Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 08:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe
Resource
win7-20240508-en
General
-
Target
2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe
-
Size
24.3MB
-
MD5
f88c4ba487f2219dd966313c33b30984
-
SHA1
a9ab1ac00de2c501c35c723628d4445c9288ca39
-
SHA256
6b7befd2136ea8436bbc0decf0d890719ff611dd202737b5501003b2e33aaaa6
-
SHA512
ef5e87c284c6399ce1a62d35cc50e5be338c6b6eb3e097e445be7dcc6398780cea8be7e1f116cc0f0b0d450cd2f9450cdf351c265b9303d1587a4464403faf32
-
SSDEEP
196608:wP0Hj6JigboXZDwqY8a/qVwsEXX1KOgCu3JK1Op3H2SAmGcWqnlv018g8:wPboGX8a/jWWu3cI2D/cWcls1
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
Processes:
alg.exeaspnet_state.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeehRecvr.exeehsched.exeelevation_service.exeIEEtwCollector.exeGROOVE.EXEmaintenanceservice.exemsdtc.exemsiexec.exeOSE.EXEOSPPSVC.EXEperfhost.exelocator.exesnmptrap.exevds.exevssvc.exewbengine.exeWmiApSrv.exemscorsvw.exewmpnetwk.exeSearchIndexer.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedllhost.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid process 476 2704 alg.exe 2652 aspnet_state.exe 2488 mscorsvw.exe 2468 mscorsvw.exe 1464 mscorsvw.exe 1496 mscorsvw.exe 1196 ehRecvr.exe 1972 ehsched.exe 1392 elevation_service.exe 860 IEEtwCollector.exe 1300 GROOVE.EXE 2128 maintenanceservice.exe 1148 msdtc.exe 1524 msiexec.exe 2520 OSE.EXE 2560 OSPPSVC.EXE 752 perfhost.exe 1664 locator.exe 2024 snmptrap.exe 2248 vds.exe 3004 vssvc.exe 2436 wbengine.exe 3056 WmiApSrv.exe 2140 mscorsvw.exe 2672 wmpnetwk.exe 2928 SearchIndexer.exe 2592 mscorsvw.exe 2276 mscorsvw.exe 1788 mscorsvw.exe 2056 mscorsvw.exe 1780 mscorsvw.exe 1704 mscorsvw.exe 560 mscorsvw.exe 2140 mscorsvw.exe 2856 mscorsvw.exe 2128 mscorsvw.exe 2820 mscorsvw.exe 2160 mscorsvw.exe 2140 mscorsvw.exe 3044 mscorsvw.exe 1284 mscorsvw.exe 1932 mscorsvw.exe 1696 mscorsvw.exe 1004 mscorsvw.exe 2140 mscorsvw.exe 1792 mscorsvw.exe 2156 mscorsvw.exe 1796 mscorsvw.exe 536 mscorsvw.exe 344 mscorsvw.exe 1576 dllhost.exe 824 mscorsvw.exe 680 mscorsvw.exe 1700 mscorsvw.exe 1456 mscorsvw.exe 1028 mscorsvw.exe 1628 mscorsvw.exe 1740 mscorsvw.exe 2216 mscorsvw.exe 1376 mscorsvw.exe 820 mscorsvw.exe 484 mscorsvw.exe 1620 mscorsvw.exe -
Loads dropped DLL 64 IoCs
Processes:
msiexec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exepid process 476 476 476 476 476 476 476 1524 msiexec.exe 476 476 476 476 476 740 476 1028 mscorsvw.exe 1028 mscorsvw.exe 1740 mscorsvw.exe 1740 mscorsvw.exe 1376 mscorsvw.exe 1376 mscorsvw.exe 484 mscorsvw.exe 484 mscorsvw.exe 1400 mscorsvw.exe 1400 mscorsvw.exe 2388 mscorsvw.exe 2388 mscorsvw.exe 2936 mscorsvw.exe 2936 mscorsvw.exe 896 mscorsvw.exe 896 mscorsvw.exe 1568 mscorsvw.exe 1568 mscorsvw.exe 1676 mscorsvw.exe 1676 mscorsvw.exe 3052 mscorsvw.exe 3052 mscorsvw.exe 1004 mscorsvw.exe 1004 mscorsvw.exe 1916 mscorsvw.exe 1916 mscorsvw.exe 2988 mscorsvw.exe 2988 mscorsvw.exe 2352 mscorsvw.exe 2352 mscorsvw.exe 2040 mscorsvw.exe 2040 mscorsvw.exe 688 mscorsvw.exe 688 mscorsvw.exe 760 mscorsvw.exe 760 mscorsvw.exe 1676 mscorsvw.exe 1676 mscorsvw.exe 1472 mscorsvw.exe 1472 mscorsvw.exe 1312 mscorsvw.exe 1312 mscorsvw.exe 344 mscorsvw.exe 344 mscorsvw.exe 2488 mscorsvw.exe 2488 mscorsvw.exe 1472 mscorsvw.exe 1472 mscorsvw.exe 2312 mscorsvw.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 23 IoCs
Processes:
GROOVE.EXE2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exemsdtc.exealg.exeSearchProtocolHost.exeaspnet_state.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat GROOVE.EXE File opened for modification C:\Windows\system32\locator.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\dllhost.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\msiexec.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\86158b2e2ba452c3.bin alg.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\System32\snmptrap.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\vssvc.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\wbengine.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat SearchProtocolHost.exe File opened for modification C:\Windows\system32\fxssvc.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\System32\msdtc.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\System32\vds.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\system32\dllhost.exe alg.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe alg.exe File opened for modification C:\Windows\system32\fxssvc.exe aspnet_state.exe File opened for modification C:\Windows\system32\IEEtwCollector.exe aspnet_state.exe File opened for modification C:\Windows\System32\alg.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe -
Drops file in Program Files directory 64 IoCs
Processes:
2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exeaspnet_state.exealg.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe aspnet_state.exe File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe alg.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Oarpmany.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe alg.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe alg.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE aspnet_state.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe aspnet_state.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\DW\DWTRIG20.EXE alg.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\rmid.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmid.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe aspnet_state.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\pipanel.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe alg.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdaterInstallMgr.exe aspnet_state.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jar.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe alg.exe File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe alg.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe alg.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe alg.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE alg.exe -
Drops file in Windows directory 64 IoCs
Processes:
mscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exe2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exealg.exemscorsvw.exemscorsvw.exemscorsvw.exedescription ioc process File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8F16.tmp\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index147.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index154.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index146.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5A12.tmp\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index134.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5715.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index150.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPD3B4.tmp\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index155.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14f.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index140.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPA9D6.tmp\Microsoft.Office.Tools.Common.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14c.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index138.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP8778.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13e.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAP933B.tmp\ehiVidCtl.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index147.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index152.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index150.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index151.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13b.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index144.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\Temp\ZAP5B98.tmp\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14e.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index136.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\Temp\ZAPB3B5.tmp\Microsoft.Office.Tools.Word.v9.0.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index153.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index155.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index141.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index141.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index148.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index140.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index14a.dat mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index149.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File opened for modification C:\Windows\assembly\temp\BUXT28YH6T\Microsoft.VisualBasic.Compatibility.Data.ni.dll mscorsvw.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\index14d.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe alg.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\index13d.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_64\index14a.dat mscorsvw.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat mscorsvw.exe File created C:\Windows\assembly\GACLock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index146.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\ngenlock.dat mscorsvw.exe File created C:\Windows\assembly\NativeImages_v2.0.50727_32\index152.dat mscorsvw.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
mscorsvw.exeSearchProtocolHost.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeehRecvr.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exeehRec.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exemscorsvw.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10310 = "The aim of the game in Spider Solitaire is to remove cards from play in the fewest moves possible. Line up runs of cards from king through ace, in the same suit, to remove them." SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit ehRecvr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\migwiz\wet.dll,-590 = "Transfers files and settings from one computer to another" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10309 = "Solitaire is the classic, single-player card game. The aim is to collect all the cards in runs of alternating red and black suit colors, from ace through king." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10058 = "Purble Place" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10061 = "Spider Solitaire" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@%SystemRoot%\system32\gameux.dll,-10305 = "Hearts is a trick-based card game in which the goal is to get rid of cards while avoiding points. The player with the lowest number of points wins." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10103 = "Internet Spades" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs mscorsvw.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000" ehRec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-104 = "Jellyfish" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} {0000013A-0000-0000-C000-000000000046} 0xFFFF = 0100000000000000b0110ae4eeacda01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SampleRes.dll,-117 = "Maid with the Flaxen Hair" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust mscorsvw.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates mscorsvw.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
ehRec.exe2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exeaspnet_state.exepid process 2124 ehRec.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe 2652 aspnet_state.exe 2652 aspnet_state.exe 2652 aspnet_state.exe 2652 aspnet_state.exe 2652 aspnet_state.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exemscorsvw.exemscorsvw.exeEhTray.exeehRec.exemsiexec.exevssvc.exewbengine.exewmpnetwk.exeSearchIndexer.exealg.exedescription pid process Token: SeTakeOwnershipPrivilege 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: 33 1028 EhTray.exe Token: SeIncBasePriorityPrivilege 1028 EhTray.exe Token: SeDebugPrivilege 2124 ehRec.exe Token: 33 1028 EhTray.exe Token: SeIncBasePriorityPrivilege 1028 EhTray.exe Token: SeRestorePrivilege 1524 msiexec.exe Token: SeTakeOwnershipPrivilege 1524 msiexec.exe Token: SeSecurityPrivilege 1524 msiexec.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeBackupPrivilege 3004 vssvc.exe Token: SeRestorePrivilege 3004 vssvc.exe Token: SeAuditPrivilege 3004 vssvc.exe Token: SeBackupPrivilege 2436 wbengine.exe Token: SeRestorePrivilege 2436 wbengine.exe Token: SeSecurityPrivilege 2436 wbengine.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: 33 2672 wmpnetwk.exe Token: SeIncBasePriorityPrivilege 2672 wmpnetwk.exe Token: SeManageVolumePrivilege 2928 SearchIndexer.exe Token: 33 2928 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2928 SearchIndexer.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeDebugPrivilege 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe Token: SeDebugPrivilege 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe Token: SeDebugPrivilege 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe Token: SeDebugPrivilege 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe Token: SeDebