 234 -Comment "NGen Worker Process"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  PID:2320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 284 -NGENProcess 290 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  PID:628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 284 -NGENProcess 26c -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 270 -NGENProcess 298 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  PID:484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 290 -NGENProcess 29c -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  PID:904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 26c -NGENProcess 2a0 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:1212
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 298 -NGENProcess 2a4 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:2072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2a4 -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  PID:2304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 2b0 -NGENProcess 2a4 -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  PID:2636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 298 -NGENProcess 284 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  PID:608
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 288 -NGENProcess 2b4 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  PID:2380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 288 -NGENProcess 2a8 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  PID:1504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 280 -NGENProcess 2bc -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  PID:3020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2c0 -NGENProcess 2a8 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  PID:436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 270 -NGENProcess 2c4 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2a4 -NGENProcess 2c8 -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  PID:2956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2cc -NGENProcess 2c4 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  PID:2668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2d0 -NGENProcess 2c0 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  PID:2916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2d4 -NGENProcess 2c8 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  PID:2056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2d4 -NGENProcess 2d0 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  PID:932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2e0 -NGENProcess 2d4 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  PID:1432
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2d8 -NGENProcess 2a8 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  PID:2068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 288 -NGENProcess 2e4 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  PID:588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2d4 -NGENProcess 2e8 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:2868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2a8 -NGENProcess 2ec -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  PID:1908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2e4 -NGENProcess 2f0 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  PID:2776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2e8 -NGENProcess 2f4 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  PID:2536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2dc -NGENProcess 2f8 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:1700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2f0 -NGENProcess 2fc -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:2460
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f4 -NGENProcess 300 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:1784
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2f8 -NGENProcess 304 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  PID:1412
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2fc -NGENProcess 308 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  PID:576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2fc -NGENProcess 2e4 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:2744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2e4 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:2072
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2ec -NGENProcess 314 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:3036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 310 -NGENProcess 318 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:1128
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2e4 -NGENProcess 31c -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 314 -NGENProcess 320 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:2116
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 324 -NGENProcess 31c -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 30c -NGENProcess 310 -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  PID:1436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 314 -NGENProcess 32c -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:2780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2e8 -NGENProcess 330 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:1536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 310 -NGENProcess 334 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 32c -NGENProcess 338 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 32c -NGENProcess 320 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:3008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 300 -NGENProcess 340 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:2096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 338 -NGENProcess 344 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:2368
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 154 -NGENProcess 320 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 154 -InterruptEvent 310 -NGENProcess 338 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 34c -NGENProcess 32c -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:1912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 154 -NGENProcess 350 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:1676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 320 -NGENProcess 354 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  PID:2256
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 32c -NGENProcess 358 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:2484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 350 -NGENProcess 35c -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:2536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 350 -NGENProcess 338 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:1664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 348 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:1088
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 154 -InterruptEvent 360 -NGENProcess 368 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 338 -NGENProcess 36c -Pipe 154 -Comment "NGen Worker Process"
  2⤵
  PID:1588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 348 -NGENProcess 370 -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  PID:2804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 348 -NGENProcess 32c -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:2328
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 348 -NGENProcess 354 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:2900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 348 -NGENProcess 314 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 378 -NGENProcess 380 -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:2304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 354 -NGENProcess 384 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  - Drops file in Windows directory
  - Modifies data under HKEY_USERS
  PID:608
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 338 -NGENProcess 380 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 388 -NGENProcess 38c -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 364 -NGENProcess 380 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1900
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 390 -NGENProcess 394 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:2584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 374 -NGENProcess 394 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:1976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 384 -NGENProcess 39c -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2312
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 364 -NGENProcess 3a0 -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 3a0 -NGENProcess 394 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:1812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 38c -NGENProcess 3a8 -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:2344
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 384 -NGENProcess 3ac -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:1500
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 394 -NGENProcess 3b0 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:3048
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3b4 -NGENProcess 3ac -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:1456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 348 -NGENProcess 3b8 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:1576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 38c -NGENProcess 3bc -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:2612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3ac -NGENProcess 3c0 -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:2636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3ac -NGENProcess 3a0 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:2100
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 3a8 -NGENProcess 3c8 -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:2304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 3cc -NGENProcess 3a0 -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  PID:2976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 338 -NGENProcess 3d0 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:1612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3b8 -NGENProcess 3d4 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:2784
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d0 -NGENProcess 3ac -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:2992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 38c -NGENProcess 3e4 -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  PID:2020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 338 -NGENProcess 3e8 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  PID:2668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3ac -NGENProcess 3ec -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  PID:2248
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3ac -NGENProcess 3c4 -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  PID:636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3f4 -NGENProcess 3ec -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3c8 -NGENProcess 3f8 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:1432
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 338 -NGENProcess 3fc -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  PID:2220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3ec -NGENProcess 404 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  PID:2852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3c0 -NGENProcess 404 -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:2288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 40c -NGENProcess 408 -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  PID:1112
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 40c -NGENProcess 3c0 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 414 -NGENProcess 408 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:1172
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 3ec -NGENProcess 404 -Pipe 3fc -Comment "NGen Worker Process"
  2⤵
  PID:1496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 40c -NGENProcess 41c -Pipe 414 -Comment "NGen Worker Process"
  2⤵
  PID:1636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 410 -NGENProcess 420 -Pipe 418 -Comment "NGen Worker Process"
  2⤵
  PID:2928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 424 -NGENProcess 41c -Pipe 3f8 -Comment "NGen Worker Process"
  2⤵
  PID:576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 41c -NGENProcess 3c8 -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  PID:1940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 428 -NGENProcess 434 -Pipe 424 -Comment "NGen Worker Process"
  2⤵
  PID:956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 438 -NGENProcess 3c8 -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  PID:3036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 430 -NGENProcess 43c -Pipe 428 -Comment "NGen Worker Process"
  2⤵
  PID:1504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 42c -NGENProcess 440 -Pipe 420 -Comment "NGen Worker Process"
  2⤵
  PID:1436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 3c8 -NGENProcess 444 -Pipe 41c -Comment "NGen Worker Process"
  2⤵
  PID:2848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 43c -NGENProcess 448 -Pipe 40c -Comment "NGen Worker Process"
  2⤵
  PID:1536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 43c -NGENProcess 434 -Pipe 444 -Comment "NGen Worker Process"
  2⤵
  PID:1648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 408 -NGENProcess 450 -Pipe 410 -Comment "NGen Worker Process"
  2⤵
  PID:1828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 448 -NGENProcess 454 -Pipe 438 -Comment "NGen Worker Process"
  2⤵
  PID:1468
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 44c -NGENProcess 454 -Pipe 450 -Comment "NGen Worker Process"
  2⤵
  PID:1996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 448 -NGENProcess 45c -Pipe 458 -Comment "NGen Worker Process"
  2⤵
  PID:112
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 460 -NGENProcess 454 -Pipe 440 -Comment "NGen Worker Process"
  2⤵
  PID:968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 464 -NGENProcess 430 -Pipe 43c -Comment "NGen Worker Process"
  2⤵
  PID:2776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 3c8 -NGENProcess 448 -Pipe 45c -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 46c -NGENProcess 44c -Pipe 460 -Comment "NGen Worker Process"
  2⤵
  PID:1208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 464 -NGENProcess 470 -Pipe 434 -Comment "NGen Worker Process"
  2⤵
  PID:2524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 464 -NGENProcess 454 -Pipe 44c -Comment "NGen Worker Process"
  2⤵
  PID:2420
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 408 -NGENProcess 470 -Pipe 468 -Comment "NGen Worker Process"
  2⤵
  PID:1636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 478 -NGENProcess 448 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:2928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 47c -NGENProcess 454 -Pipe 474 -Comment "NGen Worker Process"
  2⤵
  PID:2404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 408 -NGENProcess 484 -Pipe 478 -Comment "NGen Worker Process"
  2⤵
  PID:2572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 488 -NGENProcess 454 -Pipe 42c -Comment "NGen Worker Process"
  2⤵
  PID:3024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 490 -NGENProcess 488 -Pipe 464 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 408 -NGENProcess 430 -Pipe 448 -Comment "NGen Worker Process"
  2⤵
  PID:2200
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 408 -NGENProcess 47c -Pipe 488 -Comment "NGen Worker Process"
  2⤵
  PID:1988
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 470 -NGENProcess 498 -Pipe 484 -Comment "NGen Worker Process"
  2⤵
  PID:2080
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 430 -NGENProcess 49c -Pipe 454 -Comment "NGen Worker Process"
  2⤵
  PID:2724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 430 -NGENProcess 46c -Pipe 498 -Comment "NGen Worker Process"
  2⤵
  PID:1524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 494 -NGENProcess 4a4 -Pipe 48c -Comment "NGen Worker Process"
  2⤵
  PID:2068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 4a0 -NGENProcess 4a8 -Pipe 490 -Comment "NGen Worker Process"
  2⤵
  PID:2548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 46c -NGENProcess 4ac -Pipe 480 -Comment "NGen Worker Process"
  2⤵
  PID:1380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 4a4 -NGENProcess 4b0 -Pipe 408 -Comment "NGen Worker Process"
  2⤵
  PID:1192
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 4a8 -NGENProcess 4b4 -Pipe 470 -Comment "NGen Worker Process"
  2⤵
  PID:2220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 4ac -NGENProcess 4b8 -Pipe 47c -Comment "NGen Worker Process"
  2⤵
  PID:1268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 4b0 -NGENProcess 4bc -Pipe 430 -Comment "NGen Worker Process"
  2⤵
  PID:1992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a0 -InterruptEvent 4b0 -NGENProcess 494 -Pipe 4b8 -Comment "NGen Worker Process"
  2⤵
  PID:1908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4c4 -NGENProcess 4bc -Pipe 46c -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4c0 -NGENProcess 4a0 -Pipe 4ac -Comment "NGen Worker Process"
  2⤵
  PID:944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 4cc -NGENProcess 4a4 -Pipe 4b0 -Comment "NGen Worker Process"
  2⤵
  PID:1036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 4c4 -NGENProcess 4d0 -Pipe 4b4 -Comment "NGen Worker Process"
  2⤵
  PID:1396
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c4 -InterruptEvent 4bc -NGENProcess 4a4 -Pipe 4a8 -Comment "NGen Worker Process"
  2⤵
  PID:904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 4a4 -NGENProcess 4a0 -Pipe 4d8 -Comment "NGen Worker Process"
  2⤵
  PID:2832
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 494 -NGENProcess 4dc -Pipe 4bc -Comment "NGen Worker Process"
  2⤵
  PID:1572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 4d4 -NGENProcess 4e0 -Pipe 4c8 -Comment "NGen Worker Process"
  2⤵
  PID:2596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4a0 -NGENProcess 4e4 -Pipe 49c -Comment "NGen Worker Process"
  2⤵
  PID:2024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4dc -NGENProcess 4e8 -Pipe 4c0 -Comment "NGen Worker Process"
  2⤵
  PID:2572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c4 -InterruptEvent 4e0 -NGENProcess 4ec -Pipe 4d0 -Comment "NGen Worker Process"
  2⤵
  PID:2844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a4 -InterruptEvent 4e4 -NGENProcess 4f0 -Pipe 4c4 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 4e8 -NGENProcess 4f4 -Pipe 4a4 -Comment "NGen Worker Process"
  2⤵
  PID:2592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 4f8 -NGENProcess 4f0 -Pipe 4d4 -Comment "NGen Worker Process"
  2⤵
  PID:1536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 4f0 -NGENProcess 4ec -Pipe 4fc -Comment "NGen Worker Process"
  2⤵
  PID:2528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e4 -InterruptEvent 4f0 -NGENProcess 4f8 -Pipe 4a0 -Comment "NGen Worker Process"
  2⤵
  PID:2428
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4e0 -NGENProcess 504 -Pipe 4e4 -Comment "NGen Worker Process"
  2⤵
  PID:2956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 4ec -NGENProcess 508 -Pipe 4dc -Comment "NGen Worker Process"
  2⤵
  PID:2952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4ec -InterruptEvent 50c -NGENProcess 504 -Pipe 4cc -Comment "NGen Worker Process"
  2⤵
  PID:2280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 4f4 -NGENProcess 510 -Pipe 4ec -Comment "NGen Worker Process"
  2⤵
  PID:2492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 4f0 -NGENProcess 514 -Pipe 4e8 -Comment "NGen Worker Process"
  2⤵
  PID:2964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 504 -NGENProcess 518 -Pipe 4e0 -Comment "NGen Worker Process"
  2⤵
  PID:928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 510 -NGENProcess 51c -Pipe 494 -Comment "NGen Worker Process"
  2⤵
  PID:1960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 510 -NGENProcess 508 -Pipe 518 -Comment "NGen Worker Process"
  2⤵
  PID:112
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 4f8 -NGENProcess 524 -Pipe 500 -Comment "NGen Worker Process"
  2⤵
  PID:1016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 528 -NGENProcess 508 -Pipe 4f4 -Comment "NGen Worker Process"
  2⤵
  PID:2372
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 52c -NGENProcess 514 -Pipe 4f0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2364
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 51c -NGENProcess 524 -Pipe 4f8 -Comment "NGen Worker Process"
  2⤵
  PID:1820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 520 -InterruptEvent 50c -NGENProcess 510 -Pipe 52c -Comment "NGen Worker Process"
  2⤵
  PID:1888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 528 -NGENProcess 538 -Pipe 520 -Comment "NGen Worker Process"
  2⤵
  PID:864
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 514 -NGENProcess 510 -Pipe 504 -Comment "NGen Worker Process"
  2⤵
  PID:1812
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 540 -NGENProcess 50c -Pipe 53c -Comment "NGen Worker Process"
  2⤵
  PID:1124
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 50c -NGENProcess 508 -Pipe 544 -Comment "NGen Worker Process"
  2⤵
  PID:272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 548 -NGENProcess 534 -Pipe 538 -Comment "NGen Worker Process"
  2⤵
  PID:2744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 540 -NGENProcess 54c -Pipe 50c -Comment "NGen Worker Process"
  2⤵
  PID:956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 540 -NGENProcess 530 -Pipe 534 -Comment "NGen Worker Process"
  2⤵
  PID:1668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 554 -NGENProcess 54c -Pipe 510 -Comment "NGen Worker Process"
  2⤵
  PID:2568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 528 -NGENProcess 558 -Pipe 540 -Comment "NGen Worker Process"
  2⤵
  PID:436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 528 -NGENProcess 508 -Pipe 54c -Comment "NGen Worker Process"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 514 -NGENProcess 560 -Pipe 524 -Comment "NGen Worker Process"
  2⤵
  PID:1988
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 514 -NGENProcess 51c -Pipe 508 -Comment "NGen Worker Process"
  2⤵
  PID:2532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 568 -NGENProcess 560 -Pipe 550 -Comment "NGen Worker Process"
  2⤵
  PID:2464
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 570 -NGENProcess 568 -Pipe 564 -Comment "NGen Worker Process"
  2⤵
  PID:2588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 514 -NGENProcess 554 -Pipe 528 -Comment "NGen Worker Process"
  2⤵
  PID:1624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 514 -NGENProcess 558 -Pipe 568 -Comment "NGen Worker Process"
  2⤵
  PID:2292
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 55c -NGENProcess 578 -Pipe 51c -Comment "NGen Worker Process"
  2⤵
  PID:2084
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 57c -NGENProcess 558 -Pipe 548 -Comment "NGen Worker Process"
  2⤵
  PID:2272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 580 -NGENProcess 530 -Pipe 56c -Comment "NGen Worker Process"
  2⤵
  PID:2964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 580 -NGENProcess 57c -Pipe 578 -Comment "NGen Worker Process"
  2⤵
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 560 -NGENProcess 588 -Pipe 514 -Comment "NGen Worker Process"
  2⤵
  PID:808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 570 -NGENProcess 57c -Pipe 558 -Comment "NGen Worker Process"
  2⤵
  PID:2776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 574 -NGENProcess 590 -Pipe 560 -Comment "NGen Worker Process"
  2⤵
  PID:1740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 580 -NGENProcess 594 -Pipe 58c -Comment "NGen Worker Process"
  2⤵
  PID:2372
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 580 -InterruptEvent 598 -NGENProcess 590 -Pipe 584 -Comment "NGen Worker Process"
  2⤵
  PID:1092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 554 -NGENProcess 59c -Pipe 580 -Comment "NGen Worker Process"
  2⤵
  PID:396
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 57c -NGENProcess 5a0 -Pipe 55c -Comment "NGen Worker Process"
  2⤵
  PID:688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 588 -InterruptEvent 590 -NGENProcess 5a4 -Pipe 574 -Comment "NGen Worker Process"
  2⤵
  PID:484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 594 -InterruptEvent 590 -NGENProcess 588 -Pipe 5a0 -Comment "NGen Worker Process"
  2⤵
  PID:2276
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 570 -NGENProcess 5ac -Pipe 594 -Comment "NGen Worker Process"
  2⤵
  PID:1128
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 5a4 -NGENProcess 5b0 -Pipe 530 -Comment "NGen Worker Process"
  2⤵
  PID:2756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 588 -NGENProcess 5b4 -Pipe 598 -Comment "NGen Worker Process"
  2⤵
  PID:2136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 5ac -NGENProcess 5b8 -Pipe 554 -Comment "NGen Worker Process"
  2⤵
  PID:2940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 5b0 -NGENProcess 5bc -Pipe 57c -Comment "NGen Worker Process"
  2⤵
  PID:2800
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b0 -InterruptEvent 5c0 -NGENProcess 5b8 -Pipe 590 -Comment "NGen Worker Process"
  2⤵
  PID:1728
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 59c -NGENProcess 5c4 -Pipe 5b0 -Comment "NGen Worker Process"
  2⤵
  PID:2496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5ac -InterruptEvent 59c -NGENProcess 570 -Pipe 5b8 -Comment "NGen Worker Process"
  2⤵
  PID:1436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 5a4 -NGENProcess 5c4 -Pipe 5bc -Comment "NGen Worker Process"
  2⤵
  PID:2268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5cc -InterruptEvent 5ac -NGENProcess 5d0 -Pipe 59c -Comment "NGen Worker Process"
  2⤵
  PID:2916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5a8 -InterruptEvent 5ac -NGENProcess 5cc -Pipe 5c4 -Comment "NGen Worker Process"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c8 -InterruptEvent 5ac -NGENProcess 5a8 -Pipe 5d0 -Comment "NGen Worker Process"
  2⤵
  PID:2668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 5d4 -NGENProcess 5dc -Pipe 5c8 -Comment "NGen Worker Process"
  2⤵
  PID:2588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d4 -InterruptEvent 5e0 -NGENProcess 5a8 -Pipe 570 -Comment "NGen Worker Process"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 5c0 -NGENProcess 5e4 -Pipe 5d4 -Comment "NGen Worker Process"
  2⤵
  PID:2292
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5ac -InterruptEvent 5b4 -NGENProcess 5e8 -Pipe 5a4 -Comment "NGen Worker Process"
  2⤵
  PID:2288
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 588 -InterruptEvent 5a8 -NGENProcess 5ec -Pipe 5ac -Comment "NGen Worker Process"
  2⤵
  PID:2416
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5dc -InterruptEvent 5e4 -NGENProcess 5f0 -Pipe 588 -Comment "NGen Worker Process"
  2⤵
  PID:2656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 5e8 -NGENProcess 5f4 -Pipe 5dc -Comment "NGen Worker Process"
  2⤵
  PID:2988
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5e0 -InterruptEvent 5e8 -NGENProcess 5d8 -Pipe 5f0 -Comment "NGen Worker Process"
  2⤵
  PID:1064
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 5cc -NGENProcess 5fc -Pipe 5e0 -Comment "NGen Worker Process"
  2⤵
  PID:2524
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 5f4 -NGENProcess 600 -Pipe 5c0 -Comment "NGen Worker Process"
  2⤵
  PID:1496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5a8 -InterruptEvent 5d8 -NGENProcess 604 -Pipe 5b4 -Comment "NGen Worker Process"
  2⤵
  PID:944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5e4 -InterruptEvent 5d8 -NGENProcess 5a8 -Pipe 600 -Comment "NGen Worker Process"
  2⤵
  PID:2732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 60c -NGENProcess 604 -Pipe 5ec -Comment "NGen Worker Process"
  2⤵
  PID:1556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 60c -InterruptEvent 610 -NGENProcess 5f4 -Pipe 5e8 -Comment "NGen Worker Process"
  2⤵
  PID:2832
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5fc -InterruptEvent 5d8 -NGENProcess 614 -Pipe 60c -Comment "NGen Worker Process"
  2⤵
  PID:1748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 608 -InterruptEvent 5a8 -NGENProcess 618 -Pipe 5fc -Comment "NGen Worker Process"
  2⤵
  PID:2928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5a8 -InterruptEvent 61c -NGENProcess 614 -Pipe 5cc -Comment "NGen Worker Process"
  2⤵
  PID:2636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 604 -InterruptEvent 608 -NGENProcess 620 -Pipe 5a8 -Comment "NGen Worker Process"
  2⤵
  PID:2304
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 610 -NGENProcess 624 -Pipe 604 -Comment "NGen Worker Process"
  2⤵
  PID:1860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 610 -InterruptEvent 628 -NGENProcess 620 -Pipe 5f8 -Comment "NGen Worker Process"
  2⤵
  PID:2380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 618 -InterruptEvent 628 -NGENProcess 610 -Pipe 61c -Comment "NGen Worker Process"
  2⤵
  PID:2352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 608 -InterruptEvent 614 -NGENProcess 630 -Pipe 618 -Comment "NGen Worker Process"
  2⤵
  PID:3032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5e4 -InterruptEvent 620 -NGENProcess 634 -Pipe 608 -Comment "NGen Worker Process"
  2⤵
  PID:3020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 610 -NGENProcess 638 -Pipe 5e4 -Comment "NGen Worker Process"
  2⤵
  PID:2200
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 630 -NGENProcess 63c -Pipe 624 -Comment "NGen Worker Process"
  2⤵
  PID:1528
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 630 -NGENProcess 5f4 -Pipe 638 -Comment "NGen Worker Process"
  2⤵
  PID:1872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 628 -InterruptEvent 62c -NGENProcess 644 -Pipe 5d8 -Comment "NGen Worker Process"
  2⤵
  PID:2028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 614 -InterruptEvent 63c -NGENProcess 648 -Pipe 628 -Comment "NGen Worker Process"
  2⤵
  PID:2456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 620 -InterruptEvent 5f4 -NGENProcess 64c -Pipe 614 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 610 -InterruptEvent 644 -NGENProcess 650 -Pipe 620 -Comment "NGen Worker Process"
  2⤵
  PID:2272
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 644 -NGENProcess 610 -Pipe 64c -Comment "NGen Worker Process"
  2⤵
  PID:2016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 644 -InterruptEvent 630 -NGENProcess 650 -Pipe 62c -Comment "NGen Worker Process"
  2⤵
  PID:1192
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 658 -InterruptEvent 634 -NGENProcess 65c -Pipe 644 -Comment "NGen Worker Process"
  2⤵
  PID:1492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 63c -NGENProcess 650 -Pipe 654 -Comment "NGen Worker Process"
  2⤵
  PID:2384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 63c -InterruptEvent 660 -NGENProcess 630 -Pipe 5f4 -Comment "NGen Worker Process"
  2⤵
  PID:2172
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 664 -InterruptEvent 634 -NGENProcess 668 -Pipe 63c -Comment "NGen Worker Process"
  2⤵
  PID:1164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 65c -NGENProcess 66c -Pipe 664 -Comment "NGen Worker Process"
  2⤵
  PID:1132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 670 -NGENProcess 668 -Pipe 648 -Comment "NGen Worker Process"
  2⤵
  PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 670 -InterruptEvent 674 -NGENProcess 660 -Pipe 610 -Comment "NGen Worker Process"
  2⤵
  PID:688
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 674 -InterruptEvent 660 -NGENProcess 640 -Pipe 678 -Comment "NGen Worker Process"
  2⤵
  PID:1036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 658 -InterruptEvent 65c -NGENProcess 67c -Pipe 674 -Comment "NGen Worker Process"
  2⤵
  PID:1556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 650 -InterruptEvent 634 -NGENProcess 680 -Pipe 658 -Comment "NGen Worker Process"
  2⤵
  PID:2832
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 680 -NGENProcess 66c -Pipe 684 -Comment "NGen Worker Process"
  2⤵
  PID:904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 640 -NGENProcess 688 -Pipe 634 -Comment "NGen Worker Process"
  2⤵
  PID:660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 670 -InterruptEvent 668 -NGENProcess 68c -Pipe 630 -Comment "NGen Worker Process"
  2⤵
  PID:2240
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 68c -InterruptEvent 67c -NGENProcess 688 -Pipe 66c -Comment "NGen Worker Process"
  2⤵
  PID:2824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 688 -NGENProcess 660 -Pipe 640 -Comment "NGen Worker Process"
  2⤵
  PID:2116
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6ac -InterruptEvent 6a4 -NGENProcess 6b0 -Pipe 67c -Comment "NGen Worker Process"
  2⤵
  PID:2876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 698 -NGENProcess 6b4 -Pipe 6ac -Comment "NGen Worker Process"
  2⤵
  PID:1060
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 6b8 -NGENProcess 6b0 -Pipe 690 -Comment "NGen Worker Process"
  2⤵
  PID:2652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b8 -InterruptEvent 69c -NGENProcess 688 -Pipe 6a4 -Comment "NGen Worker Process"
  2⤵
  PID:2532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6bc -InterruptEvent 698 -NGENProcess 6c0 -Pipe 6b8 -Comment "NGen Worker Process"
  2⤵
  PID:2464
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 6a8 -NGENProcess 688 -Pipe 660 -Comment "NGen Worker Process"
  2⤵
  PID:2552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 6a8 -NGENProcess 698 -Pipe 69c -Comment "NGen Worker Process"
  2⤵
  PID:2184
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b4 -InterruptEvent 68c -NGENProcess 6cc -Pipe 6c4 -Comment "NGen Worker Process"
  2⤵
  PID:1932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 688 -NGENProcess 6d0 -Pipe 6b4 -Comment "NGen Worker Process"
  2⤵
  PID:2492
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 698 -NGENProcess 6d4 -Pipe 6a0 -Comment "NGen Worker Process"
  2⤵
  PID:2012
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 6d8 -NGENProcess 6d0 -Pipe 6c0 -Comment "NGen Worker Process"
  2⤵
  PID:2220
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6d8 -InterruptEvent 6bc -NGENProcess 68c -Pipe 688 -Comment "NGen Worker Process"
  2⤵
  PID:1692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6dc -InterruptEvent 698 -NGENProcess 6e0 -Pipe 6d8 -Comment "NGen Worker Process"
  2⤵
  PID:2320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 6a8 -NGENProcess 68c -Pipe 6cc -Comment "NGen Worker Process"
  2⤵
  PID:2392
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 6a8 -NGENProcess 698 -Pipe 6bc -Comment "NGen Worker Process"
  2⤵
  PID:1644
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a8 -InterruptEvent 698 -NGENProcess 6e8 -Pipe 6ec -Comment "NGen Worker Process"
  2⤵
  PID:752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 6c8 -NGENProcess 6f0 -Pipe 6a8 -Comment "NGen Worker Process"
  2⤵
  PID:944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 6d0 -NGENProcess 6e8 -Pipe 6e0 -Comment "NGen Worker Process"
  2⤵
  PID:672
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6f4 -InterruptEvent 6b0 -NGENProcess 6f8 -Pipe 6c8 -Comment "NGen Worker Process"
  2⤵
  PID:2488
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 6dc -NGENProcess 6e8 -Pipe 68c -Comment "NGen Worker Process"
  2⤵
  PID:2720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6dc -InterruptEvent 6fc -NGENProcess 6d0 -Pipe 6e4 -Comment "NGen Worker Process"
  2⤵
  PID:1036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 6b0 -NGENProcess 704 -Pipe 6dc -Comment "NGen Worker Process"
  2⤵
  PID:1748
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 708 -NGENProcess 6d0 -Pipe 6d4 -Comment "NGen Worker Process"
  2⤵
  PID:1968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 70c -InterruptEvent 708 -NGENProcess 6b0 -Pipe 6e8 -Comment "NGen Worker Process"
  2⤵
  PID:904
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 708 -InterruptEvent 6fc -NGENProcess 6f4 -Pipe 6f8 -Comment "NGen Worker Process"
  2⤵
  PID:660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6f0 -InterruptEvent 6d0 -NGENProcess 714 -Pipe 708 -Comment "NGen Worker Process"
  2⤵
  PID:2404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 704 -InterruptEvent 6d0 -NGENProcess 6f0 -Pipe 6f4 -Comment "NGen Worker Process"
  2⤵
  PID:1860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6d0 -InterruptEvent 700 -NGENProcess 714 -Pipe 710 -Comment "NGen Worker Process"
  2⤵
  PID:2572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 71c -InterruptEvent 704 -NGENProcess 720 -Pipe 6d0 -Comment "NGen Worker Process"
  2⤵
  PID:952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 70c -InterruptEvent 6b0 -NGENProcess 724 -Pipe 71c -Comment "NGen Worker Process"
  2⤵
  PID:940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 718 -InterruptEvent 714 -NGENProcess 728 -Pipe 70c -Comment "NGen Worker Process"
  2⤵
  PID:1792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 714 -NGENProcess 718 -Pipe 724 -Comment "NGen Worker Process"
  2⤵
  PID:188
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6f0 -InterruptEvent 714 -NGENProcess 6fc -Pipe 728 -Comment "NGen Worker Process"
  2⤵
  PID:1100
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 714 -NGENProcess 6f0 -Pipe 718 -Comment "NGen Worker Process"
  2⤵
  PID:2724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 714 -InterruptEvent 734 -NGENProcess 6fc -Pipe 738 -Comment "NGen Worker Process"
  2⤵
  PID:2864
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 734 -NGENProcess 714 -Pipe 704 -Comment "NGen Worker Process"
  2⤵
  PID:268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 730 -NGENProcess 740 -Pipe 6b0 -Comment "NGen Worker Process"
  2⤵
  PID:932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 6fc -NGENProcess 744 -Pipe 720 -Comment "NGen Worker Process"
  2⤵
  PID:1696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 72c -InterruptEvent 714 -NGENProcess 748 -Pipe 698 -Comment "NGen Worker Process"
  2⤵
  PID:2660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6f0 -InterruptEvent 714 -NGENProcess 72c -Pipe 744 -Comment "NGen Worker Process"
  2⤵
  PID:848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 714 -InterruptEvent 700 -NGENProcess 748 -Pipe 734 -Comment "NGen Worker Process"
  2⤵
  PID:2484
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 750 -InterruptEvent 700 -NGENProcess 714 -Pipe 740 -Comment "NGen Worker Process"
  2⤵
  PID:2416
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 730 -NGENProcess 748 -Pipe 74c -Comment "NGen Worker Process"
  2⤵
  PID:1972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 730 -InterruptEvent 758 -NGENProcess 6f0 -Pipe 6fc -Comment "NGen Worker Process"
  2⤵
  PID:1168
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 700 -NGENProcess 760 -Pipe 730 -Comment "NGen Worker Process"
  2⤵
  PID:3052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 764 -NGENProcess 6f0 -Pipe 754 -Comment "NGen Worker Process"
  2⤵
  PID:1664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 73c -InterruptEvent 75c -NGENProcess 768 -Pipe 700 -Comment "NGen Worker Process"
  2⤵
  PID:1644
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 758 -NGENProcess 6f0 -Pipe 72c -Comment "NGen Worker Process"
  2⤵
  PID:1164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 76c -NGENProcess 73c -Pipe 748 -Comment "NGen Worker Process"
  2⤵
  PID:1820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 76c -NGENProcess 758 -Pipe 6f0 -Comment "NGen Worker Process"
  2⤵
  PID:2264
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 76c -InterruptEvent 778 -NGENProcess 73c -Pipe 714 -Comment "NGen Worker Process"
  2⤵
  PID:2488
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 750 -InterruptEvent 760 -NGENProcess 77c -Pipe 76c -Comment "NGen Worker Process"
  2⤵
  PID:2732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 780 -NGENProcess 73c -Pipe 764 -Comment "NGen Worker Process"
  2⤵
  PID:1576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 780 -InterruptEvent 73c -NGENProcess 75c -Pipe 784 -Comment "NGen Worker Process"
  2⤵
  PID:2756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 778 -InterruptEvent 73c -NGENProcess 780 -Pipe 768 -Comment "NGen Worker Process"
  2⤵
  PID:2160
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 138 -NGENProcess 144 -Pipe 78c -Comment "NGen Worker Process"
  2⤵
  PID:2100
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 138 -InterruptEvent 770 -NGENProcess 758 -Pipe 750 -Comment "NGen Worker Process"
  2⤵
  PID:1612
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 760 -NGENProcess 780 -Pipe 778 -Comment "NGen Worker Process"
  2⤵
  PID:1472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 77c -NGENProcess 788 -Pipe 73c -Comment "NGen Worker Process"
  2⤵
  PID:2944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 77c -InterruptEvent 790 -NGENProcess 758 -Pipe 774 -Comment "NGen Worker Process"
  2⤵
  PID:1436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 794 -InterruptEvent 790 -NGENProcess 77c -Pipe 780 -Comment "NGen Worker Process"
  2⤵
  PID:2116
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 790 -NGENProcess 794 -Pipe 758 -Comment "NGen Worker Process"
  2⤵
  PID:3008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 138 -InterruptEvent 798 -NGENProcess 7a0 -Pipe 75c -Comment "NGen Worker Process"
  2⤵
  PID:2132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 79c -InterruptEvent 144 -NGENProcess 77c -Pipe 798 -Comment "NGen Worker Process"
  2⤵
  PID:2816
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 144 -InterruptEvent 7a8 -NGENProcess 7a0 -Pipe 788 -Comment "NGen Worker Process"
  2⤵
  PID:1252
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 790 -InterruptEvent 7b0 -NGENProcess 7a8 -Pipe 7a4 -Comment "NGen Worker Process"
  2⤵
  PID:1872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7b0 -InterruptEvent 760 -NGENProcess 79c -Pipe 138 -Comment "NGen Worker Process"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 77c -NGENProcess 770 -Pipe 7ac -Comment "NGen Worker Process"
  2⤵
  PID:2576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 77c -InterruptEvent 7b8 -NGENProcess 794 -Pipe 7b4 -Comment "NGen Worker Process"
  2⤵
  PID:2068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 77c -InterruptEvent 7b0 -NGENProcess 760 -Pipe 7a8 -Comment "NGen Worker Process"
  2⤵
  PID:2248
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7b0 -InterruptEvent 7a0 -NGENProcess 7b8 -Pipe 79c -Comment "NGen Worker Process"
  2⤵
  PID:1628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 7c0 -NGENProcess 138 -Pipe 7c4 -Comment "NGen Worker Process"
  2⤵
  PID:2308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c0 -InterruptEvent 138 -NGENProcess 77c -Pipe 7c8 -Comment "NGen Worker Process"
  2⤵
  PID:2536
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 794 -InterruptEvent 138 -NGENProcess 7c0 -Pipe 7bc -Comment "NGen Worker Process"
  2⤵
  PID:2584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 138 -InterruptEvent 7d0 -NGENProcess 77c -Pipe 760 -Comment "NGen Worker Process"
  2⤵
  PID:2852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d0 -InterruptEvent 790 -NGENProcess 7a0 -Pipe 7b0 -Comment "NGen Worker Process"
  2⤵
  PID:2872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 790 -InterruptEvent 7d8 -NGENProcess 7cc -Pipe 7d4 -Comment "NGen Worker Process"
  2⤵
  PID:2384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7dc -InterruptEvent 7d0 -NGENProcess 7e0 -Pipe 790 -Comment "NGen Worker Process"
  2⤵
  PID:1608
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d0 -InterruptEvent 77c -NGENProcess 7cc -Pipe 770 -Comment "NGen Worker Process"
  2⤵
  PID:2884
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 77c -InterruptEvent 7c0 -NGENProcess 138 -Pipe 7e4 -Comment "NGen Worker Process"
  2⤵
  PID:1164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c0 -InterruptEvent 7a0 -NGENProcess 7b8 -Pipe 794 -Comment "NGen Worker Process"
  2⤵
  PID:1132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 7ec -NGENProcess 7cc -Pipe 7e8 -Comment "NGen Worker Process"
  2⤵
  PID:2792
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 7ec -NGENProcess 7a0 -Pipe 7e0 -Comment "NGen Worker Process"
  2⤵
  PID:2804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 7a0 -NGENProcess 7f0 -Pipe 7f4 -Comment "NGen Worker Process"
  2⤵
  PID:2732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 7f8 -NGENProcess 138 -Pipe 7dc -Comment "NGen Worker Process"
  2⤵
  PID:956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f8 -InterruptEvent 77c -NGENProcess 7c0 -Pipe 7fc -Comment "NGen Worker Process"
  2⤵
  PID:1916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 77c -InterruptEvent 7d8 -NGENProcess 7b8 -Pipe 7d0 -Comment "NGen Worker Process"
  2⤵
  PID:872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 804 -NGENProcess 138 -Pipe 7f0 -Comment "NGen Worker Process"
  2⤵
  PID:2216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 808 -InterruptEvent 7f8 -NGENProcess 80c -Pipe 7d8 -Comment "NGen Worker Process"
  2⤵
  PID:1712
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 7c0 -NGENProcess 810 -Pipe 808 -Comment "NGen Worker Process"
  2⤵
  PID:2572
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 138 -NGENProcess 814 -Pipe 7ec -Comment "NGen Worker Process"
  2⤵
  PID:768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7cc -InterruptEvent 80c -NGENProcess 818 -Pipe 7a0 -Comment "NGen Worker Process"
  2⤵
  PID:940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7b8 -InterruptEvent 810 -NGENProcess 81c -Pipe 7cc -Comment "NGen Worker Process"
  2⤵
  PID:3020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 810 -InterruptEvent 804 -NGENProcess 818 -Pipe 7f8 -Comment "NGen Worker Process"
  2⤵
  PID:1756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 820 -InterruptEvent 7b8 -NGENProcess 824 -Pipe 810 -Comment "NGen Worker Process"
  2⤵
  PID:2848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7b8 -InterruptEvent 7c0 -NGENProcess 818 -Pipe 77c -Comment "NGen Worker Process"
  2⤵
  PID:1188
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 828 -InterruptEvent 820 -NGENProcess 82c -Pipe 7b8 -Comment "NGen Worker Process"
  2⤵
  PID:2652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 820 -InterruptEvent 82c -NGENProcess 80c -Pipe 830 -Comment "NGen Worker Process"
  2⤵
  PID:2552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 814 -InterruptEvent 804 -NGENProcess 834 -Pipe 820 -Comment "NGen Worker Process"
  2⤵
  PID:2576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 804 -InterruptEvent 81c -NGENProcess 80c -Pipe 824 -Comment "NGen Worker Process"
  2⤵
  PID:928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 838 -NGENProcess 82c -Pipe 7c0 -Comment "NGen Worker Process"
  2⤵
  PID:2068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 814 -InterruptEvent 83c -NGENProcess 804 -Pipe 838 -Comment "NGen Worker Process"
  2⤵
  PID:2740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 83c -InterruptEvent 844 -NGENProcess 82c -Pipe 818 -Comment "NGen Worker Process"
  2⤵
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 844 -InterruptEvent 138 -NGENProcess 80c -Pipe 81c -Comment "NGen Worker Process"
  2⤵
  PID:2016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 848 -InterruptEvent 83c -NGENProcess 84c -Pipe 844 -Comment "NGen Worker Process"
  2⤵
  PID:1952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 828 -InterruptEvent 840 -NGENProcess 850 -Pipe 848 -Comment "NGen Worker Process"
  2⤵
  PID:2064
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 840 -InterruptEvent 818 -NGENProcess 84c -Pipe 804 -Comment "NGen Worker Process"
  2⤵
  PID:2872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 854 -InterruptEvent 828 -NGENProcess 858 -Pipe 840 -Comment "NGen Worker Process"
  2⤵
  PID:2392
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 82c -InterruptEvent 83c -NGENProcess 85c -Pipe 854 -Comment "NGen Worker Process"
  2⤵
  PID:1652
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 814 -InterruptEvent 84c -NGENProcess 860 -Pipe 82c -Comment "NGen Worker Process"
  2⤵
  PID:2472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 138 -InterruptEvent 864 -NGENProcess 80c -Pipe 814 -Comment "NGen Worker Process"
  2⤵
  PID:1396
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 850 -InterruptEvent 85c -NGENProcess 868 -Pipe 138 -Comment "NGen Worker Process"
  2⤵
  PID:2856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 85c -InterruptEvent 86c -NGENProcess 80c -Pipe 818 -Comment "NGen Worker Process"
  2⤵
  PID:1588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 86c -InterruptEvent 870 -NGENProcess 84c -Pipe 828 -Comment "NGen Worker Process"
  2⤵
  PID:2432
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 870 -InterruptEvent 878 -NGENProcess 868 -Pipe 874 -Comment "NGen Worker Process"
  2⤵
  PID:1824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 878 -InterruptEvent 864 -NGENProcess 84c -Pipe 860 -Comment "NGen Worker Process"
  2⤵
  PID:280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 864 -InterruptEvent 84c -NGENProcess 86c -Pipe 87c -Comment "NGen Worker Process"
  2⤵
  PID:1660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 858 -InterruptEvent 84c -NGENProcess 864 -Pipe 83c -Comment "NGen Worker Process"
  2⤵
  PID:2100
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 84c -InterruptEvent 864 -NGENProcess 880 -Pipe 884 -Comment "NGen Worker Process"
  2⤵
  PID:3036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 864 -InterruptEvent 868 -NGENProcess 80c -Pipe 85c -Comment "NGen Worker Process"
  2⤵
  PID:2216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 868 -InterruptEvent 888 -NGENProcess 858 -Pipe 878 -Comment "NGen Worker Process"
  2⤵
  PID:2944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 888 -InterruptEvent 858 -NGENProcess 84c -Pipe 890 -Comment "NGen Worker Process"
  2⤵
  PID:1436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 86c -InterruptEvent 858 -NGENProcess 888 -Pipe 88c -Comment "NGen Worker Process"
  2⤵
  PID:2504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 880 -InterruptEvent 84c -NGENProcess 870 -Pipe 850 -Comment "NGen Worker Process"
  2⤵
  PID:1760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 858 -InterruptEvent 864 -NGENProcess 80c -Pipe 898 -Comment "NGen Worker Process"
  2⤵
  PID:2624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 84c -InterruptEvent 888 -NGENProcess 894 -Pipe 89c -Comment "NGen Worker Process"
  2⤵
  PID:756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 864 -InterruptEvent 870 -NGENProcess 86c -Pipe 8a0 -Comment "NGen Worker Process"
  2⤵
  PID:472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
PID:1936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1b8 -InterruptEvent 1a0 -NGENProcess 1b0 -Pipe 1ac -Comment "NGen Worker Process"
  2⤵
  PID:2700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 1a0 -NGENProcess 1b0 -Pipe 1b8 -Comment "NGen Worker Process"
  2⤵
  PID:2456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1a0 -InterruptEvent 20c -NGENProcess 210 -Pipe 208 -Comment "NGen Worker Process"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 21c -NGENProcess 224 -Pipe 1a0 -Comment "NGen Worker Process"
  2⤵
  PID:928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 1bc -NGENProcess 228 -Pipe 220 -Comment "NGen Worker Process"
  2⤵
  - Drops file in Windows directory
  PID:2964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 214 -InterruptEvent 228 -NGENProcess 210 -Pipe 20c -Comment "NGen Worker Process"
  2⤵
  PID:628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 228 -InterruptEvent 230 -NGENProcess 21c -Pipe 218 -Comment "NGen Worker Process"
  2⤵
  PID:2776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 200 -InterruptEvent 1bc -NGENProcess 238 -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  PID:1984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 238 -NGENProcess 234 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  PID:2312
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 22c -InterruptEvent 21c -NGENProcess 234 -Pipe 1b0 -Comment "NGen Worker Process"
  2⤵
  PID:1652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 1bc -NGENProcess 240 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:1820
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 210 -NGENProcess 240 -Pipe 214 -Comment "NGen Worker Process"
  2⤵
  PID:272
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 210 -InterruptEvent 230 -NGENProcess 248 -Pipe 200 -Comment "NGen Worker Process"
  2⤵
  PID:1212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 224 -NGENProcess 250 -Pipe 210 -Comment "NGen Worker Process"
  2⤵
  PID:2732
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 250 -NGENProcess 22c -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  - Drops file in Windows directory
  PID:884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 1bc -NGENProcess 258 -Pipe 224 -Comment "NGen Worker Process"
  2⤵
  PID:1116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1bc -InterruptEvent 258 -NGENProcess 248 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  PID:2936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 238 -NGENProcess 260 -Pipe 1bc -Comment "NGen Worker Process"
  2⤵
  PID:2452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 264 -NGENProcess 248 -Pipe 230 -Comment "NGen Worker Process"
  2⤵
  PID:2592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 26c -NGENProcess 264 -Pipe 22c -Comment "NGen Worker Process"
  2⤵
  PID:1760
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 264 -NGENProcess 234 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  PID:1468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 240 -NGENProcess 234 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  PID:2468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 240 -NGENProcess 258 -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  PID:1956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 26c -NGENProcess 278 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  PID:636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 258 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:2020
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 258 -NGENProcess 250 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  PID:2660
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 258 -NGENProcess 274 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  PID:1912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 288 -NGENProcess 274 -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  PID:1064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 288 -NGENProcess 250 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  PID:1784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 284 -NGENProcess 294 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:1496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 284 -NGENProcess 238 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  PID:2320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 290 -NGENProcess 29c -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  PID:1588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 21c -InterruptEvent 298 -NGENProcess 294 -Pipe 238 -Comment "NGen Worker Process"
  2⤵
  PID:484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2a0 -NGENProcess 26c -Pipe 21c -Comment "NGen Worker Process"
  2⤵
  PID:1080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 26c -NGENProcess 234 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  PID:900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 290 -NGENProcess 2a8 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 290 -NGENProcess 29c -Pipe 234 -Comment "NGen Worker Process"
  2⤵
  PID:308
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 294 -NGENProcess 2b0 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  PID:1744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2a8 -NGENProcess 2b4 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:2428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 2a8 -NGENProcess 298 -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  PID:844
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 2ac -NGENProcess 2bc -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:2516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2bc -NGENProcess 2b4 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  PID:968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2c0 -NGENProcess 290 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2a8 -NGENProcess 2c8 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2b4 -NGENProcess 2cc -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  PID:2084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 290 -NGENProcess 2d0 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  PID:628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 284 -NGENProcess 2cc -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  PID:2384
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 29c -NGENProcess 2d8 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  PID:972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2d8 -NGENProcess 2c8 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:1764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2b4 -NGENProcess 2e0 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  PID:1084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2b4 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  PID:1444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2e8 -NGENProcess 2e0 -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  PID:1304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 284 -NGENProcess 2a8 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:2440
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2d8 -NGENProcess 2f0 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  PID:1412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2e0 -NGENProcess 2f4 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  PID:956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2f8 -NGENProcess 2f0 -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  PID:484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2f0 -NGENProcess 2a8 -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2d4 -NGENProcess 300 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:2100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 300 -NGENProcess 284 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 284 -NGENProcess 2a8 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:2936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 2ec -NGENProcess 2e4 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 310 -NGENProcess 2a8 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 318 -NGENProcess 284 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:1964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 318 -NGENProcess 2f4 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  PID:2124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 2f4 -NGENProcess 2f0 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:2876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 30c -NGENProcess 320 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:2724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2d8 -NGENProcess 2f0 -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 2d8 -NGENProcess 30c -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1956
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 30c -NGENProcess 2d8 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  PID:1068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 2f0 -NGENProcess 330 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 334 -NGENProcess 2d8 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 338 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 30c -NGENProcess 284 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 2d8 -NGENProcess 340 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:972
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 338 -NGENProcess 344 -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 284 -NGENProcess 348 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:1740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 334 -NGENProcess 344 -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 300 -NGENProcess 350 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 30c -NGENProcess 344 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 34c -NGENProcess 358 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2152
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 338 -NGENProcess 344 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 344 -NGENProcess 354 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:1632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 34c -NGENProcess 35c -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:1804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 338 -NGENProcess 368 -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 2d8 -NGENProcess 36c -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:2528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 338 -NGENProcess 370 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:2284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 334 -NGENProcess 36c -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 358 -NGENProcess 378 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 378 -NGENProcess 368 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 2d8 -NGENProcess 380 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:2416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 380 -NGENProcess 36c -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:2964
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 34c -NGENProcess 388 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:1068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 388 -NGENProcess 368 -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:2236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 350 -NGENProcess 390 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:2852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 36c -NGENProcess 368 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:628
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 36c -NGENProcess 350 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:1960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 380 -NGENProcess 368 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:1564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 3a0 -NGENProcess 390 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:2792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 380 -NGENProcess 350 -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:2736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3a0 -NGENProcess 3b0 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:2280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3b0 -NGENProcess 398 -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  PID:2304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 368 -NGENProcess 3b8 -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:1304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 3bc -NGENProcess 398 -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:1224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 3ac -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:3016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 368 -NGENProcess 3c4 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 350 -NGENProcess 3ac -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:2944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 368 -NGENProcess 3cc -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:1736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 3d0 -NGENProcess 3ac -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3ac -NGENProcess 3b8 -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  PID:952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 350 -NGENProcess 3d8 -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  PID:2592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 3dc -NGENProcess 3b8 -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3c8 -NGENProcess 3e0 -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:2028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 368 -NGENProcess 3e4 -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:1492
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3b8 -NGENProcess 3e8 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3e0 -NGENProcess 3ec -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  PID:580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3f0 -NGENProcess 3e8 -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:2012
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 368 -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  PID:2580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3f4 -NGENProcess 3f0 -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  PID:1888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 3d8 -NGENProcess 3fc -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:1636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 404 -NGENProcess 3f0 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:688
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 40c -NGENProcess 408 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  PID:1484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 374 -NGENProcess 3e8 -Pipe 404 -Comment "NGen Worker Process"
  2⤵
  PID:2988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 410 -NGENProcess 408 -Pipe 3fc -Comment "NGen Worker Process"
  2⤵
  PID:1700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 414 -Pipe 3d8 -Comment "NGen Worker Process"
  2⤵
  PID:904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3f0 -NGENProcess 3f4 -Pipe 414 -Comment "NGen Worker Process"
  2⤵
  PID:804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 408 -NGENProcess 3f4 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  PID:2824
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3f8 -NGENProcess 420 -Pipe 40c -Comment "NGen Worker Process"
  2⤵
  PID:1920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 368 -NGENProcess 41c -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:2596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 410 -NGENProcess 420 -Pipe 418 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 3f8 -NGENProcess 42c -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3e8 -NGENProcess 430 -Pipe 428 -Comment "NGen Worker Process"
  2⤵
  PID:1804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 420 -NGENProcess 434 -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  PID:952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 434 -NGENProcess 3f4 -Pipe 438 -Comment "NGen Worker Process"
  2⤵
  PID:2576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 3f4 -NGENProcess 430 -Pipe 43c -Comment "NGen Worker Process"
  2⤵
  PID:1252
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 3f4 -NGENProcess 434 -Pipe 41c -Comment "NGen Worker Process"
  2⤵
  PID:2500
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 408 -NGENProcess 444 -Pipe 410 -Comment "NGen Worker Process"
  2⤵
  PID:2228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 408 -NGENProcess 3f8 -Pipe 434 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 44c -NGENProcess 444 -Pipe 424 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 444 -NGENProcess 3e8 -Pipe 3f4 -Comment "NGen Worker Process"
  2⤵
  PID:2580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 430 -NGENProcess 3f8 -Pipe 440 -Comment "NGen Worker Process"
  2⤵
  PID:684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 44c -NGENProcess 458 -Pipe 444 -Comment "NGen Worker Process"
  2⤵
  PID:1888
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 448 -NGENProcess 45c -Pipe 454 -Comment "NGen Worker Process"
  2⤵
  PID:1036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 3f8 -NGENProcess 460 -Pipe 42c -Comment "NGen Worker Process"
  2⤵
  PID:584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 458 -NGENProcess 464 -Pipe 408 -Comment "NGen Worker Process"
  2⤵
  PID:2384
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 45c -NGENProcess 468 -Pipe 450 -Comment "NGen Worker Process"
  2⤵
  PID:1720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 460 -NGENProcess 46c -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  PID:1968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 464 -NGENProcess 470 -Pipe 430 -Comment "NGen Worker Process"
  2⤵
  PID:2744
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 464 -NGENProcess 44c -Pipe 46c -Comment "NGen Worker Process"
  2⤵
  PID:1588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 478 -NGENProcess 470 -Pipe 3f8 -Comment "NGen Worker Process"
  2⤵
  PID:2072
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 448 -NGENProcess 47c -Pipe 464 -Comment "NGen Worker Process"
  2⤵
  PID:1916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 420 -NGENProcess 470 -Pipe 480 -Comment "NGen Worker Process"
  2⤵
  PID:3016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 458 -NGENProcess 484 -Pipe 448 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 458 -NGENProcess 45c -Pipe 470 -Comment "NGen Worker Process"
  2⤵
  PID:940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 48c -NGENProcess 484 -Pipe 474 -Comment "NGen Worker Process"
  2⤵
  PID:1792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 494 -NGENProcess 48c -Pipe 460 -Comment "NGen Worker Process"
  2⤵
  PID:1144
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 468 -NGENProcess 44c -Pipe 45c -Comment "NGen Worker Process"
  2⤵
  PID:2532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 420 -NGENProcess 498 -Pipe 494 -Comment "NGen Worker Process"
  2⤵
  PID:756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 490 -NGENProcess 49c -Pipe 478 -Comment "NGen Worker Process"
  2⤵
  PID:1008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 44c -NGENProcess 4a0 -Pipe 484 -Comment "NGen Worker Process"
  2⤵
  PID:1876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 44c -NGENProcess 488 -Pipe 49c -Comment "NGen Worker Process"
  2⤵
  PID:976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 458 -NGENProcess 4a8 -Pipe 47c -Comment "NGen Worker Process"
  2⤵
  PID:2848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 4a0 -NGENProcess 4ac -Pipe 48c -Comment "NGen Worker Process"
  2⤵
  PID:1976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a0 -InterruptEvent 4ac -NGENProcess 4a4 -Pipe 4b0 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2864
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 488 -NGENProcess 4b4 -Pipe 4a0 -Comment "NGen Worker Process"
  2⤵
  PID:808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 498 -NGENProcess 420 -Pipe 488 -Comment "NGen Worker Process"
  2⤵
  PID:2444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 498 -NGENProcess 4a8 -Pipe 4b4 -Comment "NGen Worker Process"
  2⤵
  PID:928
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 498 -NGENProcess 44c -Pipe 420 -Comment "NGen Worker Process"
  2⤵
  PID:2004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 4c4 -NGENProcess 4a8 -Pipe 468 -Comment "NGen Worker Process"
  2⤵
  PID:1556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 4c4 -NGENProcess 498 -Pipe 4a4 -Comment "NGen Worker Process"
  2⤵
  PID:1016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 4a8 -NGENProcess 4ac -Pipe 4c4 -Comment "NGen Worker Process"
  2⤵
  PID:2460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4ac -NGENProcess 4c8 -Pipe 4d8 -Comment "NGen Worker Process"
  2⤵
  PID:2872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4b8 -NGENProcess 4dc -Pipe 4a8 -Comment "NGen Worker Process"
  2⤵
  PID:672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 4d4 -NGENProcess 4e0 -Pipe 4d0 -Comment "NGen Worker Process"
  2⤵
  PID:2000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 4c8 -NGENProcess 4e4 -Pipe 44c -Comment "NGen Worker Process"
  2⤵
  PID:1720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4c8 -NGENProcess 490 -Pipe 4e0 -Comment "NGen Worker Process"
  2⤵
  PID:2388
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 4c8 -NGENProcess 4c0 -Pipe 4e4 -Comment "NGen Worker Process"
  2⤵
  PID:3048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 4ac -NGENProcess 490 -Pipe 4b8 -Comment "NGen Worker Process"
  2⤵
  PID:1588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f0 -InterruptEvent 4ac -NGENProcess 4c8 -Pipe 458 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 4e8 -NGENProcess 4f8 -Pipe 4f0 -Comment "NGen Worker Process"
  2⤵
  PID:872
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 4fc -NGENProcess 4c8 -Pipe 4ec -Comment "NGen Worker Process"
  2⤵
  PID:1504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4fc -InterruptEvent 4c8 -NGENProcess 490 -Pipe 500 -Comment "NGen Worker Process"
  2⤵
  PID:1464
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 504 -NGENProcess 4dc -Pipe 4ac -Comment "NGen Worker Process"
  2⤵
  PID:2132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 4fc -NGENProcess 498 -Pipe 4c8 -Comment "NGen Worker Process"
  2⤵
  PID:1828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4fc -InterruptEvent 4d4 -NGENProcess 4dc -Pipe 4c0 -Comment "NGen Worker Process"
  2⤵
  PID:436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 4d4 -NGENProcess 4fc -Pipe 4e8 -Comment "NGen Worker Process"
  2⤵
  PID:2604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 4f4 -NGENProcess 514 -Pipe 490 -Comment "NGen Worker Process"
  2⤵
  PID:2200
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 4f8 -NGENProcess 4fc -Pipe 504 -Comment "NGen Worker Process"
  2⤵
  PID:2044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 51c -NGENProcess 4d4 -Pipe 518 -Comment "NGen Worker Process"
  2⤵
  PID:2008
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 4d4 -NGENProcess 508 -Pipe 4dc -Comment "NGen Worker Process"
  2⤵
  PID:1100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 4f4 -NGENProcess 498 -Pipe 51c -Comment "NGen Worker Process"
  2⤵
  PID:2288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 4fc -NGENProcess 508 -Pipe 520 -Comment "NGen Worker Process"
  2⤵
  PID:2068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 4fc -NGENProcess 4f4 -Pipe 4d4 -Comment "NGen Worker Process"
  2⤵
  PID:2896
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 524 -NGENProcess 530 -Pipe 528 -Comment "NGen Worker Process"
  2⤵
  PID:1140
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 508 -NGENProcess 534 -Pipe 510 -Comment "NGen Worker Process"
  2⤵
  PID:1192
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 528
    3⤵
    PID:1672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 508 -NGENProcess 50c -Pipe 530 -Comment "NGen Worker Process"
  2⤵
  PID:1112
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 52c -NGENProcess 53c -Pipe 4f8 -Comment "NGen Worker Process"
  2⤵
  PID:2488
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 534 -NGENProcess 540 -Pipe 498 -Comment "NGen Worker Process"
  2⤵
  PID:1908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 540 -NGENProcess 538 -Pipe 544 -Comment "NGen Worker Process"
  2⤵
  PID:1884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 540 -NGENProcess 534 -Pipe 4fc -Comment "NGen Worker Process"
  2⤵
  PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 540 -NGENProcess 524 -Pipe 538 -Comment "NGen Worker Process"
  2⤵
  PID:1484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 508 -NGENProcess 534 -Pipe 52c -Comment "NGen Worker Process"
  2⤵
  PID:564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 554 -NGENProcess 53c -Pipe 550 -Comment "NGen Worker Process"
  2⤵
  PID:1812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 558 -NGENProcess 50c -Pipe 514 -Comment "NGen Worker Process"
  2⤵
  PID:1404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 524 -NGENProcess 534 -Pipe 548 -Comment "NGen Worker Process"
  2⤵
  PID:2280
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 554 -NGENProcess 560 -Pipe 558 -Comment "NGen Worker Process"
  2⤵
  PID:1940
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 560 -NGENProcess 508 -Pipe 564 -Comment "NGen Worker Process"
  2⤵
  PID:2160
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 540 -NGENProcess 568 -Pipe 554 -Comment "NGen Worker Process"
  2⤵
  PID:2908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 568 -NGENProcess 534 -Pipe 56c -Comment "NGen Worker Process"
  2⤵
  PID:2764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 54c -NGENProcess 570 -Pipe 540 -Comment "NGen Worker Process"
  2⤵
  PID:608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 54c -NGENProcess 50c -Pipe 534 -Comment "NGen Worker Process"
  2⤵
  PID:1792
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 54c -NGENProcess 524 -Pipe 570 -Comment "NGen Worker Process"
  2⤵
  PID:2128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 574 -NGENProcess 57c -Pipe 55c -Comment "NGen Worker Process"
  2⤵
  PID:1768
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 50c -NGENProcess 580 -Pipe 560 -Comment "NGen Worker Process"
  2⤵
  PID:1104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 568 -InterruptEvent 50c -NGENProcess 4f4 -Pipe 57c -Comment "NGen Worker Process"
  2⤵
  PID:2412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 584 -NGENProcess 588 -Pipe 568 -Comment "NGen Worker Process"
  2⤵
  PID:1876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 584 -InterruptEvent 58c -NGENProcess 4f4 -Pipe 508 -Comment "NGen Worker Process"
  2⤵
  PID:924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 590 -InterruptEvent 53c -NGENProcess 594 -Pipe 584 -Comment "NGen Worker Process"
  2⤵
  PID:2676
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 590 -InterruptEvent 580 -NGENProcess 524 -Pipe 4f4 -Comment "NGen Worker Process"
  2⤵
  PID:1976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 598 -NGENProcess 50c -Pipe 590 -Comment "NGen Worker Process"
  2⤵
  PID:2436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 598 -NGENProcess 574 -Pipe 524 -Comment "NGen Worker Process"
  2⤵
  PID:580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 5a0 -NGENProcess 50c -Pipe 594 -Comment "NGen Worker Process"
  2⤵
  PID:1204
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 5a4 -NGENProcess 580 -Pipe 588 -Comment "NGen Worker Process"
  2⤵
  PID:2728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 578 -NGENProcess 598 -Pipe 574 -Comment "NGen Worker Process"
  2⤵
  PID:456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 5ac -NGENProcess 53c -Pipe 5a0 -Comment "NGen Worker Process"
  2⤵
  PID:2344
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 5ac -NGENProcess 59c -Pipe 598 -Comment "NGen Worker Process"
  2⤵
  PID:1128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5ac -InterruptEvent 59c -NGENProcess 5b0 -Pipe 5b4 -Comment "NGen Worker Process"
  2⤵
  PID:1908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 58c -NGENProcess 5b8 -Pipe 5ac -Comment "NGen Worker Process"
  2⤵
  PID:832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a8 -InterruptEvent 580 -NGENProcess 5bc -Pipe 54c -Comment "NGen Worker Process"
  2⤵
  PID:2276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 5b0 -NGENProcess 5c0 -Pipe 5a8 -Comment "NGen Worker Process"
  2⤵
  PID:1484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b0 -InterruptEvent 5c0 -NGENProcess 53c -Pipe 5c4 -Comment "NGen Worker Process"
  2⤵
  PID:1812
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 5b8 -NGENProcess 5c8 -Pipe 5b0 -Comment "NGen Worker Process"
  2⤵
  PID:2808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b8 -InterruptEvent 5c8 -NGENProcess 5bc -Pipe 5cc -Comment "NGen Worker Process"
  2⤵
  PID:2420
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c8 -InterruptEvent 5d0 -NGENProcess 59c -Pipe 58c -Comment "NGen Worker Process"
  2⤵
  PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 580 -InterruptEvent 5b8 -NGENProcess 5d4 -Pipe 5c8 -Comment "NGen Worker Process"
  2⤵
  PID:1620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 5c0 -NGENProcess 5d8 -Pipe 580 -Comment "NGen Worker Process"
  2⤵
  PID:1116
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 59c -NGENProcess 5dc -Pipe 50c -Comment "NGen Worker Process"
  2⤵
  PID:1596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5bc -InterruptEvent 5d4 -NGENProcess 5e0 -Pipe 578 -Comment "NGen Worker Process"
  2⤵
  PID:2504
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 5d8 -NGENProcess 5e4 -Pipe 5bc -Comment "NGen Worker Process"
  2⤵
  PID:2916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d0 -InterruptEvent 5d8 -NGENProcess 53c -Pipe 5e0 -Comment "NGen Worker Process"
  2⤵
  PID:2300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b8 -InterruptEvent 5d8 -NGENProcess 5d0 -Pipe 5e4 -Comment "NGen Worker Process"
  2⤵
  PID:1736
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 5e8 -NGENProcess 5f0 -Pipe 5b8 -Comment "NGen Worker Process"
  2⤵
  PID:2224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5e8 -InterruptEvent 5f4 -NGENProcess 5d0 -Pipe 59c -Comment "NGen Worker Process"
  2⤵
  PID:2124
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 5f8 -NGENProcess 53c -Pipe 5e8 -Comment "NGen Worker Process"
  2⤵
  PID:2484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f8 -InterruptEvent 53c -NGENProcess 5f4 -Pipe 5d4 -Comment "NGen Worker Process"
  2⤵
  PID:2684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f0 -InterruptEvent 5ec -NGENProcess 600 -Pipe 5f8 -Comment "NGen Worker Process"
  2⤵
  PID:808
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5ec -InterruptEvent 5c0 -NGENProcess 5f4 -Pipe 604 -Comment "NGen Worker Process"
  2⤵
  PID:2260
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 5dc -NGENProcess 5d0 -Pipe 5fc -Comment "NGen Worker Process"
  2⤵
  PID:1524
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5dc -InterruptEvent 5f0 -NGENProcess 600 -Pipe 60c -Comment "NGen Worker Process"
  2⤵
  PID:2952
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 5c0 -NGENProcess 610 -Pipe 5dc -Comment "NGen Worker Process"
  2⤵
  PID:568
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 608 -NGENProcess 614 -Pipe 5a4 -Comment "NGen Worker Process"
  2⤵
  - Modifies data under HKEY_USERS
  PID:2584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 600 -NGENProcess 618 -Pipe 5d8 -Comment "NGen Worker Process"
  2⤵
  PID:456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 610 -NGENProcess 61c -Pipe 53c -Comment "NGen Worker Process"
  2⤵
  PID:1068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d0 -InterruptEvent 614 -NGENProcess 620 -Pipe 5f4 -Comment "NGen Worker Process"
  2⤵
  PID:1164
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5ec -InterruptEvent 5f0 -NGENProcess 618 -Pipe 614 -Comment "NGen Worker Process"
  2⤵
  PID:2828
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 61c -NGENProcess 628 -Pipe 5ec -Comment "NGen Worker Process"
  2⤵
  PID:576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 61c -InterruptEvent 62c -NGENProcess 618 -Pipe 608 -Comment "NGen Worker Process"
  2⤵
  PID:1304
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 61c -InterruptEvent 620 -NGENProcess 5c0 -Pipe 5d0 -Comment "NGen Worker Process"
  2⤵
  PID:1816
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 620 -InterruptEvent 5f0 -NGENProcess 62c -Pipe 628 -Comment "NGen Worker Process"
  2⤵
  PID:1132
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f0 -InterruptEvent 62c -NGENProcess 634 -Pipe 638 -Comment "NGen Worker Process"
  2⤵
  PID:2432
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 62c -InterruptEvent 630 -NGENProcess 600 -Pipe 63c -Comment "NGen Worker Process"
  2⤵
  PID:1560
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 624 -NGENProcess 618 -Pipe 610 -Comment "NGen Worker Process"
  2⤵
  PID:2088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 640 -NGENProcess 634 -Pipe 5c0 -Comment "NGen Worker Process"
  2⤵
  PID:1412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 644 -NGENProcess 600 -Pipe 61c -Comment "NGen Worker Process"
  2⤵
  PID:1748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 624 -NGENProcess 64c -Pipe 640 -Comment "NGen Worker Process"
  2⤵
  PID:2960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f0 -InterruptEvent 618 -NGENProcess 650 -Pipe 648 -Comment "NGen Worker Process"
  2⤵
  PID:1536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 62c -InterruptEvent 618 -NGENProcess 5f0 -Pipe 64c -Comment "NGen Worker Process"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 620 -InterruptEvent 630 -NGENProcess 658 -Pipe 62c -Comment "NGen Worker Process"
  2⤵
  PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 634 -NGENProcess 5f0 -Pipe 644 -Comment "NGen Worker Process"
  2⤵
  PID:2080
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 660 -NGENProcess 618 -Pipe 65c -Comment "NGen Worker Process"
  2⤵
  PID:3040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 618 -InterruptEvent 600 -NGENProcess 660 -Pipe 634 -Comment "NGen Worker Process"
  2⤵
  PID:756
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 600 -InterruptEvent 660 -NGENProcess 620 -Pipe 650 -Comment "NGen Worker Process"
  2⤵
  PID:2224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 660 -InterruptEvent 678 -NGENProcess 67c -Pipe 674 -Comment "NGen Worker Process"
  2⤵
  PID:1876
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 600 -NGENProcess 688 -Pipe 660 -Comment "NGen Worker Process"
  2⤵
  PID:2084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 600 -InterruptEvent 670 -NGENProcess 67c -Pipe 618 -Comment "NGen Worker Process"
  2⤵
  PID:268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 670 -InterruptEvent 68c -NGENProcess 678 -Pipe 66c -Comment "NGen Worker Process"
  2⤵
  PID:1364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 690 -NGENProcess 600 -Pipe 68c -Comment "NGen Worker Process"
  2⤵
  PID:1900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 688 -NGENProcess 698 -Pipe 684 -Comment "NGen Worker Process"
  2⤵
  PID:752
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 688 -InterruptEvent 664 -NGENProcess 600 -Pipe 620 -Comment "NGen Worker Process"
  2⤵
  PID:1692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 664 -NGENProcess 688 -Pipe 690 -Comment "NGen Worker Process"
  2⤵
  PID:592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 664 -InterruptEvent 67c -NGENProcess 600 -Pipe 694 -Comment "NGen Worker Process"
  2⤵
  PID:2208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 6a4 -NGENProcess 680 -Pipe 670 -Comment "NGen Worker Process"
  2⤵
  PID:2552
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a4 -InterruptEvent 69c -NGENProcess 688 -Pipe 6ac -Comment "NGen Worker Process"
  2⤵
  PID:1360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 6b0 -NGENProcess 6a8 -Pipe 6a0 -Comment "NGen Worker Process"
  2⤵
  PID:1208
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 6a4 -NGENProcess 6b4 -Pipe 69c -Comment "NGen Worker Process"
  2⤵
  PID:960
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 600 -NGENProcess 6b8 -Pipe 678 -Comment "NGen Worker Process"
  2⤵
  PID:1444
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 600 -InterruptEvent 67c -NGENProcess 6b4 -Pipe 6bc -Comment "NGen Worker Process"
  2⤵
  PID:2472
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 688 -InterruptEvent 680 -NGENProcess 6c0 -Pipe 600 -Comment "NGen Worker Process"
  2⤵
  PID:1700
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 6c4 -NGENProcess 6b4 -Pipe 664 -Comment "NGen Worker Process"
  2⤵
  PID:1484
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 688 -NGENProcess 6c8 -Pipe 680 -Comment "NGen Worker Process"
  2⤵
  PID:2056
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 688 -InterruptEvent 67c -NGENProcess 6b4 -Pipe 6a4 -Comment "NGen Worker Process"
  2⤵
  PID:1728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6cc -InterruptEvent 6b0 -NGENProcess 6d0 -Pipe 688 -Comment "NGen Worker Process"
  2⤵
  PID:1860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 6b8 -NGENProcess 6b4 -Pipe 6d4 -Comment "NGen Worker Process"
  2⤵
  PID:1916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 6cc -NGENProcess 6d8 -Pipe 6b0 -Comment "NGen Worker Process"
  2⤵
  PID:1412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6cc -InterruptEvent 6c4 -NGENProcess 6b4 -Pipe 6dc -Comment "NGen Worker Process"
  2⤵
  PID:1748
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 6e0 -NGENProcess 6a8 -Pipe 6c8 -Comment "NGen Worker Process"
  2⤵
  PID:2496
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 6e4 -NGENProcess 6b8 -Pipe 67c -Comment "NGen Worker Process"
  2⤵
  PID:2352
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 6e8 -NGENProcess 6b4 -Pipe 6d8 -Comment "NGen Worker Process"
  2⤵
  PID:3000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6ec -InterruptEvent 6e8 -NGENProcess 6e4 -Pipe 6a8 -Comment "NGen Worker Process"
  2⤵
  PID:608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 6c4 -NGENProcess 6f4 -Pipe 6ec -Comment "NGen Worker Process"
  2⤵
  PID:2624
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 6cc -NGENProcess 6e4 -Pipe 6d0 -Comment "NGen Worker Process"
  2⤵
  PID:1104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6f8 -InterruptEvent 6cc -NGENProcess 6c4 -Pipe 6e8 -Comment "NGen Worker Process"
  2⤵
  PID:1180
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b8 -InterruptEvent 6b4 -NGENProcess 700 -Pipe 6f8 -Comment "NGen Worker Process"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6f0 -InterruptEvent 6e4 -NGENProcess 704 -Pipe 6b8 -Comment "NGen Worker Process"
  2⤵
  PID:2044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 6c4 -NGENProcess 708 -Pipe 6f0 -Comment "NGen Worker Process"
  2⤵
  PID:2848
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 6f4 -NGENProcess 704 -Pipe 680 -Comment "NGen Worker Process"
  2⤵
  PID:2684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6f4 -InterruptEvent 70c -NGENProcess 6e4 -Pipe 6cc -Comment "NGen Worker Process"
  2⤵
  PID:976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 710 -InterruptEvent 6c4 -NGENProcess 714 -Pipe 6f4 -Comment "NGen Worker Process"
  2⤵
  PID:2084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 710 -InterruptEvent 700 -NGENProcess 708 -Pipe 6e4 -Comment "NGen Worker Process"
  2⤵
  PID:2436
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b4 -InterruptEvent 6e0 -NGENProcess 6c0 -Pipe 710 -Comment "NGen Worker Process"
  2⤵
  PID:1644
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 70c -InterruptEvent 6c4 -NGENProcess 71c -Pipe 6b4 -Comment "NGen Worker Process"
  2⤵
  PID:3004
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 720 -NGENProcess 6c0 -Pipe 714 -Comment "NGen Worker Process"
  2⤵
  PID:2032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 704 -NGENProcess 700 -Pipe 6e0 -Comment "NGen Worker Process"
  2⤵
  PID:1556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 6c4 -NGENProcess 728 -Pipe 720 -Comment "NGen Worker Process"
  2⤵
  PID:1460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 70c -NGENProcess 700 -Pipe 72c -Comment "NGen Worker Process"
  2⤵
  PID:2232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 70c -InterruptEvent 730 -NGENProcess 6fc -Pipe 718 -Comment "NGen Worker Process"
  2⤵
  PID:1636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 730 -InterruptEvent 70c -NGENProcess 724 -Pipe 6fc -Comment "NGen Worker Process"
  2⤵
  PID:2884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 728 -InterruptEvent 704 -NGENProcess 71c -Pipe 730 -Comment "NGen Worker Process"
  2⤵
  PID:2384
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 704 -InterruptEvent 700 -NGENProcess 724 -Pipe 734 -Comment "NGen Worker Process"
  2⤵
  PID:1948
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 740 -NGENProcess 70c -Pipe 73c -Comment "NGen Worker Process"
  2⤵
  PID:1712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 740 -NGENProcess 700 -Pipe 6c4 -Comment "NGen Worker Process"
  2⤵
  PID:1232
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 71c -InterruptEvent 728 -NGENProcess 748 -Pipe 6c0 -Comment "NGen Worker Process"
  2⤵
  PID:1404
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 728 -InterruptEvent 74c -NGENProcess 700 -Pipe 708 -Comment "NGen Worker Process"
  2⤵
  PID:3048
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 74c -InterruptEvent 754 -NGENProcess 704 -Pipe 750 -Comment "NGen Worker Process"
  2⤵
  PID:1400
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 754 -InterruptEvent 748 -NGENProcess 738 -Pipe 740 -Comment "NGen Worker Process"
  2⤵
  PID:3016
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 74c -NGENProcess 758 -Pipe 754 -Comment "NGen Worker Process"
  2⤵
  PID:1224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 74c -InterruptEvent 700 -NGENProcess 70c -Pipe 728 -Comment "NGen Worker Process"
  2⤵
  PID:3032
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 760 -NGENProcess 758 -Pipe 71c -Comment "NGen Worker Process"
  2⤵
  PID:1620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 738 -NGENProcess 748 -Pipe 764 -Comment "NGen Worker Process"
  2⤵
  PID:1536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 700 -NGENProcess 768 -Pipe 760 -Comment "NGen Worker Process"
  2⤵
  PID:1704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 768 -NGENProcess 74c -Pipe 76c -Comment "NGen Worker Process"
  2⤵
  PID:1648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 768 -InterruptEvent 770 -NGENProcess 704 -Pipe 70c -Comment "NGen Worker Process"
  2⤵
  PID:2448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 704 -NGENProcess 744 -Pipe 748 -Comment "NGen Worker Process"
  2⤵
  PID:2544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 700 -NGENProcess 75c -Pipe 770 -Comment "NGen Worker Process"
  2⤵
  PID:2128
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 74c -NGENProcess 778 -Pipe 738 -Comment "NGen Worker Process"
  2⤵
  PID:2028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 774 -InterruptEvent 74c -NGENProcess 700 -Pipe 75c -Comment "NGen Worker Process"
  2⤵
  PID:3028
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 74c -InterruptEvent 700 -NGENProcess 780 -Pipe 784 -Comment "NGen Worker Process"
  2⤵
  PID:1904
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 768 -InterruptEvent 77c -NGENProcess 788 -Pipe 74c -Comment "NGen Worker Process"
  2⤵
  PID:2456
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 77c -InterruptEvent 704 -NGENProcess 780 -Pipe 724 -Comment "NGen Worker Process"
  2⤵
  PID:1100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 768 -NGENProcess 790 -Pipe 77c -Comment "NGen Worker Process"
  2⤵
  PID:2512
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 768 -InterruptEvent 790 -NGENProcess 758 -Pipe 794 -Comment "NGen Worker Process"
  2⤵
  PID:268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 778 -InterruptEvent 790 -NGENProcess 768 -Pipe 744 -Comment "NGen Worker Process"
  2⤵
  PID:2212
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 774 -InterruptEvent 790 -NGENProcess 778 -Pipe 758 -Comment "NGen Worker Process"
  2⤵
  PID:2536
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 790 -InterruptEvent 7a0 -NGENProcess 768 -Pipe 788 -Comment "NGen Worker Process"
  2⤵
  PID:2064
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 704 -NGENProcess 700 -Pipe 780 -Comment "NGen Worker Process"
  2⤵
  PID:1300
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 190 -NGENProcess 790 -Pipe 79c -Comment "NGen Worker Process"
  2⤵
  PID:2728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 190 -InterruptEvent 790 -NGENProcess 188 -Pipe 798 -Comment "NGen Worker Process"
  2⤵
  PID:2580
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 790 -InterruptEvent 700 -NGENProcess 768 -Pipe 778 -Comment "NGen Worker Process"
  2⤵
  PID:2392
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 78c -NGENProcess 7a0 -Pipe 7a4 -Comment "NGen Worker Process"
  2⤵
  PID:2172
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7ac -InterruptEvent 790 -NGENProcess 7b0 -Pipe 700 -Comment "NGen Worker Process"
  2⤵
  PID:832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 790 -InterruptEvent 704 -NGENProcess 188 -Pipe 190 -Comment "NGen Worker Process"
  2⤵
  PID:944
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a8 -InterruptEvent 7a0 -NGENProcess 7b8 -Pipe 790 -Comment "NGen Worker Process"
  2⤵
  PID:2584
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 774 -InterruptEvent 7b0 -NGENProcess 7bc -Pipe 7a8 -Comment "NGen Worker Process"
  2⤵
  PID:1084
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7b0 -InterruptEvent 7b8 -NGENProcess 7c0 -Pipe 768 -Comment "NGen Worker Process"
  2⤵
  PID:2264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7b8 -InterruptEvent 78c -NGENProcess 704 -Pipe 7a0 -Comment "NGen Worker Process"
  2⤵
  PID:2936
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c4 -InterruptEvent 7b0 -NGENProcess 7c8 -Pipe 7b8 -Comment "NGen Worker Process"
  2⤵
  PID:1968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7b0 -InterruptEvent 7c8 -NGENProcess 774 -Pipe 7cc -Comment "NGen Worker Process"
  2⤵
  PID:2036
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c8 -InterruptEvent 188 -NGENProcess 7ac -Pipe 7bc -Comment "NGen Worker Process"
  2⤵
  PID:1680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 188 -InterruptEvent 7d0 -NGENProcess 7c4 -Pipe 7c0 -Comment "NGen Worker Process"
  2⤵
  PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d4 -InterruptEvent 7c8 -NGENProcess 7d8 -Pipe 188 -Comment "NGen Worker Process"
  2⤵
  PID:868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c8 -InterruptEvent 704 -NGENProcess 7c4 -Pipe 7b4 -Comment "NGen Worker Process"
  2⤵
  PID:2880
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 704 -InterruptEvent 7e0 -NGENProcess 7d0 -Pipe 7dc -Comment "NGen Worker Process"
  2⤵
  PID:1468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e0 -InterruptEvent 7e8 -NGENProcess 7ac -Pipe 7e4 -Comment "NGen Worker Process"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7b0 -InterruptEvent 774 -NGENProcess 7d4 -Pipe 7f0 -Comment "NGen Worker Process"
  2⤵
  PID:2100
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 774 -InterruptEvent 7c8 -NGENProcess 7ec -Pipe 7c4 -Comment "NGen Worker Process"
  2⤵
  PID:1656
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c8 -InterruptEvent 78c -NGENProcess 7d0 -Pipe 7d8 -Comment "NGen Worker Process"
  2⤵
  PID:2604
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 7f8 -NGENProcess 774 -Pipe 7b0 -Comment "NGen Worker Process"
  2⤵
  PID:2380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7f8 -InterruptEvent 7e8 -NGENProcess 7d0 -Pipe 7d4 -Comment "NGen Worker Process"
  2⤵
  PID:1528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e8 -InterruptEvent 7e0 -NGENProcess 7ac -Pipe 7fc -Comment "NGen Worker Process"
  2⤵
  PID:2044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e0 -InterruptEvent 804 -NGENProcess 7ec -Pipe 7c8 -Comment "NGen Worker Process"
  2⤵
  PID:2672
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7f4 -InterruptEvent 7e8 -NGENProcess 808 -Pipe 7e0 -Comment "NGen Worker Process"
  2⤵
  PID:968
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d0 -InterruptEvent 704 -NGENProcess 80c -Pipe 7f4 -Comment "NGen Worker Process"
  2⤵
  PID:2712
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 704 -InterruptEvent 7f8 -NGENProcess 808 -Pipe 810 -Comment "NGen Worker Process"
  2⤵
  PID:2396
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7f8 -InterruptEvent 814 -NGENProcess 774 -Pipe 7ac -Comment "NGen Worker Process"
  2⤵
  PID:2068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 814 -InterruptEvent 78c -NGENProcess 7e8 -Pipe 80c -Comment "NGen Worker Process"
  2⤵
  PID:2724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 818 -NGENProcess 7d0 -Pipe 804 -Comment "NGen Worker Process"
  2⤵
  PID:556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 818 -InterruptEvent 7f8 -NGENProcess 774 -Pipe 820 -Comment "NGen Worker Process"
  2⤵
  PID:2740
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 824 -InterruptEvent 81c -NGENProcess 7ec -Pipe 814 -Comment "NGen Worker Process"
  2⤵
  PID:1692
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7f8 -InterruptEvent 774 -NGENProcess 808 -Pipe 704 -Comment "NGen Worker Process"
  2⤵
  PID:2868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1025\LocalizedData.xml
Size 80KB
SHA256 bfca8cdb158986f6a333ece89daa3081a6a81f89ea868a697113a19121c14f7e
MD5 bd97655af30131b0d8387bab5f20e68d
SHA1 cb42103aea4de739573dacf49ebb527b00dc3e55
SHA512 c365faed844bb2d750acea77b308df2a9a8b94e2270ce2b75d17b4356262d0d65a4489bc55705a45c4b1bc28bd0cc2b2c1e167a43d3c7321f3e758f128ea7651
SSDEEP 384:4EKMFNhaVwV/VLVWPD66KUtycONAkXtj7l/Xequ0zmM7cBp9stCctFnDRydTJleD:DlxgdGUTJleYi
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1028\LocalizedData.xml
Size 69KB
SHA256 0ad12bf18aa4fcc557ab9422ebef07ab0b8369395bcf695f0915ea99c689f99f
MD5 5727d5160e0fb5d661eb4e6720430d1b
SHA1 b3b6ba3fda17ca68a20675ae06b3c56d576274b4
SHA512 7f0314a621137e4076f4ea22e82a6845912fae3b002ba4455952c683e6be89e5a3de4a7cd8f4df2a360247923ca472a53619a2d3635cdcfc1c66e03e7aac2a31
SSDEEP 384:4EdgFNhaVwV/VLV33zqjKUtycONAkANsc2XceacoHcdYc3bCHwx+DR+USWV/K1ND:2XCJnVBSWV/K1+gwJg5H
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1029\LocalizedData.xml
Size 85KB
SHA256 309dac84e7aef6b4cca2cd7b1eeef8a30bd910373724ca56e8764fa3b420aa79
MD5 eae0498ea94f2a7e7982ee773d10d3a5
SHA1 f0bc4a900f0eefd362760b77b7cc1829ac0bb93e
SHA512 978b97cb7c8274ed73063c1f9a9bce4d9c0fd9c186de67d2ce3b03d33dd88487b6f480eea481fe9c3687c3008a5403b85a16ba57072ac03baee1ffe1c14fb6e7
SSDEEP 384:4ERWbTP0qTvLSGf6KUtycONAkzMo+snsMsBTKTuTyTfQjkj/svHov+yJKe3dJTZT:h2LToiJUQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1030\LocalizedData.xml
Size 83KB
SHA256 2b563a3837a23214d290f11b6acb6836ed065bc17c8965108b385ea3ac91922f
MD5 c805fa6fd2e634ecd0083074194b3899
SHA1 079f0dc73703b987447cf3ddc1e4761047aeb605
SHA512 ff5e3813a4769e6962c363dc64f251724df98be94b195c805cb8854717d3e633fa2c9ae160c55ee6e3872699e692a6ff8b58d2b8de36579f30edcf324c798e8f
SSDEEP 384:4EJUFNhaVwV/VLVWPD66KUtycONAkoiqz3b4VYZtPeEbZfURtzBSmRLAgRQJYR2X:HZtPrtSvJcR
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1031\LocalizedData.xml
Size 88KB
SHA256 8e878d95152714e1b77c1c7cb8538501c732e06615bb614d3cd71d0b147beaa4
MD5 4ce791c97f9a6abae6de28487cbdf24c
SHA1 cb85c4b052eae862a55d0b8bf8f2c57e3412c0a0
SHA512 4333de904e66d1ff795d8905a21b8c06830635de4bc25ecd3eb94aef7923937b67d5ff464b2e92249a3c5d61bf19ebae7868c9f5435544bd5c3e80fa925e7e4e
SSDEEP 1536:Qa6UBbBM+MTy+MRRY6VC7u3pg010Jsz/ziX:Qa6UBbBM+MTy+MRRY6VC7u3pg010Jsz+
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1032\LocalizedData.xml
Size 90KB
SHA256 c00d4950f2497d3de235b7d82a8bb737d17eb789551b2fbe8be822ac59d7db8b
MD5 b15beae6eebd44f084681316217c35fd
SHA1 ff93f038e65b85a68b4887f88eb792db1d6fc1ce
SHA512 9af03bb58e5d6bf1a62c4fd1e86c4809b97b0f10929c6b7bdd5048afd29c8b21755ed73587dc4380dbd0a8302a9873bd0540553feff40a01fa8196a89c074b36
SSDEEP 384:4E2yvnT86nzWPD66KUtycONAkD+LoYRONOVA8HTiVEsmXadUkqc00CfMMHlRcyvN:cqjQyZ0J7
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1033\LocalizedData.xml
Size 83KB
SHA256 65471fdc2a95dd77759ad629bc57db6f4caf039d43d4e756053c30a7d5ff03c9
MD5 f68f5e6d0ab12908f1d6451ea4b16d61
SHA1 f51ef1ccb08cfdab32c0ceacf5369c353eb036d5
SHA512 7a64114083903522d319237063d05b619fdc3d4ce9945dd3124773b9f6a57b848007b77f55bcba5f29001c9f4d02ee68f35440c37e8326e96559bae485c0b4c3
SSDEEP 384:40v89tJKVQVfVjV2vjaCS89aEetgcbFT/4Se8NqJpR+enRROu5aeJInO/yJakC62:4/4STqyJiT
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1035\LocalizedData.xml
Size 84KB
SHA256 b9176ebcf72da0b18850a2d23eb90962c90e2c819b0aa2fb4d32b71ae387b82c
MD5 cdfc12ff066fef57a60e13a61e2fe9f7
SHA1 c412a703fbc4c436d6f40129dd793ff94188e0ab
SHA512 0bea735854f1148ed044afae2f1da5dd0c8f5b9f3d758371b85656fd4bb98a77e6b495ec95797ec36b36f1029aa4f434c1a8ea1541ca738b8e634999b69ea9d0
SSDEEP 384:4Et04sUwpVbVkV4VbiO/6KUtyc6BM47nQqOYeBzW/3zKdm4Ne4Bti4l59R8fOaJt:S+/lOfOaJ+Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1036\LocalizedData.xml
Size 87KB
SHA256 15454de5eb80f0b2bbec3e9855d1841b1ae7c95d38f838ba525cdc8b0270c7c7
MD5 8122a6977d478cd6c93ac26998f38f91
SHA1 9a49baefafd4918ea5a538366d4091d2a867e4d9
SHA512 4ee048f39fb80f4e52dc80384c4566ab65d1aae3d52078d76d6fa63b1761625ba02bf5238532aaebf23c8b46c19448bbbdd9d885d22afe3b92b094a0bd6ea4b7
SSDEEP 384:4E5EF9xWQ9RWPD66KUtycsmIPdC0EVDpFqpRatkxOGv5Gj8VjfRiLYcRryQMuvtR:J+skeu8tbxhJNP/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1037\LocalizedData.xml
Size 78KB
SHA256 2f0078da6c7d15c770d517030dc0d96d540a67a501cd54430637ffb77c23fb44
MD5 52529d623cbe2229e179178037852000
SHA1 cdf681bcd3090d7ded20878a7e8759465f429c91
SHA512 6c4a05fb4e0f15ff297bd1371d0e33e020376b4f85b3bc4faedf92e9521deb2e47b55d1a4aacbc68b76ea6602a4f14d354a51098c8143cb2e5a6db77d97bab4e
SSDEEP 384:4E9EJquUMovngPMIzVK6ptI6AmtycsOlrAyAgAUk6U+zmhygwREQ0mFfGQdJjwve:FV6UCtJjw5o
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1038\LocalizedData.xml
Size 86KB
SHA256 f73b516104eb7651bb66889799d771c44b8c6bfda501237f3325b6f2133c0af7
MD5 17e14f770796e2b7458f1fdb9511da1a
SHA1 c72c4ae5455e9851b6e5f2aabf1f3d78920258d8
SHA512 dac5d1536ddf76d485b1512c4e1fc7d13e21ebd79f112f1cb53bd6d59395cfee9b6cc5afcb26f3bea0c7b190bdc6b19c49fedaadae89e92cf904c22b52fdb4fc
SSDEEP 1536:QZa/a8abaRayCIu4F70S9BIzEERIJH0rji3kC4ILiv:QZayHuEsXF70S9BIzEERIJH0rji3kCle
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1040\LocalizedData.xml
Size 85KB
SHA256 9fde0a246757fdcbd435abf67d10168b1875c9b1a85d51bb821cb7494e3f79d1
MD5 2dd0b542600eddd67f44d35492e5d526
SHA1 8199817fd80d39d5536a6b21d7ee108c16792f81
SHA512 d76a7fdecdd9ecd70601fec0765e97a1a42315edce8a483b7b22007e5b4de00ff84e09e1cb50a2127ce64b8de92ca38bb8f1acea707061d95c120c194a2cb187
SSDEEP 384:4ELLGeyl/eSWPD66KUtycs9/wTuiGKHg3XLCMa1eHzNZNs4fuD4RBJBo5U6sxuwv:9+aYtJGk
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1041\LocalizedData.xml
Size 75KB
SHA256 a69cc0439bf7e72a59ac4c2b0f6d80cc8822165421a824bb234924de3e5d69e1
MD5 05ae74494480b60daa65cbd7d33e8ff3
SHA1 a54c87632654368909c2e9801f10a76ac864ca28
SHA512 16292e5ff02087380ff0b64b3c129af689a050d9562aba0ea9d71e692505d50ffefefd08eaca36f370b86a0f01309ea577336a89d5d5f7f9ea573098bb2f228c
SSDEEP 384:4E0UFNhaVwV/VLVWPD66KUtycONAkrmZXM++oMeRCcLsRDJDhFfv:25GJ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1042\LocalizedData.xml
Size 73KB
SHA256 92d7923380007234dfed0329779621909bea28bc837c1975ac141ce872caae55
MD5 5659c33354875ffe975534d8b4c29675
SHA1 5cf25ba5da9d8c6fd6a6b7ba67bd02c663f48b21
SHA512 38fafc1d3886d8cddff362d690c776280d6b586521c9f7991ff60d6403940820ae44d987f76ffea5f33899e12dcef07d6e12ec8b54245d5523f9a9f9f2adcb20
SSDEEP 384:4EIyFFhyV4VnVLV//rCjKUtycONAkYETFU9WFwWknfYbzqRjXU2ggRZVDhYAS+KY:dbFwW9b+xJr
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1043\LocalizedData.xml
Size 85KB
SHA256 794c11a6abe5a9348cedf44a5421ef20e9de00e7cd34dc80e9d5a80538e45666
MD5 9841af88c8432f1c28c390205fa25cdf
SHA1 7eff1df19b35080442254f0962e8337038b53024
SHA512 3ddbfa7f7a3165144ffe6a772bb78d0659db60d71ac4d250ac3ff2a416396123ff9377c928012b5e84e7571ccbe52e132d6f3ad22fa5185878923c48995270ee
SSDEEP 384:4E2oNVxJ4i/5Qbkkk5vWPD66KUtycsyUjt9FQvFzyDZAZDhyY7YGoDq1RYktgNVX:uvREQDhyUuqGhHtP0tJJ8Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1044\LocalizedData.xml
Size 84KB
SHA256 3a9354ac2acaf1671844a4d1c8f0e7c5c86ef183cb30dda4eef5bac02de6b2a7
MD5 be070a2a425774e4016376a7c5efc46e
SHA1 56ccfcca60b97ce227436f72bd56969d4b770557
SHA512 4c0045629f9a9a7d8a84b79303550a26fa8cad308b78656acfe579fc1c1f6dd5fd6d10c23fb87142406117357a1cb2ffe6364025233b70bf776ef0b696f31616
SSDEEP 384:4EX2lskoDBkIWPD66KUtycONAk+dkmgJhjMFwrbDbGBklKn9COrtQ2GCJYkTQQv:8klU9Ct2GCJYu9
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1045\LocalizedData.xml
Size 87KB
SHA256 e2383afcb0c44bab237003b4a8c3dac2bdccada9f42c82ea2004aa04db901edd
MD5 603d2406053837c960df9a66e3af052d
SHA1 7afb11ea418cba19fa1b25d112c7acd110bfc638
SHA512 97d598473cbd9c3b66bbfc8c1f4ba47701bc66a9581262a75f6b4af5d469ff19b134ebd3d6108af3df1f9bee82f8f5f0ba864abb769dbb23677bc427a1247ea3
SSDEEP 768:VMUuGp9Vi0iG0XE2Uq4DplOe6lsQjPLJbOzdH:TCjJyZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1046\LocalizedData.xml
Size 84KB
SHA256 00601e4ff88a8d6f0dcbf65fbbf14142cd86fdc7cb8f251893f70b597ef3a7eb
MD5 af1f0f47f381c11a9c4296fcdca0ebbd
SHA1 838f581e6aa7596381d25784d8ca30a48c47eb9e
SHA512 8d326bdb639a797dc5e253936f7b39981f5bdeb112fd46a5d0596d6476ad17e790b43b1b2dce91bf33f27940cc32afa57e535c3f38e93cd30f27d4843a49d9eb
SSDEEP 384:4EYbb8UAjJUgYN5s6KUtycONAkPuroXIvQzVhHL4lzSv3kOY8vg2m/qKdxEcyJ2w:KobcyJzyN7K
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1049\LocalizedData.xml
Size 86KB
SHA256 c43af2be229fa08f1d7f161ff9dd4dfd25a459a05ec8462c3b683ab7bd0cc4f8
MD5 d6f7e810eeaec18464d0ebf0e0589eb6
SHA1 962a25926f8196448821c4b21d5619d42cf3ae6d
SHA512 b78f9f98a9993478c2107eb738f1949d031f12ffbc78e7a4cfa67ff7dbefe5e456712eb6e23eebaaadb6a5645ff25600432e1c5e32f1e4493d090d9b8674bed3
SSDEEP 384:442CNVxJ4i/5Qbkkk5vWPD66KUtycONAk0S72TrkSVfGo/RGKVcng5/spnBthXlK:4fVUJi
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1053\LocalizedData.xml
Size 83KB
SHA256 3c4c96b9ed7f536cbcc698760b7142db8411d6ba4ad784a29727bac2e7df7d9a
MD5 653ff0be9c7132b411bb95d7d6b90d78
SHA1 fd57ee34dd102fe6b8b709bf46829f7b1c0a7c42
SHA512 77ed725595a50492d80ac2c593b25f30ec61a579348acef87e2f25484f2975abfeff946c04de6482be186864c3c9d42a673a3d4b679f19cbe34851d1c1496064
SSDEEP 384:4Eaw+WCXVVV6VOVWPD66KUtycONAkr2JuWf59pWAQJluOuos98LSGcgqBV6kMQjc:SvVAQJwnIXrJJpoc
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\1055\LocalizedData.xml
Size 83KB
SHA256 d1896ac9b20686a00c7d0bf0f8dc8279b9a52f88025b8cc3b161100d224df7c9
MD5 bd0f034d3eff8d3a60f9acccadcfbf56
SHA1 c622870702e94cdf76979093440c22f9127e4b50
SHA512 3d6e93c1498381a5e8bb34969cec3596a5006abc5f1ad1b3bfb3298e763b64f45538be05693c1c70787135ec3af2e813bed45dfd174dcbc0db3b711550737d65
SSDEEP 1536:i7gos8RlQm/wobG+PKarUdTvJ4rtRevbS6bh:i7gos8RlQm/wobG+PKarUdTvJ4rtRezd
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\2052\LocalizedData.xml
Size 69KB
SHA256 f0b7e9242c27ea1652e9ea6d46b8617e189e31bf093e7e21e38e60d94cea16eb
MD5 7497b47f7db96dff8e7c1198b7964006
SHA1 fc05395f849d386261b8bb7511893bbe6a4c5467
SHA512 b24f97e32de52ac4cee276c0d4b4089cdcea90ac309f135c3b2273de15badffbed02044aa8f429e52376159e1def2c43c87405fa2a206b4ac55d74040e20951a
SSDEEP 384:4EzL8FNhaVwV/VLVWPD66KUtycONAkGxkZtmqaDCWehZ9TfVxzR/8XMHRd4LOPcW:NkZtmqaCZmXw4LOPjAJN6
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\2070\LocalizedData.xml
Size 86KB
SHA256 32a0606e178f5f77b7e13573a910b4fcb7587e9ff4823d3a95cc28dd73074ade
MD5 382abfa1307279a35a6a70f7de7046e3
SHA1 fabfd301d954d04a1565d23c2f093b1c0ce574c1
SHA512 b5ada4a1abe2689173f169b5d16b05da34158e55e9ae0b0b77f2de9e47469bbae77c958bbe62d756a8fbd610b995d9be8bd6606d1230371f0c7f2ea89f291046
SSDEEP 384:4EDlFNhaVwV/VLVWPD66KUtycONAkbIxHIbF1+1TQYOdxIL1FskOYNigvR/nikku:Ylu6kzX0JZ5OW
MD5 SHA1 SHA512 SSDEEP

Submit Download

LocalizedData.xml

Path C:\6c3dfc7293b5537f042c271533\3082\LocalizedData.xml
Size 85KB
SHA256 df8531355aa11a9a585b63a6fcc96c0c6c480e06a602d88a949bcac1ff7795bd
MD5 2bce3f6dd7abbe483ec92a688ef3b76e
SHA1 6a8adc8e3c481aa6e404239cd0ea419c0e98c262
SHA512 0d03643ed072e5961f5ef5d1ebbd2cb0e730ea5e40c46892e7a83d11f47290f031564d3283fa24c587bf46df8f4e39abe92f38e6a42acded315b16c96d7e7e8d
SSDEEP 384:4Er0PfH7g2HbWPD66KUtycsJ7UUMYTKPex7UM/I9aXdoBchU7aF/6JD1NDoAjJuH:fX0K2VgZN08Jtikin
MD5 SHA1 SHA512 SSDEEP

Submit Download

DHTMLHeader.html

Path C:\6c3dfc7293b5537f042c271533\DHTMLHeader.html
Size 15KB
SHA256 e139af8858fe90127095ac1c4685bcd849437ef0df7c416033554703f5d864bb
MD5 cd131d41791a543cc6f6ed1ea5bd257c
SHA1 f42a2708a0b42a13530d26515274d1fcdbfe8490
SHA512 a6ee9af8f8c2c7acd58dd3c42b8d70c55202b382ffc5a93772af7bf7d7740c1162bb6d38a4307b1802294a18eb52032d410e128072af7d4f9d54f415be020c9a
SSDEEP 192:7Ddx3KOTczFQ21Kp4n5DTx1iDecPeLHLHQFJFjZWblWUxFzJzcKHjT:fdsOT01KcBUFJFEWUxFzvHH
MD5 SHA1 SHA512 SSDEEP

Submit Download

netfx_Full_GDR_x86.msi

Path C:\6c3dfc7293b5537f042c271533\NetFx451\netfx_Full_GDR_x86.msi
Size 900KB
SHA256 6504cc67a8733aa24a628c737a8a83f28f4bce86edaf993f0491d52349552346
MD5 3792ad35ba11c4626dbf5a69ddf83ac1
SHA1 193483376d63fb18e0da47409b1b2b21a2a0456f
SHA512 6966b2ccb76408a6399662ab404f05c3294a409d6cdd192358f213aece005471edf948269674cb736f8ddec9a295dc412c9b9841c90c1be86b2ea36b99d1fe6d
SSDEEP 12288:rzEm6rDBSFeOTbtH6c9niu4CeuqUNY6ksCLgch:l6rVSsOTJ6Zu4C7Y6kHd
MD5 SHA1 SHA512 SSDEEP

Submit Download

ParameterInfo.xml

Path C:\6c3dfc7293b5537f042c271533\ParameterInfo.xml
Size 2.6MB
SHA256 902417bce105310d3e0fb674060f00dadf0b5f87c4ecb210e77897c2122b40cf
MD5 533b9cb0939025d0da973a24c7419583
SHA1 5f654c8d2a0e5a45bae4d1b2bef9034ede5b328e
SHA512 fe8ee47a3272f685668668874f04bcb277db550fe12f976bf57827aa7e7a65d6bd7f5242e4019b33401bdb1331af61cec988ee38c50e750f280835595768e271
SSDEEP 3072:GwvegkpveQveSnpveRveL1pve+veRYpveHBEL9YCIl:l4TSDBEL9YH
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupEngine.dll

Path C:\6c3dfc7293b5537f042c271533\SetupEngine.dll
Size 868KB
SHA256 c40f60ab16752e404cae3943f169d8260ad83f380e0c2bd363ad165982608f3e
MD5 4c0b492d3e96d742ba8922912976b3f8
SHA1 ee571ea60f3bb2feea2f7a5ff0d02cc7d7524b6e
SHA512 99e44ffa8b50fbfa378310198582404a4f90b2450677b1f152baa55c6e213fbb5fbd31d0207a45876a57837e2a5d642bd613843e77f9f70b0d842d8bcdf0cfad
SSDEEP 24576:oG2ynlYA0f/0DyMNFCU7fw3vdvQKG/k2K8nNRv:oG2ynlYAuKDDfw3v5QKG/JK8nNRv
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupUtility.exe

Path C:\6c3dfc7293b5537f042c271533\SetupUtility.exe
Size 216KB
SHA256 a6e53349f95700a67bdb8f6ea960965bccdc96034344be7634defd638cb908ad
MD5 ad024bbc264ffdb9db0911391dad64c3
SHA1 137a6f1fbbc491a193dee0ddedc3db5cf8c2d9de
SHA512 d094af833077ea1e64fe1bf8d698a2cdccbd8f85982045fdca6e4e0d58bef9df90ca34eee9b8ac14f51b198b52c0aa7d9fd0296ee83a59ffc285169b2b440999
SSDEEP 6144:IeQabthSPEtYrfKGKwAEQh9qnlNA76oqFKPu:IeQaJhSMtYrfcwAEc9qnYOQG
MD5 SHA1 SHA512 SSDEEP

Submit Download

UiInfo.xml

Path C:\6c3dfc7293b5537f042c271533\UiInfo.xml
Size 63KB
SHA256 b879f9bc5b79349fa7b0bdbe63167be399c5278454c96773885bd70fbfe7c81d
MD5 c99059acb88a8b651d7ab25e4047a52d
SHA1 45114125699fa472d54bc4c45c881667c117e5d4
SHA512 b23a7051f94d72d5a1a0914107e5c2be46c0ddee7ca510167065b55e2d1cb25f81927467370700b1cc7449348d152e9562566de501f3ea5673a2072248572e3b
SSDEEP 1536:24UR0d5vud5vcZ2QYQLIN/N7pfMGgrX8FPirziPfwws36z7y/HoQilwJwowJwXZR:24UR0d5vud5vcZ2QYQLIN/N7pfMGgrX5
MD5 SHA1 SHA512 SSDEEP

Submit Download

netfx_Full.mzz

Path C:\6c3dfc7293b5537f042c271533\netfx_Full.mzz
Size 14.1MB
SHA256 f797998c892f6123597b49721214ec64ca1bbd2561c858f3047b47ad2e2c5022
MD5 60983f40be3df9230b53e5a4a3e59fc8
SHA1 3940a88894ab8a265745bd87fd8ed706eff6d4c8
SHA512 a0a9244be4624fd5c69d35065231263e535f0d4bc010ee3a7dbc31e761779aa42909d8c771b79ec902fc49d5bcc9c1b8830d42bb59c2eeed9f051407fdae274e
SSDEEP 393216:byVIOrskAp6pmbhABs0sVXELjPPjVYMi/I05KW:boc4Sf
MD5 SHA1 SHA512 SSDEEP

Submit Download

netfx_Full_x64.msi

Path C:\6c3dfc7293b5537f042c271533\netfx_Full_x64.msi
Size 1.7MB
SHA256 cf83469bd8d0b1f8187881d9b158c8b530eef3cf4fe0549eec35951dc43626d7
MD5 0315277a43cf63bac757b148c432a170
SHA1 2edf861f759bcdafa4d7b4121d29802a7acac20b
SHA512 021c4fc8799187a34cec78ac64138c08cd42bfd7de48ff3792dfcce4fa17dc0839e04543e7fa94c1f4d59d88ef7289402bca0e581de5b035345b5ffb90762dff
SSDEEP 24576:aN88PVH63n6/8xEFE1jwBcgurhwQUvrCnuYpLA9WKEtao4ks:g96X6u+g1gXYpLVtZ4
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqmapi.dll

Path C:\6c3dfc7293b5537f042c271533\sqmapi.dll
Size 221KB
SHA256 b236253e9ecb1e377643ae5f91c0a429b91c9b30cca1751a7bc4403ea6d94120
MD5 6404765deb80c2d8986f60dce505915b
SHA1 e40e18837c7d3e5f379c4faef19733d81367e98f
SHA512 a5ff302f38020b31525111206d2f5db2d6a9828c70ef0b485f660f122a30ce7028b5a160dd5f5fbcccb5b59698c8df7f2e15fdf19619c82f4dec8d901b7548ba
SSDEEP 3072:Dl5e8m9Z5G6ZUMIiaQVedGGEc6SYm8X/UvHFupHIjNNlMi/fbtcICcu0b9+x0o/l:gG6ZUon6GVSYmnGHEvlMMac59+xfbB
MD5 SHA1 SHA512 SSDEEP

Submit Download

f77ab8f.rbs

Path C:\Config.Msi\f77ab8f.rbs
Size 2.4MB
SHA256 61f280cc462ba22ae55ff58a9dc967d60d4fc45c488c3f49a62121b049cde27b
MD5 4d6cab5cc692a30ef6fc998a1fdd8a18
SHA1 b66bf068a8d8995c1e073c8da5a86b297d44a044
SHA512 bb3bc350ce63a49dec2a0fff1ea9b00155389be04fa61ded6f25dd3d429bedcd824ad62d4c161400016c2e76d3f55977896076eb815ceaaee0c0662402e6c920
SSDEEP 24576:LIkxN88PVH6/n6/8xEFE1jwBc91eEhwd1N88PVH6V:h96f6u+Khwdz96V
MD5 SHA1 SHA512 SSDEEP

Submit Download

f77b231.rbs

Path C:\Config.Msi\f77b231.rbs
Size 2.2MB
SHA256 c7df5bf4313c2dae163904394adda5e9b5cfee0f34e59ba5e73022e82db0b8f5
MD5 cf4ea8e1c19e81e588b406aded361374
SHA1 f25a1c6a90c09cc077f89a313f779ddf58c57e85
SHA512 5e6aef0c38910c09f32053d934d288f591a7f4e7a74ae91c1d32d0c3ed7003a2f6cb2b3b9acd14f548b319be200777ae66b7be30a87c5c23a1b88ba90f1ff8c7
SSDEEP 24576:kN88PVH63N88PVH6kN88PVH69N88PVH6VN88PVH6mN88PVH6TN88PVH6NN88PVHY:y96V96y96r96T96096596b96t
MD5 SHA1 SHA512 SSDEEP

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 3a4bb2a6261024c1505cb7c354b10a601138f925f9533526d07c3b4546d3ff6e
MD5 98648e2b72173eebdc01412d53ed3ba7
SHA1 10c1195a59cde2982e025cbc1e97372e4fb21120
SHA512 76a07533e3c640b6f993dd29ad8c64bb298edbe5d14c88ee595f4d5141a37f4aaf6be05d58ec24a80c7012301e18632ef452b25cb3a8fba7e362e6b462653ce8
MD5 SHA1 SHA512

Submit Download

CabACA4.tmp

Path C:\Users\Admin\AppData\Local\Temp\CabACA4.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft .NET Framework 4.7.2 Setup_20240302_142413477-MSI_netfx_Full_x64.msi.txt

Path C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240302_142413477-MSI_netfx_Full_x64.msi.txt
Size 1KB
SHA256 aa03b2c81d61296f0adf598651c84afa6617cecf6b159e768cb36260f1bbaa40
MD5 e8e3865f8e3db94e8b74bba425c38677
SHA1 421daefdd817faf4e2714e1a7dc47b338111b2ef
SHA512 963ab61528506270904e216f2e3687fb31790250af116d2eb5a357643f12971e09dcdc0a093cdc996b9def60771b8ab0a699d5e56e85e825a152811989edccfe
MD5 SHA1 SHA512

Submit Download

RGIC8DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RGIC8DB.tmp
Size 10KB
SHA256 a380116d80066949811b29c5b53c20488c1ca6b05a955c1698aff58fc18ebf94
MD5 dbef78447120e830587017c581f994f1
SHA1 ea5214b9503e9a3b5335053b9f2e85c1bd26f3ce
SHA512 eda079a1c4e25d18099accf11860b7c78c9c303c855d87ddfd1750a41e47571db6acf929921a20be693a18d948799279c3f7be47574a2004810021271d735b3b
SSDEEP 192:L9QI6wA1jUr2ol3ilWoTWgzMPiS+XdC8lUwRQHb:2wA1jUr2olylWouwRQ7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpD47E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpD47E.tmp
Size 105KB
SHA256 d7937cdcb9f99ea7fd30a0b21c11b82176ac416b724b5a876fdec2a6700e6997
MD5 64362991b01414cd34a25b6cf50c996c
SHA1 2a7095d44892cc44fd79cb3729e63226c3880ee0
SHA512 4e28168ee18cbdec6b5dda102f988450be25b12211e849afd864f008137397516b97270fef24d52632c1e5ee9075505b3854978553c85ea25f374767a828f87f
SSDEEP 3072:Fx/bh59mtC9x+7Rl/kJ6L4302wacu9fj5Q6IyYS+sl0mfCy6/hktnHSkO1pd8lA1:Fx/bh59mtC9x+7Rl/kJ6L4302wacu9fo
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIB3C7.tmp

Path C:\Windows\Installer\MSIB3C7.tmp
Size 291KB
SHA256 e3dee969908f521936fd327b83aec0f0d0930845546aa221f18cbebfd122327e
MD5 75fb9a8745aca61b2e5331458977dfdc
SHA1 4bdc9382030781a0cedfdbea06bd6bf0ef3cf61f
SHA512 8c56f906b2add736f28c2a6236aed2ecebd7978c9c19f6ee300737f3664df85e66a57c55a29ec7a9befb0575e843898e677d91fa9403ea6a7ee3d0cb8fb71b15
SSDEEP 6144:tNgYI9tNTOPLxzE17NGsRqXDc/Ja6sI5nlA:tNgYID8PEaXD76sIw
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIBDB7.tmp

Path C:\Windows\Installer\MSIBDB7.tmp
Size 255KB
SHA256 caf3f71c11b10bece30705b2aa32b975ef9f52f519490af6deebee668194ee89
MD5 9593870e12c484ef7f943cb7752717dc
SHA1 e750d6776abfebc955af8b16689e414bc86ba988
SHA512 6fe4d73961df36a6af203a3eec7b3c3682c13065f5cdad8690c43c861cec11b5271e82efb4437869ba8bab2178d97410f5aaece5d7bceff05d386cce0a6e9af1
SSDEEP 6144:2K6D/JR6E/CHcxEPt4YnizaNyYSYJhsAfBcY:2Ke60C8xEFiz0yYFsAfBcY
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIEC49.tmp

Path C:\Windows\Installer\MSIEC49.tmp
Size 202KB
SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
MD5 ba84dd4e0c1408828ccc1de09f585eda
SHA1 e8e10065d479f8f591b9885ea8487bc673301298
SHA512 7a38418f6ee8dbc66fab2cd5ad8e033e761912efc465daa484858d451da4b8576079fe90fd3b6640410edc8b3cac31c57719898134f246f4000d60a252d88290
SSDEEP 3072:X9LUHM7ptZ8UKOGw5vMWSuRy1YaDJkflQn3H+QDO/6Q+cxbr0qMG:XuH2aCGw1ST1wQLdqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIEC89.tmp

Path C:\Windows\Installer\MSIEC89.tmp
Size 145KB
SHA256 bb88089e5e9c0ad58ca615e67ecf694f2e4b3c086cc924255358e24a80d14004
MD5 ea8e3c648d1f4f0e57d0c3af7985cdf0
SHA1 988b2acaa365ec7ff21e2715d874e183deaea76d
SHA512 3434bcae1e846af02fe88a3e8367d0752f2e005e66324205a31d1b015b64f19b2a51aa652944290ec961e15ba7001419f12b77926a7c46de02ebd0764c58318b
SSDEEP 3072:rBDFiApmCRtRKMIXzaLZzqAd2vVCabCtn7pJv5ye+BxU+BJC:rbxm8RKnuF/gvwabA0hr
MD5 SHA1 SHA512 SSDEEP

Submit Download

AddInUtil.exe.config

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe.config
Size 161B
SHA256 9d6823fb2d5c4948c1e38b099ff2a238066950552659dd922d3df63c4a09c896
MD5 9a740fb9a29d2cc61fa447e640109141
SHA1 5d438029e218977a64a2c30ddf824b4fd3523178
SHA512 b1b85bf43c1af94d4a782a15246f59f61a3af5a27b4f83fc39cf1ee75808efec8a31882b4a5d4953713397e7d534bc49fab28f81a96bf11c8a5ab73b9b3c6e53
MD5 SHA1 SHA512

Submit Download

web_lowtrust.config

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web_lowtrust.config
Size 5KB
SHA256 b386f2a75e99571822c15bc5b57daadae210ad8db3585cf9229f92a1e47e4811
MD5 07134c1e521d7eccde5fc1ae7d778067
SHA1 67793f4545f764789d9f36d497533a0da956ccec
SHA512 80969dcd112665f00ca24ea18b9e286b7da7acc06a9449f9cc5a35a6ec2e6cf349eb3c719ee1ffe76983b7c19b01ab6cfffc71ad768c3d31d16c91350f184cf6
SSDEEP 48:8YpQH0HEPHoxH6zKwH/VcLHmPQUHgRHbiHi/H2M13pMv5phkB1RDGo5jmcp2mcp/:8YCUOEM9yG4UuGI7tuoUcvcx
MD5 SHA1 SHA512 SSDEEP

Submit Download

web_minimaltrust.config

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Config\web_minimaltrust.config
Size 4KB
SHA256 0c1aa27ba67af39f019ce2387312fe0d74f3f23ae2fcc34290b799ba0374a292
MD5 64dbcee736e12c39da44f7b5c4c2d694
SHA1 66951f9be79844285b9ce0a1ec705d8c16766d51
SHA512 9f6ce82f6e841aefee297e16ac02327e2c497e886058d49ae4c559c2260c41bad25e3e6b2905d7374283a37cd4aaa3e9e1e76e87206b75a951217ea70c202d9b
SSDEEP 48:8YpQH0HoxH/VcLHmPQUHgRHbiHi/H2M13pMv5eRDGo5jmcp2mcpq:8YCUE9yG4UuGI7tWoUcvcg
MD5 SHA1 SHA512 SSDEEP

Submit Download

NlsData0009.dll

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WPF\NlsData0009.dll
Size 18KB
SHA256 d461aae84388cc9e1626ba068f2ff71274c5e8058bd95f3a958c477a8ec11968
MD5 6520eff266875135a85c5bc0ab33e8b3
SHA1 a568618f12ad80815dc7a99206e80f4e3db428dd
SHA512 6a60c0031a8a0951bd4906efa09094781f510c9781a52aa8a0e87838b1e693abf9d8fe4b69319ab6d0b880a0d169cf5046d1c7f27ff8ad806db437a10dcbbd5c
SSDEEP 384:cWyB/WVYBm0GftpBjSjaQHRN7R9lndaEWQunG:UbVi8jLoG
MD5 SHA1 SHA512 SSDEEP

Submit Download

jsc.exe.config

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe.config
Size 281B
SHA256 f3e74bb1fa170c71933b3e329457f2db137f9cd32b08c29b63401c17e4a1ae52
MD5 c5b1320a8e2e2e36fba39626a3b75ed0
SHA1 3e978970892351939a9a8c1a10806ecb70833991
SHA512 058afcb0e8edbd98f27cb4c39502c0cd73f2f96ee09fd259d190e276b29d4d95ccabaf15c9aef91048a547fadaaeef78f838853107f31164dfff2f16142c0920
MD5 SHA1 SHA512

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Size 108KB
SHA256 a347fb07c7dcb68e2232c73f7af528e97efe4a1c4a8abc2d66aa7e93e694a0b4
MD5 0cfbadfafdc3ae92b00988c506fe91c3
SHA1 a8b016f4b88e0b916deabad789e5e525b37f1f67
SHA512 12bdb4e2a8f3280e61038c5c995f43a03ae2eacf3b6295ad4436abd5b45e04c3bbba4d56b1c0eafd517208d29e308df34d87fc3341492262d5ea3f53f1303a57
SSDEEP 768:iMgij0zrYl2n2TfGPeilEMF8t2K4wM6LDptU2UlGembolgbM+UMRqMcLLMkgVpzO:i5iICJUUqTPp6Y/
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngen_service.log

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log
Size 8KB
SHA256 11fa0a604a48d84673d11b8193edaf0e80f05a0a2178f31e04b620a0afb2efaa
MD5 c5c36a6a0a64c96139bb9383fd1e82d8
SHA1 4985c7cb9aa5cbccfb05f16d61c21201b4ac10d1
SHA512 53f9690c123e1964f7060be6639f74abbba4da085b1de4a6285bdc1369e99889949d6054353594b0d7686d8078bf06bb8aae90d7828a9dbfe85e1cb022cd6b57
SSDEEP 192:V8eSBSI6D0gkvQAxmOv/qvIApmOv9tgrJ:YjWAvJYv9tu
MD5 SHA1 SHA512 SSDEEP

Submit Download

regtlibv12.exe

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
Size 106KB
SHA256 53940c8a89b8015edef7dbfd6e759205a576c22794da3d97d34df9f384019de0
MD5 7b08042914fd8b4c68dcaf9ee456c365
SHA1 63d986b2c4dd4276c02812a782433f86cd47f2e4
SHA512 77f8f115b6340c81409fbad8a62978a3169c5278f60890eb1f4e00f8fcc74be7f84e590c786ea492fba5c780775d67aa85fe65649fb31f98a8ca49f04d0b27ab
SSDEEP 3072:9fTLZgntTi450ape6kJtuTHftW8VYYjzmZ:9fTKnL0ape6Atu7nvq
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc.exe.config

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe.config
Size 182B
SHA256 2d4610ade011e530d817dd3ba4fc787e5dc0c2297cc520c30a643b8fb13f9093
MD5 c002006ced9de9edddd0fbc440a33623
SHA1 7144330e908fd57d439ce9200a388bfe37fb716a
SHA512 c2a5ee9cc44eafc4be7d2be7fa8f6b7e911ace2ebb656281ef8854eb9e93f567e224aaebd3238dc00c6a28bc92784d0317434ac9976d209b09286553bb891afe
MD5 SHA1 SHA512

Submit Download

NlsData0009.dll

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\NlsData0009.dll
Size 18KB
SHA256 a256d30a99870b14a7a752f6f216f207d1c4453478908d6353a8511904bf2542
MD5 a025bee281432df00d7c92a23df29155
SHA1 56946dc01ca617bac76290a865f65723a80a82e6
SHA512 b90821ad49e297438e16bc02aba95072c4d466ab86c355836e31950f6d7ed67dd8d76a66aa7cbd2c5393aa59ddc9d68dab090255f62b815b27b381d62b6a2a50
SSDEEP 192:DaWyB/W42dsNtLxCjdks/nGfe4pBjSrH4WAaAXcrMHnhWgN7a4WtjPqnajkSXt76:uWyB/Wbsngm0GftpBjTaQHRN7WlJnTo
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log
Size 117KB
SHA256 2fe9d5d72fe8050da7bb7f7b020e0b666d271bee7ad74c86ff3ec246317bba69
MD5 5d645ac2cf2911d03a81dd5f1e1e5aba
SHA1 5b26a81259331f1155cb63476afbf3c78ee80ba4
SHA512 19e808778b0cf32e6b082676b6387fd24e89bdc739bb95a4373c8819c9dbaaf9c94befb3e2dee3baebe7dab6353dd0b1327cb8b281737a351c3f57da94f53e37
SSDEEP 768:xMztfl3kCePKwqYHfGqRbami52IrI4WlA9+Ijd6kBWXgj0lleHiDJjJZJgJ16C:xMzJKCRWjDJjJZJgJEC
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngen_service.log

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
Size 8KB
SHA256 feef47c4ba654e5a7c67f1a05905b46590fd046e65de05348cd4d578eadab737
MD5 abdbc394d6096f64bd7f8f7839b7e1d7
SHA1 32139b59056a665681c75449fee47612d05d93d6
SHA512 5c13af0194e5770b0f5a64930f477a42f920e4dbb0d0b0dc1af27e1f5ab37d4879af5a31855f33c4d653d076d637c58853ab9f2358292f49a89f4b487b293492
SSDEEP 96:Vk2trSWeRr8rBeRe+Q+Qw/XlA7YLC/QwVJXsRyjvl6e6ePgw8mA7YLXC/QwVJXsu:VlZSWSWBdXMVAvQgvWWAHQgv9tgrQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

regtlibv12.exe

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\regtlibv12.exe
Size 96KB
SHA256 6ccea8682511cfb02017de0d9b51650952a69f0a08324557b8ce1849a5dec6e0
MD5 7f039e051a21ca24011eb0cb883765fb
SHA1 d3f250bebb5be84f72474430639996968c930676
SHA512 a2d6d4389e2fe2bc319b2c695071024362b60eeba6032359d7e3071585ac6a46c5a7287835359002bfe796021db05588d0a8898f0236bd68c3eba577ba848c49
SSDEEP 3072:1VV3P0vi4T0iuMXX4B6dwmoD4OJVgz8LFWz9:1HIi4T0iuMn4B6dwmoW8+
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerfStringBackup.TMP

Path C:\Windows\SysWOW64\PerfStringBackup.TMP
Size 4.5MB
SHA256 49029962974e3645f98cdeb8d891816f4f9d7df55b809612dc6b11ec5322ae74
MD5 4dd4bf665cc5001af9a6e61fa63c246a
SHA1 46a9a53e70524e50ff319f524473ea275dd70c7c
SHA512 3a9ddb8f9f3be272296363cbf1cdeb3bdb4259ab290809e1ddf0167b5c9aab35942099f33a71526172582d073b3023f22540f9cbebc37a7aff217b7a65e337ff
SSDEEP 6144:ymEuZzD+RCrnLWUVnqgsp/s7GaCLtAhtQvtJ5zm2TLxAMe4RgfaBH6ULlm9mVPNy:jahAuQVHY/Ez
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc007.dat

Path C:\Windows\System32\perfc007.dat
Size 145KB
SHA256 f32fc0f8baa07d69cf9b37081574e176eb7d1a3faeafde7b24be5afc1b1820fc
MD5 11aa410df91f3adb24c1b5c0d7df915d
SHA1 773ba90ce5d799e2afc14dec1e9606bde6f97b8c
SHA512 b5f7381dc53c757d2fc007d627b02f667f0e9a17234b2436054c701d527cf3518d330b8c5d860493ef7738b7921fd55fa896740de87c638dbd8eeef8630791dc
SSDEEP 768:5Kb+j2tTFyuhttrBq2azmYxTXjvOXZODr9TE/RU96PIz:5Kb+j2tTPhttdq2g7OXZODr9T2q
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc00A.dat

Path C:\Windows\System32\perfc00A.dat
Size 154KB
SHA256 9dcdf5c7400192eaf2a0d9c9665a6f16f98596825f4b259bd80eb1e883d1aef1
MD5 675f847153b006eaf24b5fc5cd796354
SHA1 10218ec67ceabbb83230c25031b49f32caabaf61
SHA512 05cf9e86fbce787fe213a85ca97c239f516f7377df80b0d6125b7aacecaa30c22f54f7afad0f3b2d497b7324cfaa84363a760a7fc8613bc1a8fc961eaceb2dc9
SSDEEP 768:jLLxU1GSWnWRIV9t1N2r+BA6GabCOcxyxePC5rcLtY4NcgBqL6QenMfQZU61lyAX:jLLxUBWn92k6W3w1
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc00C.dat

Path C:\Windows\System32\perfc00C.dat
Size 145KB
SHA256 5e21b7965731d97125ae8180a2d20ab4fb60899512fe4e18e8626115fe835a37
MD5 09da72f39a969a09126b9fd1206e3f70
SHA1 bc3e75df227a629b4656fab8811ce9242a3eb6c3
SHA512 1199a64baa07cf12a0dd83d01ea2cf094f8fa484647b27563b941cac40079ded5d6469954fcc2a2343325136d29ec0b5b4d273375bdb2dc4044b0d95e8797fe0
SSDEEP 3072:Sk/cq2l6twvg0KS9mI+EP5YVcbuo3jfz2F/cKuEF2Dsf:SA
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc010.dat

Path C:\Windows\System32\perfc010.dat
Size 142KB
SHA256 39edd8ca0a9274afae1817fde5129714d852a0324268588ab1b9eaff6dc03120
MD5 699d4a8522d4cb2fe10a24f9602ed237
SHA1 6f702b7195432ae85e384eb86fbd0b00dc9be07c
SHA512 ae7c2f4e86b2f0c3328b6bc11352e77024cda033f8930e4e7b53fc3b53a4140eabc4722fd060af8fedf643fbce75f046661a1e022ab6d733adcf505a4b61ed8b
SSDEEP 768:0hCx4l7JXlrCE3eAGua2eSXrAxmI4yYf4w91Nw+vB2U++P+pmij4Vh6TzoqAbqGJ:0Axo7JX9E2hH+eaM
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfc011.dat

Path C:\Windows\System32\perfc011.dat
Size 118KB
SHA256 2c9f1fe8465e38f68606a6275b83a92fdbc8b7350c4a03507ac3fd92f8f82923
MD5 8956ec662d09f1f1407894a9e2dde739
SHA1 cbe5a0fe0008452d48fa0b2610b53c71dcefb9a3
SHA512 f95ec2098f5c902dda99df6943953730e52e0de7be241655d765f4f9e10c5c293f9530f9e9b348b9120737a4aef4b18559f9c6f191402b232c9af5fde01d35b3
SSDEEP 768:BwwR1fQRDl6VE3qG2T/YULhOdQfUwe6RzqgX2rIfwUKTzWPTryQiIAMyOfI6PIr:X1i33qG2JRzqgX2VWi9NnOf1y
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh007.dat

Path C:\Windows\System32\perfh007.dat
Size 680KB
SHA256 2d9a76cb88d58ca4096c0229eaa67ab3dcd115a6ecb738d10dd8e0053b61f8b0
MD5 4f8eb3f95fec1a57710244c0fceac169
SHA1 aa82ef4d136a21739a02f837b1f6fd2b2ef19978
SHA512 6921d549ed14b5d72a1e6018758cebbd5ed08fabecbd40f268fb939b68b45205cbf7e56f9916a8254b3a263b43b0ff4f9a0f3e9104b420b26fb8f024f4bb9427
SSDEEP 3072:chpwBxTEsmVdxOpM88RMgfQuRx+PYZ1XrcPDtzcSx2A8q1JuqaB32rSrSVCxls/g:/PZmiDDnKofxk
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 646KB
SHA256 c4ace92324a176396bae3463fd9502f6a0f1f375534bda07d7e9a2d38e48a2f5
MD5 5d82fc32d22b7840015aca29a677f702
SHA1 634c0604f4d16dc0576ded69e6b3ceab39589625
SHA512 7fa97e141de08a628dfd75590fc0a953f878e7eb2864e262b404f6ec6bd2ad7bc6a9efec524a8e82375df4b0908e29cd7114d7be52d538693967405850b31e40
SSDEEP 3072:PdGEJowE4j0kRZnLOlMZ8M6d0UHjYnWB7BxLh0okf9zQdcpM7q3TBQpsAMXV7c9F:j8M6d0SZ9W1+
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh00A.dat

Path C:\Windows\System32\perfh00A.dat
Size 727KB
SHA256 c1000137859913282ecea9f24f075031ae7d90a3b1c46b36595289078bbc5929
MD5 04e45cff3993c19739548779be51eed2
SHA1 f8a7ba5fc4647f0c0e34297b7e4b4e77aaa206a7
SHA512 f7de7abe634dab2009c96b87e0002f603400d997699ab13bbac5ae03f714214102b8cadfd5d1b53160b40e9ffb58f5d3a15a7d3fa0c9c57179284c5d7d73d706
SSDEEP 3072:2f57F17Fetjvtx1tTSam86nAgnjXSn5EBGP5pNxXoTbMd4Xn8BoMjHArzThBOZnb:Ntjvtx1tTS3n3jXCP5XZnUOZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh00C.dat

Path C:\Windows\System32\perfh00C.dat
Size 727KB
SHA256 aebb3abdd7e5733457987adff79bb8a7662e059368a628ec32b8943d708369a4
MD5 23cfd66ced96456fda591b26414c0a36
SHA1 2fd65d408cc3101c40d3da9d3eea8d0a2ca20c1f
SHA512 0851402513350f10ba5f4255b2d7e1264ddbb8323fcf4e930cac2975d7e95a7368f0ee71b93413af29633064f4df0515202f6350e30392f2c269c9ef28e711e4
SSDEEP 3072:8S0+6JpGytgViPIiy4auTs62gdDIefsnnSRRDwcBRKZNtflhHZneBZoVoZfMdtBq:mTsIrCeJqi
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh010.dat

Path C:\Windows\System32\perfh010.dat
Size 722KB
SHA256 91654b82dc82e4e7522ef46cadbd0b582881a369c9306d55856a5f748056bc24
MD5 b91ee2d171f5682163225eb57aed83ed
SHA1 bacbe30271109cc84bf192a66c4ab4cc41ae3b3a
SHA512 053b2c7e0a5648fcba226e07c6f435f4b2e09ceca7cf20328b27c4d0a2a06fe65c93f8ea1b92cfbd5f37866882d9482864df5e687b79c0816ef6790b721de772
SSDEEP 3072:gd8gxHwjkUXx5q8d8tj/v9GLcxcx8oEpvnLB+aVGul9oLim4dDXBnZdQTKSBf1T5:oHj/v9GLnaVGuEkB4Bfv
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh011.dat

Path C:\Windows\System32\perfh011.dat
Size 406KB
SHA256 c82712cbaf78493d5ec7590d62ae95e16b152697e57e4a0e5c71cfa7edfb8b94
MD5 cbd875112b1152281ce9f6c1e06ba86a
SHA1 c229b133d821389ba2aa619507d5bf874ee7c2b2
SHA512 c2cc8ea55c8a6280455ce94fd37518945cbe1d6070fe62dfdf57df0ef8d8b3a7c6c719f2a8448d60b864e5be5df254941927b80f8960db3c4ecc72d3976bbd0f
SSDEEP 3072:Ej83gD6HfgO/235TjhpoMnkrBI4BHvjxiBzBDVTooFosWbEh3KlpsOdciKXEqB3S:o83r/23hLDfcHyKK8BmF2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab8A55.tmp

Path C:\Windows\Temp\Cab8A55.tmp
Size 29KB
SHA256 a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53
MD5 d59a6b36c5a94916241a3ead50222b6f
SHA1 e274e9486d318c383bc4b9812844ba56f0cff3c6
SHA512 17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489
SSDEEP 768:hbIXHqGVBV+xrk2TY+Awydbvk18hbhMtSsQgCE7:hbIXHqGVBVYrU+Ar788LuYs
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar8BAE.tmp

Path C:\Windows\Temp\Tar8BAE.tmp
Size 81KB
SHA256 725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15
MD5 b13f51572f55a2d31ed9f266d581e9ea
SHA1 7eef3111b878e159e520f34410ad87adecf0ca92
SHA512 f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c
SSDEEP 1536:FPmjsoxXSSRrByDBo/DYBK4HZpCnfOOxhgGS5:MjsQ14DSbuy5A5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Office.Tools.Word.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll
Size 834KB
SHA256 a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
MD5 c76656b09bb7df6bd2ac1a6177a0027c
SHA1 0c296994a249e8649b19be84dce27c9ddafef3e0
SHA512 8390879b8812fc98c17702a52259d510a7fe8bc3cf4972e89f705e93bc8fa98300c34d49f3aec869da8d9f786d33004742e4538019c0f852c61db89c302d5fdf
SSDEEP 24576:vBaQ/48o3J6EQf3quRzc1PUG1R56VNoKeLCmhLC6PcDgMDVoutjGEPt2XwiJVQw+:vmbF
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Office.Tools.Common.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll
Size 797KB
SHA256 4c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
MD5 aeb0b6e6c5d32d1ada231285ff2ae881
SHA1 1f04a1c059503896336406aed1dc93340e90b742
SHA512 e55fd4c4d2966b3f0b6e88292fbd6c20ffa34766e076e763442c15212d19b6dea5d9dc9e7c359d999674a5b2c8a3849c2bbaaf83e7aa8c12715028b06b5a48e1
SSDEEP 12288:ct8eQTQuTInEuQyT/xK6ur6EaPeDu4DDOikXuQKSLP635D:OVEQuTInEJMEaPADDBYW5D
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
Size 163KB
SHA256 99facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
MD5 e88828b5a35063aa16c68ffb8322215d
SHA1 8225660ba3a9f528cf6ac32038ae3e0ec98d2331
SHA512 e4d2f5a5aeaa29d4d3392588f15db0d514ca4c86c629f0986ee8dba61e34af5ca9e06b94479efd8dd154026ae0da276888a0214e167129db18316a17d9718a57
SSDEEP 3072:Vfrwg7RYTqxvEgqLR8yvI/3+TGcrLtsooV2eJeC:Vr2TgyzlHrLUo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Office.Tools.Excel.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll
Size 1.3MB
SHA256 489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
MD5 006498313e139299a5383f0892c954b9
SHA1 7b3aa10930da9f29272154e2674b86876957ce3a
SHA512 6a15a10ae66ce0e5b18e060bb53c3108d09f6b07ee2c4a834856f0a35bec2453b32f891620e787731985719831302160678eb52acada102fdb0b87a14288d925
SSDEEP 12288:prmLSP94aDva1B9rh6cLRIo8BxT6hFfK1/bukdQA2CFxOy5atDdurc650fKkQZrD:p3qEMrZLWtxT6S/bLQA2CP5ataOfp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Office.Tools.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
Size 148KB
SHA256 f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
MD5 ac901cf97363425059a50d1398e3454b
SHA1 2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA512 6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00
SSDEEP 3072:/zYqzl6vitEz7xwXmh8GffcXIq37NVbN:/zzlcFsNV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Size 34KB
SHA256 620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
MD5 c26b034a8d6ab845b41ed6e8a8d6001d
SHA1 3a55774cf22d3244d30f9eb5e26c0a6792a3e493
SHA512 483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537
SSDEEP 384:da5BCjktbG0LW4OYWajiCRRrrOcEdqEGSGtg67KGhJSxUCR1rgCPKabK8tBX5PKY:E5BCjkdGViiyrKBgEnGtFiJrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0b641086fe5b6e2bb2127dca7f2fa88e\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Size 143KB
SHA256 479d20042de551dad612907e307319037fc3a018bf9d8555980495aad0fe26bb
MD5 5e380e103024ccd66824648df0104d10
SHA1 761389b204ecb9fd3e6af7040b8f27848814527a
SHA512 cf8bb08f43fd904030c418f096cf63b274b673006d1062b41d79652c87a42b1c8f32b334183b7d28ca5d318ef0dd696961477730f4bf5feb12dda6a2af06b792
SSDEEP 3072:fQ+LLoRHGqk0svxWqZz9dfc7HHzTn0dN1b1oY:fndqk02zfc7HHzTIN1b
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Size 109KB
SHA256 211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
MD5 0fd0f978e977a4122b64ae8f8541de54
SHA1 153d3390416fdeba1b150816cbbf968e355dc64f
SHA512 ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8
SSDEEP 1536:ZBTpx1pun2Ao8for8HKg+sr8LVG3xS/pBMnnYawG9FEGjLn95:vTpxSn2z8wyKg1r8LVGhS/pBuVjL9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\181356b1bbb85fe2401c4dfad1a45133\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
Size 158KB
SHA256 b2f9dce9baca3e56fb3587ffe30ca38eb0f89ed30985b328a853778480c0f87b
MD5 a763a9348ab4ee3bd593bb17d854e51b
SHA1 4d0c97ba6877e2f9ab32fe1316936a4f2e0ff2c9
SHA512 e8d3896d4bd788d3ed923e0c9d3ba19fe9fc507060e2e5e8e410964f4c9d7331928324a79336079ccc84c050d8f0acfb03126a2e3622daac3846b0bfd028f602
SSDEEP 3072:rXmcgbx1r1fG6nJ0ap08Jp6izVCLjGOd2v0Lq4otqJ:rqdp08JsipGd2v/d
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Size 41KB
SHA256 de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
MD5 3c269caf88ccaf71660d8dc6c56f4873
SHA1 f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA512 bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6
SSDEEP 384:nsgGdjJ/glRbWjeCWKmjAZE+S+dl5IG6g67KGhJSxUCR1rgCPKabK8tBX5PKytZB:K1J/glXtjAZEtG6FiJHbJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\43ac81bed18b52d77a8011ada80939b5\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
Size 296KB
SHA256 ad8d210d001d3298ad4e1cbf08449b2cbd2b358d28cfad99db78639627a7cb86
MD5 7687295a6e19cc656b077e6a61629d4e
SHA1 fa1025de5cffb56a3d1f8cae9d09b7171b33326e
SHA512 19de95fd90bc6f091e785074ee71dc15d450d65fbdea933e26650fb9c747d81ae2fca7f5f83192f17451a49a314d264cabea2202c805b6ffab729d381675734c
SSDEEP 3072:XLOtcZGhdEZGI9pyJet+6pwluGCulHxYoDUV4mV8TmQXc6rPPrs8X/huVOIBm8nL:Xifh+JwUaxYB4myNPPcOa469BbMD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
Size 356KB
SHA256 971188681028501d5ac8143b9127feb95d6982417590af42cf1a43483e38bd42
MD5 87111e9d98dc79165dfc98a1fb93100b
SHA1 4f5182e5ce810f6ba3bdb3418ad33c916b6013c8
SHA512 abbb246d620e8a2ab1973dde19ff56ea1c02afa39e889925fe2a1ba43af1ad4ff6eb017e68578ae520109b3e290b3d9054d7537eb2df0ede6e0fbca8519cc104
SSDEEP 3072:56qC2HqPCI6duJr7ptAAsT8I7SOqiBk+D+JlTYOlb2PvqFwqa/dhb9lrjrL0u7Sz:5R/InB7p+IzaK5pID3yj1VWO5Nk2
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5c8b40c69a2293c8f499b38b25c41117\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll
Size 157KB
SHA256 0406be7235661a62f68bff4c7640b4e241a0c392d548bf242ed08ba0eeaee66b
MD5 7bdf8e0c9aa04b71a52dd964005f4363
SHA1 a87e809146d3c70093a189c37f0a96b8bd0ce525
SHA512 4983ebf42241723cf258407c7d2a0773f395c861741f4e98bd7ac86e1ef0a597f89263bb5a986b69ffd43836a5e49d8f03342736b4c3183ea0c58b8099af2051
SSDEEP 3072:EoxNwNUVGfR8SSgOX55uKG/Smn6TQ93YvBg1HnAYrtFOlARuwq:EoOgQypg1HAYrClxwq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f2320d38621eb541713e6cd421c2b8a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
Size 648KB
SHA256 637dc357ff9011902186f2fd128ca74ac84fdb6d984f15036803b6a8fe28868a
MD5 7ebbba07bc6d54efd912bcd78b560b7b
SHA1 a6aee1a80ddcdf201301ac29293c62d58bcc941d
SHA512 2139a0d520ed70b72dc76fdd0555185386c9c22de1e1fb7eaac0607b313500c44f856c76ac6e2cd72148ea0b86b10bdd2b0ab7daacfc945cb66a637b8d99cfe8
SSDEEP 12288:pWTDfVLvLrEO96OBvKiepJM3bVfslML/Uxv:QTzVj96OBv+s3bVeM7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
Size 1.2MB
SHA256 868c297cb00b2d298f594ad7e3fd4e38aeaac78042613626d6f919b2bca25c4f
MD5 0637ad2bf6fc5ac1d29e547155bc818c
SHA1 a502879466b6dd37eae5881bbb18353f97623852
SHA512 1d18a16ec3b91c3143c4371de305a7ea464d41661752ece65bf1ce19a8342a265c024a740afa6be8baf4d1edfdac6c6fcdad7395c1294342cd1f4388428e52c1
SSDEEP 24576:LY6a+yFJfqheIdU342UZ7H6RQRcbRT0Je:LAXJfgnZH+T4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Size 210KB
SHA256 8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
MD5 4f40997b51420653706cb0958086cd2d
SHA1 0069b956d17ce7d782a0e054995317f2f621b502
SHA512 e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6
SSDEEP 3072:AY300VkAKMkZAQXSMUIG/qpZOMMu7tp425/g8XnXAxQjvAyBbE2IuT5K:N300abAQXSIpp425/g4XAxQj8sQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9248a710d7fe2485a557ce5d3cbcf2df\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
Size 607KB
SHA256 a09436c1df8fcd8ecd1732d6e4e68f32b092e71e0c5d3308b0f3f20abd03d4e0
MD5 e9ca062e4958cc25400c804029a5bf62
SHA1 1ed4374d0d0f568936fdebe17d9110481d6b3344
SHA512 43a9ea20d1e636201c0ce7098c198b893465b45f747ed2a002e8dd0bfc7739c28e166d259faf3a0087ae1fe59c74cc8e598f2b283cc7ebc345b6f3b5c388e520
SSDEEP 6144:KoC/phHYnalLnrVAaKRE5U70YvfWoE1LXAl2G8:oph4c5Aa/5U70YnDGXAH
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Size 53KB
SHA256 e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
MD5 e3a7a2b65afd8ab8b154fdc7897595c3
SHA1 b21eefd6e23231470b5cf0bd0d7363879a2ed228
SHA512 6537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33
SSDEEP 768:HWlAYEcK9BS9AYpLcMykgHoOQA91NEDqhq6rqnX/fksPLKzRoEkmKYE:2IS9AYpLbyvHoOeqhCX/fksPLKzeEk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
Size 65KB
SHA256 b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d
MD5 da9f9a01a99bd98104b19a95eeef256c
SHA1 272071d5bbc0c234bc2f63dfcd5a90f83079bbab
SHA512 dcb3273e33b7df02461e81a4f65ae99c0a9ae98188a612ce6d605a058bd2dcb6ddb5b7c78abe1f0a955b7f0c07c323dbfd77a2b6a629a9c87e4ecc1c57e4d81d
SSDEEP 768:qr7PJw0hqz81x2lNfGqljg6rqnucDEHr0Xvw+XTI2v+:qaz81EDfGqlEucDz3ku+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\af41f38c3891ddf799d6440d64fd7bcf\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Size 187KB
SHA256 f705c903cf7cca5bbb34d30acce80204dc10667f80dab7a7b0355644624feed5
MD5 b28c9a37f6b65c2b34331dcc4a0b5114
SHA1 c7804c66d955dd0b5d71d402357848fff58e1060
SHA512 b0e26a4d908890fe6a6b9370d9cd5db3b2ad57a90f8db23d9c028183ff72f547a5da20be75f615fc609ce31f6fafe8aa99503e2dfc6727edaefc35a9f5fa3ba4
SSDEEP 3072:0+AhM3TLW4RrF7xvzexZG0YUBXtqiZDgAOqa7pjS35ljC:/h35COqaA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Size 28KB
SHA256 4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
MD5 aefc3f3c8e7499bad4d05284e8abd16c
SHA1 7ab718bde7fdb2d878d8725dc843cfeba44a71f7
SHA512 1d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b
SSDEEP 384:zo44VLWb9pWk+/f1LPh5Ga14RKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+C:M44VKQjhgqX6rqnL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b8e029b1434d965380b363483e376df0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
Size 329KB
SHA256 e94a4ad1ef9de2886a231e857c8691328c2e6e344cc9e82440e5c45b8a788256
MD5 eb09a7062a66a50fe2cb16c4a80561a7
SHA1 33b4c71ced7644be9802374a4f04c866394daaca
SHA512 c57a4c626c87032ca422df04ce7c3322662a9b0c6c06a46e93f08ca8f431295c9ae802cd79f53cae5de2b39a30bbeb756c966880e874ed44115cf511cc1ff920
SSDEEP 6144:8h6AOltp2aPt5dft2o3JDyMpmcPZC7DJ:WC32LwDy/cPZC7DJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bb63c81d306795319eaf7af25f67342a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
Size 141KB
SHA256 124a0869df89ec2c9f0b307dd6b6d17e1e1e7ad638e0b4abf4483c15f842d270
MD5 58cacef7cbc000bb5ddeedc08a598f36
SHA1 f8963d4ac1f7b72c2ee4a0a6d45b921f4f88bab7
SHA512 9cf04e365abcdcfcb9c1f927da83a2dfe0791cccb80cd84ed63b03264d1e253060c455ed8664f35aee0a59e8c172f859ba49c67c9eec811a53e656c076c6bf66
SSDEEP 3072:ptfIAuWlpmNepqNiQsJVIpy27wRJWFwj2l/qTE:VpmoQsJVIpylRJW/lS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
Size 278KB
SHA256 54701cbe719b08b2393b9f4a604c372f9a280b5d3dd520b563d2aea7d69a1496
MD5 d74d434aa70ce827715b5e0ac7eda5be
SHA1 b53f3374be4c96af51c78fd873de1360f17c200f
SHA512 631d09a0ff39ece829f5c23278c2c030e5ff758b285128edb7805682de75b5be1aedd914d2325f79ec98d0103660a39ae1f1a5782f5dad038b143f3774c098df
SSDEEP 3072:hZJvD8mjXUBYAyL30/XB9DZ+eUAnHkIlwY8lIVkGw5LlYkT5xFyI1XwzRcB3AZRg:Vz7TL3oLFkES7sI1Y3gkCt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\cfda62def2a779969518651d60ef1557\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Size 180KB
SHA256 ab7157403b23583960b251a5a187f58473b60c581b77bbd38167d88479a16930
MD5 13ad37a72269fd27a874751824224e79
SHA1 3397e691e3141882ad1ef683f461882547f45524
SHA512 72f7e1c2a165233a943eedc324fc8d3138196a0a38caa1c022759940e1e7b642e661820175d6a232f1b51a2e11a9263c5db87df8ff448a47d2471c35af6ced21
SSDEEP 3072:o/wrDDxrtupHu1IcT7TX8qCg5T9+lumPNMEvW:gQTuput5pgZPNM3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Size 27KB
SHA256 edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
MD5 9c60454398ce4bce7a52cbda4a45d364
SHA1 da1e5de264a6f6051b332f8f32fa876d297bf620
SHA512 533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300
SSDEEP 384:p3G5WIYt3gWZRbqDXDa1F7RKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81T:p3GuxbqDTqk6rqnDT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Size 57KB
SHA256 4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
MD5 6eaaa1f987d6e1d81badf8665c55a341
SHA1 e52db4ad92903ca03a5a54fdb66e2e6fad59efd5
SHA512 dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2
SSDEEP 768:TjNuK+IyFStxjgruxqt6rqnGSAysH/c2QfUFNNM:TjjyFejg2qjGSAysyfONS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e9e77a821b5270fa8a9ffb554e183cbd\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Size 83KB
SHA256 f616e95397aa5c3b158ba16c226031655841ff94aabec285dfbb9f859f089814
MD5 8d0a924f0c8424dadb62be10a18575a4
SHA1 37c95e65d4b4e0169137474ccaaad0067e749639
SHA512 a61fa5510b1bbb11243f17c9e4fd564c7ca1da3cd94e6ac70b8050233a3afe3023a183da078a2fa302795d7f0d3e9ad5df9d97e5da1cc213fc4b684a40ba50c1
SSDEEP 1536:eaDF96wOuxSJApZF+GqXH3Lig1Cn0flLQY6nHeTD:bF9NSI+Gq33ug1CnPYJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Size 130KB
SHA256 f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
MD5 2735d2ab103beb0f7c1fbd6971838274
SHA1 6063646bc072546798bf8bf347425834f2bfad71
SHA512 fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de
SSDEEP 1536:7nPoe7UR41pBQgVV8XW/gRiiWT+NQU2mGBEPz0redeiHv+i1hy6EZ:rP77UoBQaARbGQ0ypHvxJEZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Size 59KB
SHA256 a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
MD5 8c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1 b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA512 825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557
SSDEEP 768:+dPHQ5qW4AlMdXQ8U34CbQU2wzitMGgRFiJiog4r/H9Pa3l1X:+dzAGQloCb5RoMGRESil
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Size 42KB
SHA256 f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
MD5 71d4273e5b77cf01239a5d4f29e064fc
SHA1 e8876dea4e4c4c099e27234742016be3c80d8b62
SHA512 41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180
SSDEEP 384:DZRKdYJ6rfFW8u7WbxyB50zc7bXV5qCmIGLg67KGhJSxUCR1rgCPKabK8tBX5PK2:biYJ6r+9BtbljGLFiJH6ZRa
MD5 SHA1 SHA512 SSDEEP

Submit Download

ehiVidCtl.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
Size 855KB
SHA256 897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
MD5 7812b0a90d92b4812d4063b89a970c58
SHA1 3c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea
SHA512 634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed
SSDEEP 24576:1YzsJmTux8s3+p0nydYLGCci7MV2vQxaPINO/XW54b6GnHQHiZELmtYvaWD8panD:Czsf8s3+p0nydYLGCci7MV2vQxaPINO3
MD5 SHA1 SHA512 SSDEEP

Submit Download

stdole.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
Size 43KB
SHA256 6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
MD5 3e72bdd0663c5b2bcd530f74139c83e3
SHA1 66069bcac0207512b9e07320f4fa5934650677d2
SHA512 b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626
SSDEEP 768:KlDLw8e093CR8YeJxO5+wBnjbjW1eRyhQmNj4MieeA:IM8YeJ05+w5jCLhxWMBe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll
Size 105KB
SHA256 dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed
MD5 d9c0055c0c93a681947027f5282d5dcd
SHA1 9bd104f4d6bd68d09ae2a55b1ffc30673850780f
SHA512 5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930
SSDEEP 3072:SaQ0OT+1zQRJgdeUQAqsVOrk2EH6/50/:SaCtRJgdeUQAqs1H20/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Office.Tools.Word.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll
Size 1.1MB
SHA256 df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa
MD5 7835e60e560a49049ae728698da3d301
SHA1 87b357b1b3c9a2ad2f3b89b10a42af021ab76afe
SHA512 b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993
SSDEEP 24576:FRlYHXXWY+Be8J6EQf3quRzc1PUG1R56VNoKeLCmhLC6PcDgMDVoutjGEPt2XwiK:FRlYHXXWY+/Do+G
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
Size 238KB
SHA256 0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86
MD5 0a4ed78b7995d94fa42379f84cd5f8e9
SHA1 90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b
SHA512 86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184
SSDEEP 3072:1M74iw31rTqczsFgqLR8yGI/3B5Qjrb/aL2SwXvgI6ZT4z4jv:ucikTbWzEf/aLZm4jv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Office.Tools.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll
Size 248KB
SHA256 c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08
MD5 4bbf44ea6ee52d7af8e58ea9c0caa120
SHA1 f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2
SHA512 c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3
SSDEEP 3072:dnrIbLB5SpvQjAfVAiAvZ8otMCKMWZk3Bxmqg5iOgDZMV6q36vVgbz7xwXmh8Gfn:dNAdDMg4NKDXgK64Y8BGBykfSitHrTz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Office.Tools.Excel.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll
Size 1.8MB
SHA256 3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6
MD5 9958f23efa2a86f8195f11054f94189a
SHA1 78ec93b44569ea7ebce452765568da5c73511931
SHA512 3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1
SSDEEP 12288:A+K+1Eye5cMQ2gLBN638XEkGFUK1/HupdyQCkUZz5FgtvqTwxRFwBqoWA/a3zIqY:ZV2cb6An+/H0gkUZz5hTw14Okb4Qww
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.Office.Tools.Common.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll
Size 541KB
SHA256 c29cefd05641ab09018f92c2a91e3ad231b577557a6dad40deab4e8786aa7f53
MD5 e3abba0345d6f5ecce08607028cf1cd9
SHA1 3073baf149819b7825bf2badc279308f24a87bbf
SHA512 8f3c14dc1e76465308a9c433235d71e1a051eb504c7c8f5db0c814edbc792548a62539dd1432c2c3f1548360f7c247691134977f889c52eb538e290798586131
SSDEEP 6144:TdsGMn/fVDvnd0Y67D2sYsduQsuotT/xK6ur6EaPe5:BMnVDiY6ruQoT/xK6ur6EaPe5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
Size 58KB
SHA256 34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
MD5 3d6987fc36386537669f2450761cdd9d
SHA1 7a35de593dce75d1cb6a50c68c96f200a93eb0c9
SHA512 1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11
SSDEEP 384:7PMW8u7WFNytFff1rbOpzc7bXJ5qCmIGLg67KGhJSxUCR1rgCPKabK8tBX5PKytK:7Bztt57b5jGLFiJH69
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
Size 205KB
SHA256 4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1
MD5 0a41e63195a60814fe770be368b4992f
SHA1 d826fd4e4d1c9256abd6c59ce8adb6074958a3e7
SHA512 1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728
SSDEEP 3072:LxdMbUJyvw+z3DmPh8SaQLkyLnzD9XnJVJfQeT6yKX1r8LVGhyiUilUn5GSihX:rzZnbliUi2n0v
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\0817dd144bd1703a16af65cf81ef80e6\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
Size 759KB
SHA256 9ef88d67461f4d91de1e16fab938d5561db9d04898d8776f9e716fdd52f91369
MD5 37c49cf471f7ad881127f9e38bed1a10
SHA1 473c3a7a28d138ccfff0d971a1ce9360ab990aba
SHA512 e88e5b3b41b5763ed7de4d3ef40ec77144252c30d8d67f5b387b905026bd856e9d70889ccf9f78b0c0a7b0298ca8afdbaed133675001dc60593c6fbc31e93c47
SSDEEP 6144:p5Yy/ROrC8Ic/sgBh9cnarAaKRE5Lmxk2BNRAyb+GXePpIpAHGyxE7J+XRk:7/wsz+ugAa/5LmxkWLvDeiICIhk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\19c2b79f666960d7a242a04c5d76f114\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
Size 227KB
SHA256 6c4f0f9775fbaf81122cba659cdd5449974810c772d51e152fc20016211988e0
MD5 4ec89a4e8fe1b5b9916ace8dbabc0418
SHA1 dafec0baada7f2fa425978a5816fe852053fb1fc
SHA512 648704c9808193a045035858b68f7e98981da8c1c98f07e04afacb1b181beeb0bf7df9f42a563636093aff05f01f0c7faacdde0561e9e8776e914611f9f43b34
SSDEEP 3072:3k7YhuE6x7E/q1GUqEnX35WT1fG6nJEQ4vQupZvC3GR36atU/IV1MaJNiBbe/R+u:iqEPt6a+aiep+fkP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
Size 43KB
SHA256 4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf
MD5 68c51bcdc03e97a119431061273f045a
SHA1 6ecba97b7be73bf465adf3aa1d6798fedcc1e435
SHA512 d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8
SSDEEP 384:NbWb9pWIgj92Ph5Ga14RKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+C739:NaIehgqX6rqnLD9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
Size 198KB
SHA256 469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268
MD5 9d9305a1998234e5a8f7047e1d8c0efe
SHA1 ba7e589d4943cd4fc9f26c55e83c77559e7337a8
SHA512 58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c
SSDEEP 3072:XSwrQTw+GOSEVZjAYe0/XRLF/PnXCkKY3nHNTwAR1mkGQ0ypRt024ZHgpSsyrGI1:4VAFyRnQHg/YGI1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\36c5a9d83dfb1b6b1c0202fb505c9daf\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
Size 221KB
SHA256 aa332098d4073a4c4a654d16ec5fd0b6e2b1f284890057e164204d756095dd93
MD5 78c5a493778f578ef5517fe161162819
SHA1 faf377bdc739623fb5f111d51af97e8c78f11525
SHA512 6a905ef75d2eb909cd30c3916110f6b41a849ff4ed9f4c19e4d5f85ccf05d9b9dd009b351003386778801909d2628ce4c6cd9b1a54e3a0cd1ab9c5496f35cf50
SSDEEP 3072:mRw2me3zyqYAYBbeO/IxFhpqNi6EdVtjidQvXEP2G+Y6o6:T2SzblIx16UXjievXI1V6n
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4aadb4c389e3c3168ed07890b4486d14\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
Size 305KB
SHA256 13c30eeeb3deb9389fc0794d6dd06cf721d1f1c97c6038c02f1d5c3f49aebf19
MD5 5d7899a1a0b7a90765004ccddab93ecd
SHA1 f9aead9f8fb1e00fd487eb80c97e68ac9f3c07dc
SHA512 bd8c19e4283126ec18b335134f9178f81ceb6413f37dbd604feddd447b9f1d9623c5aaeb3572bdcfe68f7ee61ecbaccbca8eead259c745df580680523ff897bb
SSDEEP 3072:aCzZKF1gjrjMEfO1wRSwuuUxvzexZG0YUBXtqiZDg7fPjgksNCsBT0wQPBhEGrhi:L1sEGD1fPjSNCsBT0wQnEmhTLB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4b363c5e4c1eae1701bf45d167f8658f\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
Size 91KB
SHA256 edc77665afe4901d4370c6a4fe7427b235a8b4bbcd58ac41ee72440cf414bb5b
MD5 adc5887e89bc56694a193d92898d3518
SHA1 267f14c45a86d50ad627c6cb00626049e9c1ee20
SHA512 bdea1e13b655e62b74f908f1012a746992245ffcebe21bad624e6e051429e8cccf531fc03fa1fc7319bc5c9c6367c261174394f9623a1968c6381d674b341a37
SSDEEP 768:MDXJTpaMHAzbz8H52lNfGqljg6rqnuOMfBaR9ocKMNk:MNlHobz8HsDfGqlEuOMJW9oD0k
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\585e8f83eff436c8156f071e8f2bdaa0\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
Size 1.8MB
SHA256 8eb8d5e0c2097d6fdae4b58cfde3e1be1dd6e59968891ac6d11efe8adf227285
MD5 04a6857c04546270358d14398fde209e
SHA1 596a3e11ac6c303c679edfd6c30aa71e8eaf8a23
SHA512 4e8bfd6bf9463a004c17a897026bcc1b4edb0764c7e959f09a744d395e9885b24f8e869b78896218ce930562796a3a8e3a7f0a59ba11c8dfa32b0908c5706b22
SSDEEP 24576:Gbz+EzlUs4fqheIdbwTe6clNgvqpQyDOscl15:+lEfgfWyDOsy15
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6348aa5d2bd39c221a41286e95c18b97\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
Size 381KB
SHA256 20d8234901a58ec8ec24f2ce7048ac9e1e7381e3eae10cfeb1e002001d2c8b6c
MD5 0811b25e0449e04f782127bc6f8ac5e3
SHA1 dc1766e20ee338b12fa80e3ce0052ef97ddf9e20
SHA512 a3a07aa4263175688019597b0829b090ad3b8ff43c554b8c89e16b48de86fddab4be6217bce24ccce9cad0c98df1240a7068c8b55778d836c34d5326cbd9c8a6
SSDEEP 6144:cvjcXKLFMdnS3sISCy5lHH6r39fO7A9fWu3s+I:cAyFsnS3036rX9Vs+I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
Size 70KB
SHA256 1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d
MD5 57b601497b76f8cd4f0486d8c8bf918e
SHA1 da797c446d4ca5a328f6322219f14efe90a5be54
SHA512 1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850
SSDEEP 768:dp3MVuuF2YvrGA5sRskS6KiIXrKhgEnGtFiJr93/apdS/IWTMdqZahrl:n3MVuuF2YvrGA+RsCKikrc5GSxMmcmg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\72878769c87f1ae773d0183f84ef4baf\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
Size 271KB
SHA256 49ed5a7a23338f8b7a77b215efb855dff857c12ef52dacfbead12135699f75b6
MD5 d4bc330aa1a561bda30cb0858d93638a
SHA1 93f1e496b427d76d56ad5fb455586a27a32eb56b
SHA512 58c163f12760fe2e48920bf14f0a3c60ef4f9cdbae513538d6cd2d1a7ab57057f3ee55c829cf6c9fc4ac5a1b9a274a1c6c039e7f4200ccb1142124ceecdaf291
SSDEEP 3072:3foUKwJcVp1XYgeN6mgjEupHu1IcT7TX8qCgaH9t49fkzxT8TnCwcrVzQiD:A/GJuputadG9szxT8TCTr+iD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\74054b5793bfb8c8c0753b4d4aead8e3\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
Size 947KB
SHA256 c632156c276f9189d0f53addcc1043006d86188e3b74d9c4042ab2110b6cfd4e
MD5 b1aa17d171be82960213057ca35815a9
SHA1 6c68a8a2c524ddbe04395dfa613378bb311aa314
SHA512 6f042aec9c74da86d15322d4300d93e4a9e69ad3555b302d42d7629dfa060209898b4569a380e9da1a785ddb53a6e0cc0f7543606f17ee467277990971c2fc1a
SSDEEP 12288:GuBMOWFogLwlfsK9ZSZguawlGlVNb5Hxf7gFpp0F7/xUgDj2Pm:roFL25PnbNb5RCkxUgDCPm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
Size 87KB
SHA256 b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88
MD5 ed5c3f3402e320a8b4c6a33245a687d1
SHA1 4da11c966616583a817e98f7ee6fce6cde381dae
SHA512 d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a
SSDEEP 768:Zi3OAYpLZMh3plFYqOQdDqhq6rqnX8qlh+JEUX:NAYpLKh3CqOGqhCX8qlh4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\95191bf1f65a5cedd5d0da3a519bc37b\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
Size 221KB
SHA256 99f772b7f561de4e625d7bcd3af0b3a58abfb60e53668c752a3ab53a4b16d778
MD5 aa3dcb9b1ea779c0b6848cccf3d14932
SHA1 11e2e7d75cb745094d1b870aecc17f3b603cd8d2
SHA512 f0c730b474c9242e06171e137c53280debb2789163ac303de0d1eb6fa1ff2ca20b051f7c0b31cf3a9f7376a0441c7d4b0af274cafc4070cb155513df0f955f81
SSDEEP 3072:n54egpVAMihQPSk0enxWqZz90HHz8Lcl+kxQO1pNTLUxdQ:5Vjk0oqHHz8Lcl+kuypVsdQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
Size 82KB
SHA256 37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047
MD5 2eeeff61d87428ae7a2e651822adfdc4
SHA1 66f3811045a785626e6e1ea7bab7e42262f4c4c1
SHA512 cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a
SSDEEP 768:LG4T0Q1Du+ci/pO/muxqt6rqnGCAbVZG+L9WZBmI1CmAE:LfT0Q16OpO/lqjGCAb2V0IomAE
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e2605baf91eb0d1d46833886c0ae51f\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
Size 122KB
SHA256 92748e1721ad2f648d69f3b296da14909ab05e84b040770c4a551805bc89774a
MD5 33224cf2762c33848d144ac9c7886eea
SHA1 ea42a26507efbb420e92e331d2de92ce05e71d85
SHA512 30b5b7e9364f1104c88d5df0e9fb45f957aa6cf31246cf08ffd2a4bdcdb74ef7e429d3ae81f91916f426a29969ff2ea836e7f769757c01f66e4513d96e636a81
SSDEEP 1536:T26IuTXEREBDsNTjdhFAlZF+GqXH3LignKL0ftx6SNQjPgFYOnmv:Kjf0+Gq33ugnKLYQGVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
Size 58KB
SHA256 1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7
MD5 a8b651d9ae89d5e790ab8357edebbffe
SHA1 500cff2ba14e4c86c25c045a51aec8aa6e62d796
SHA512 b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce
SSDEEP 384:0UDWjeCWGzThUb5eE+Sedl5IG6g67KGhJSxUCR1rgCPKabK8tBX5PKytZ+GrN5Wq:00gTmcENG6FiJHq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a8141e9e81e2c3bbf457e4980d4c2847\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
Size 483KB
SHA256 c26eea914017a12af65dc7ebcbbf86d5a620de60f57e3660057163613f2b0233
MD5 aae5a97685a809d0a0f661f9319f8a12
SHA1 b5fdd4ec4cc057fccc868de4f4910be89e23e48a
SHA512 d95c0635c587fe40e2c33cabf14e2893be49df06aebf2d40f4c0623f649e9abbd73a95cc5e3740db3b15df07406e36b1534781e63ee485e54671cfb21d3317fb
SSDEEP 6144:ZxgPDEq5VVGqdbIJT0K3pIMLJu5dElGKPq2OGQ:Lg7EKqqR7K3pTLM5dyDy2OGQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ad7d01564f0056d2476f6ae5d257356b\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
Size 436KB
SHA256 45ee38adadeb1586532e8dd4baba14740ccb0801c2e21318c35268543e0ddef7
MD5 748bed51a810c033b91c660b5776ab95
SHA1 ec2616fb01949fb9fe4b0eea707f7095b69aa9e4
SHA512 dc0cce4c633b8e43d8f6d565fcfc73d79bfea375a79ae5057af6d3cc1b62f929e34c95bcfe2f7d378ec7f421fafdd9ab73cff454df0934e2d2f45a52580e9df0
SSDEEP 6144:/ubG1UaxYVZm3MbURso7QIciE6PebveuxhKD4vWX:G2uZm8+sNxgDr
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\b22777deb45f6aeebf6bc7753dd76eea\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll
Size 220KB
SHA256 9f8de356dab305f2be5cf1f75934eb6b87072e1745ab5ee73ab4b319bb9a2b5a
MD5 5c35887a0b76108f6fb6daac51256ef5
SHA1 3be6ece2f60d205bcb955a5da0aa182d83cc1899
SHA512 0d1d2e5dd3ec776fab85e8f3b8cde32718bbbb52463c2702a17336326570a2fd624b0e32fd98182bba8c25fdd57ba861edebc1f00cfa66c04ec1c8a6f10fcee3
SSDEEP 3072:IBRiIMR0PLYZ/iUHGfR8SSgOX55uKG/Smn63qiPrfsBalUpSofdfALY4RMuiV:tj/im7EaKSsTV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
Size 85KB
SHA256 d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
MD5 5180107f98e16bdca63e67e7e3169d22
SHA1 dd2e82756dcda2f5a82125c4d743b4349955068d
SHA512 27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363
SSDEEP 768:AiQR6AHSZn4NTUVkNEwztMGgRFiJiGqKlyzzCZ62MPFeA:aR6AHSZn4NTUVkNlhMGREKt62MPFe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\daa561280ac1119d9c2694442212aaea\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
Size 487KB
SHA256 75127c1e3a30e544413d7eb24fd726bacf8c3a3951ddba1fc990ad00a7f1cc49
MD5 aefa28d036740086ae52d157f245200a
SHA1 d502f55fa76c3cdb69c8ab97321cd9b9a4b68e55
SHA512 3943c099644525fc2b3a50f843cc1612a003d4f92a9187b2fcecaaf90b33071bced0db4608a91bb59c6bf5d1f6f4eb158881bf78cced0597b7bc3045d9b66ee3
SSDEEP 6144:fWN2YIQUPam5mdk8S/boaQv2lKMlLZ+QPKea63F:eWQSV5MH8QelKMl0QPKea63F
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
Size 298KB
SHA256 5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
MD5 5fd34a21f44ccbeda1bf502aa162a96a
SHA1 1f3b1286c01dea47be5e65cb72956a2355e1ae5e
SHA512 58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125
SSDEEP 3072:TSdEjG0bLnUk7DO5PC/CVrJ2b7LW6EqNoEZP7XBwJDSkypzPNLpmQmlMUIG/qpx3:xX575bLpmQmlI+7SK3atvv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
Size 43KB
SHA256 f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c
MD5 dd1dfa421035fdfb6fd96d301a8c3d96
SHA1 d535030ad8d53d57f45bc14c7c7b69efd929efb3
SHA512 8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1
SSDEEP 384:17WIYt3gW+obpDXDa1F7RKJ9Yu6dnPU3SERztmCJMadMardz/JikPZ+81A:14tbpDTqk6rqnDA
MD5 SHA1 SHA512 SSDEEP

Submit Download

ehiActivScp.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll
Size 124KB
SHA256 2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2
MD5 929653b5b019b4555b25d55e6bf9987b
SHA1 993844805819ee445ff8136ee38c1aee70de3180
SHA512 effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013
SSDEEP 1536:dh8s4Nbhj0R88DRaHLgENQgux4q+OKAbIf304KuSQY:dh6hjQRsQgU3bIfr
MD5 SHA1 SHA512 SSDEEP

Submit Download

ehiVidCtl.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll
Size 2.1MB
SHA256 5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a
MD5 10b5a285eafccdd35390bb49861657e7
SHA1 62c05a4380e68418463529298058f3d2de19660d
SHA512 19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452
SSDEEP 49152:Xqj3MRF8s3+p0nydYLGCci7MV2vQIaPINOFXW54b6GnHQHiZELmtYvaWD8pangdc:Bn8s3+p0nydYLGCci7MV2vQIaPINOFXE
MD5 SHA1 SHA512 SSDEEP

Submit Download

stdole.ni.dll

Path C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll
Size 88KB
SHA256 9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998
MD5 1f394b5ca6924de6d9dbfb0e90ea50ef
SHA1 4e2caa5e98531c6fbf5728f4ae4d90a1ad150920
SHA512 e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476
SSDEEP 768:jBxZ9CQeJIzlJ1OkajJpxeGxO0BnjGjW1eRyhQmNj4v+y0ebpjGKJp:9xo0ROP/cGx/wjCLhxW44pbJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

_Networkingperfcounters.ini

Path C:\Windows\inf\.NET CLR Networking 4.0.0.0\0804\_Networkingperfcounters.ini
Size 162KB
SHA256 b96641749344ef7a526a9beb091ee01f24b15be6e8cbb1910ab3950735d00664
MD5 1e6f1204fe6d523fd92be81efbe4e04a
SHA1 048bc3a594b3400646ccaf355e9aef3ea1807ccd
SHA512 bd31a4f06e46972de1c52e3eba18e6445227de561917f114fa9689973279d5ac97d0fd6025de8c66d483bf71ce56f1b8406b04133e0a8d72ed5ae1f98328dc2c
SSDEEP 3072:FvUkBdKFu9xcDwuQCz8vIEXIXEPbGvjxOwujwpizUB:i
MD5 SHA1 SHA512 SSDEEP

Submit Download

aspnet_perf2.ini

Path C:\Windows\inf\ASP.NET\0001\aspnet_perf2.ini
Size 972KB
SHA256 9185acaab08190024106ed25782de038ad4e1df4f1e6cc0c30566c1657987922
MD5 60d35695506c89e7b3a45173bdb84e20
SHA1 d2d980c004632a74b8ec97621df904573ea1e0d3
SHA512 c3008a2bceb02ff3c72a54b25a724d76dc658632ef402b8a927a1f0f0168b4423d174b0fa53fcf0335acdb04723f5bc9d0fdcba40ca884b7b932b5505cca100b
SSDEEP 6144:GABI3glTJA0q8lgyTFaFru7xPK/8XMVUwNnf:G7
MD5 SHA1 SHA512 SSDEEP

Submit Download

aspnet_perf.ini

Path C:\Windows\inf\ASP.NET_4.0.30319\0001\aspnet_perf.ini
Size 974KB
SHA256 209367dc07168cf47d43e0e7a2482b40707292daf85ebfad1498a22ac4be9cae
MD5 849b9d28dcb2c672a3bb5cf2154c0c48
SHA1 1cdec72079a700b833ff909150a3700bc699c7a2
SHA512 2fcd844cf8aad49fe3813e95951eacde786641fc0302fb0a09b89fe5ed62e598bca2f377269781e05bf89bf001ebf35a70e4324581938a09daa8da6fef70a15e
SSDEEP 6144:kYBIRU9TJA0q8lgyTFaFBe7xPK/8XMAUwNnf:ki
MD5 SHA1 SHA512 SSDEEP

Submit Download

aspnet_perf.h

Path C:\Windows\inf\ASP.NET_4.0.30319\aspnet_perf.h
Size 7KB
SHA256 2e1cb9b545075233c86c875c611029f8faf162c206fd0b024759def531c8309b
MD5 8fe6d34e9ba1b68d13d3fa8f0be994e2
SHA1 40e9be0cd7fd665ce8e7170039b337cba21f0802
SHA512 954f7f13b2562398e5c96480d1335e992582e761e435ae76e3378b03b4092bae272801e2b97487517cd3930ae3d9ea1a47e01a8de92889ab1b6c53bcaebd02a5
SSDEEP 96:X6+Oiu2Xus6INuTJYdfBKWav6fsSxcRWQkDmXPs7W:X6+Oiu2X16ICJYdpKWav6UOcRWnaPuW
MD5 SHA1 SHA512 SSDEEP

Submit Download

_TransactionBridgePerfCounters.ini

Path C:\Windows\inf\MSDTC Bridge 4.0.0.0\0804\_TransactionBridgePerfCounters.ini
Size 132KB
SHA256 fa9bc8de7d5fc1286ee3b377b7b64dfd45bf1ca64d351cf84219258d69d28b5f
MD5 9bbd7f42f8b83a37fdc5c9845f0f3bce
SHA1 844417b0337dd5859e0e14e9d4e9f470b9d15891
SHA512 2ac7742a3e0d2032ef5895556443a55669e182679e80c962cadbc3e6f44b4f5c335c134bc2ba99588176af8f2b57d95b4be8720bd50eb8f9fda230acd895d8e5
SSDEEP 768:eso3IBAA7veWloaaS886jsthfH07GoVgqA69XdPHa3nyKvkCb6gtg1SxHJmSqcP:b6jsY7Dy
MD5 SHA1 SHA512 SSDEEP

Submit Download

_SMSvcHostPerfCounters.ini

Path C:\Windows\inf\SMSvcHost 4.0.0.0\0804\_SMSvcHostPerfCounters.ini
Size 130KB
SHA256 a45b01d603ce04bb571a0d9e397402d7f5712b2d8c53a559d82ba51c82665226
MD5 77729c6bb134e72eca1af79065a7827d
SHA1 440432551e46e3578406640b80142145a6b0aee8
SHA512 b3d3972bde1a957cf460396fb38e97a038b725d7546ef17369d3f89cca02394fca6b9db68a4d1bf50e5e682a83b881e340ef6eb888f20f2272e6e22a56971dc3
SSDEEP 768:Bso3IBAA7veWwoOizlvPmSu2IZKGl25lIFg45P4mXWK9dtk9y+:VizlC2pGlVXWK9dtk9y+
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerfCounters.ini

Path C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0804\PerfCounters.ini
Size 150KB
SHA256 30cba9ada8f072d597b1fb6209caf762c36aafbf5c724a2156b032ab3f5be3f8
MD5 9373e6c17e6b07895743759b0285e5f1
SHA1 3158ddc28fc09d9ccd870b4ffa17d0846a1f8e5a
SHA512 fd068acd0fad925bb8ed36953b20a20d7393459f238300b8760dd2627e35cdd033f6c218bcd3c9e16a892b5e1b8e795b12ec29c86a875aa617c5f88e9016c1ab
SSDEEP 1536:lzpRo3nOY4p3Djs7DoeWWuWeiemWkAPYj5eA1Bfx:lzpRN3Dw7Dsk+Y1eo
MD5 SHA1 SHA512 SSDEEP

Submit Download

aspnet_state_perf.ini

Path C:\Windows\inf\aspnet_state\0001\aspnet_state_perf.ini
Size 41KB
SHA256 d4e8445619208069dc343e9160eb394e3fb97529328d29b34c192a27ad683af9
MD5 b5ebeb2f3699db3f59959362f2825e69
SHA1 f2182ecb27f2862225109a24255673c41ddbcee5
SHA512 6f4a63194e8e218e1df584982a04de94fccb2309619d92c07fb107ff97b2bdc2dc301b2bdeb6016e5b1bf3afcdcdc276cc482eb51ffa027af5ef7c6bfef0aa71
SSDEEP 768:iTo3IBAA7veWnai/j87C1nxc3Bnro35Uz/Skbk9vdn0QW/vondkmkmVJvWoFse+a:fOYc
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path \6c3dfc7293b5537f042c271533\Setup.exe
Size 86KB
SHA256 a9d2cc918999858aa1e500a8fbc919b6397da6b44b666e3fc0edd38920748212
MD5 40d87630ef1364a3dc4fd3387212c77d
SHA1 2ab844ca20815c51960ac5d1d75e93897c9f2df2
SHA512 d81f1e80186f3c9c78a45c235f30da9e6f5cd3ca1f6b153892a1c53decc350b7a5f4f9924f59ab83dc20c31acad783faeebbcb67c9419f74628da6459530c9d3
SSDEEP 1536:Sho8hgX1PdzaodhYbyyyygPoZI9+WZnqxMQP8ZOs0JJ+vVIZN:Sho8hiVd18yyyygPoZcX/gBqNqN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualBasic.Activities.CompilerUI.dll

Path \Windows\Microsoft.NET\Framework64\v4.0.30319\1033\Microsoft.VisualBasic.Activities.CompilerUI.dll
Size 267KB
SHA256 53fe6a5a764c81d0770c0eec818af054f436cf14fca98f2a7b50267659ae6d30
MD5 3e0aea97cd4ad00048a7ad612d97404b
SHA1 b5ded8027f587edbd5c831bf4d8de94c0e8fc0c9
SHA512 46a4ffc8a5e51529a1d0a010ec714d24ede98483eab0f5c402e35ff7875c370b5089d9ce1f74d47e0d29262ca49f96aa51e105406b3d9b473dddc38ac05a3f41
SSDEEP 3072:uj2tgnmTRp0biWj1GdL3Qj6v8h43nECvOY/:ujmpoiWj1GdLU6vq4UCvOG
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc7ui.dll

Path \Windows\Microsoft.NET\Framework64\v4.0.30319\1033\vbc7ui.dll
Size 266KB
SHA256 46548e54d799cb1a6d7b3a2dcb332d829434a6eb7216208a9874831069929d00
MD5 2aa11251c2cb82dde4996ae31845551a
SHA1 37092867b7904f4510fdabec0b1031d68ca843ea
SHA512 01920320d0c5ac9ca315faf3b2eb85630f95c7cc69e695a6dbc72e2060c87fc2491289821cfded08e0b82fcb9d6b9813071d3c6d13bb9faaaed2ef8435c60eb8
SSDEEP 3072:ZIGBgnmTRp0biWj1GdL3Qj6v8h43nECvOVE2G:ZIKpoiWj1GdLU6vq4UCvOjG
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualBasic.Activities.Compiler.dll

Path \Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.VisualBasic.Activities.Compiler.dll
Size 3.8MB
SHA256 37508e0776f7a4eb6e1cb36623b1d8bde7f54147cc1fbd7aca8e9e0304ab19a4
MD5 f945684b3e2cabc3df0bcaada876e6e2
SHA1 52b74b20e8113470bf119bac8a9e95374bae18ee
SHA512 9e7cd4b345e977013975cb76909fc368206870288c3089a48edd4d07c03b3c451dd0fcd043c99b3c48b3b471212c2a46ec591bc6091fecc0c68831760fb4e728
SSDEEP 49152:UztpMld8PIOrshpW1Ya0xrKwFDfEZ6Panm16aAG0fIxmXpqld9owijW/wMc0:X8PIOrshQ1wFom16aAGoI8qHoJrQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

vbc.exe

Path \Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
Size 3.1MB
SHA256 0eac2b0a121b287a323a3941dfcb2244c026656d29c20697abe90ead1d50dc9c
MD5 7737cc2f0bf1d0aebcaf14be3e1d83fe
SHA1 17784293db75fd968fadb557b95da28fcecc8189
SHA512 f8a5346fcc5c295a3ccff948f2c8b7a6c0c21266b49fb79f195d47e24f8a86fc739b4569d83a53f5b9e237ca8a09d5ed931c5422e52e162945e6b1db939d995d
SSDEEP 49152:6uWt/5PbLf29nkXJQdLjPPKSVvuJn2lg1lC8HorrJu9gTjAJNQ+qZA/bsWVl3S:sxukX6dLjPPFVPe1lC8HovJHRR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft.VisualBasic.Activities.CompilerUI.dll

Path \Windows\Microsoft.NET\Framework\v4.0.30319\1033\Microsoft.VisualBasic.Activities.CompilerUI.dll
Size 267KB
SHA256 5c42de36f968269c4caf400ffef28c460ac435547625134a735b97dffd569910
MD5 74db0148b1e924660cc7f873e2c781f5
SHA1 f4e4492adbe3ce5b38bd464f52814f44f924c02f
SHA512 53055f9eaf5660aadd476d22e99ebdd4f788e218920ee863b29be9de53f8ca4425f347b57859d3501a23f656f1046a74000d0cb03ac640f5690b1a39ec3cba1e
SSDEEP 3072:Uj2tgnmTRp0biWj1GdL3Qj6v8h43nECvOxvEr:UjmpoiWj1GdLU6vq4UCvOdI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/268-3846-0x00000000020A0000-0x000000000215A000-memory.dmp

Download

memory/268-3848-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/268-3870-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/628-3859-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/628-3860-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/688-3830-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/688-3831-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/756-7375-0x000000005C000000-0x000000005C13C000-memory.dmp

Download

memory/868-3839-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/868-3858-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1092-3866-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1092-3867-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1188-3872-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1188-3871-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1204-3865-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1204-3847-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1380-3375-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Download

memory/1380-3372-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Download

memory/1432-3845-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1432-3844-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1484-3862-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1484-3861-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1500-3857-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1500-3856-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1616-3853-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1616-3838-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1628-3960-0x0000000001720000-0x00000000017A0000-memory.dmp

Download

memory/1628-3959-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Download

memory/1628-3961-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Download

memory/1628-3964-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Download

memory/1680-3841-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1680-3840-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1704-3832-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1704-3833-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/1720-3967-0x0000000001660000-0x00000000016E0000-memory.dmp

Download

memory/1720-3966-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Download

memory/1876-7402-0x000000005C000000-0x000000005C04E000-memory.dmp

Download

memory/2020-3868-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2020-3869-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2032-3864-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2032-3863-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2180-3371-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Download

memory/2180-3370-0x000007FEF5CD0000-0x000007FEF66BC000-memory.dmp

Download

memory/2220-3837-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2220-3836-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2264-3854-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2264-3855-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2428-3843-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2428-3842-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2496-3827-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2496-3826-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2536-3962-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Download

memory/2536-3963-0x0000000001720000-0x00000000017A0000-memory.dmp

Download

memory/2536-3965-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Download

memory/2748-3957-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Download

memory/2748-3956-0x00000000015D0000-0x0000000001650000-memory.dmp

Download

memory/2748-3955-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Download

memory/2748-3958-0x000007FEF5460000-0x000007FEF5DFD000-memory.dmp

Download

memory/2824-5697-0x0000064438000000-0x0000064438161000-memory.dmp

Download

memory/2868-3849-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2868-3850-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2876-5725-0x0000064438000000-0x0000064438061000-memory.dmp

Download

memory/2920-3852-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/2920-3851-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/3044-3835-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/3044-3834-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/3064-3828-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download

memory/3064-3829-0x0000000073680000-0x0000000073D6E000-memory.dmp

Download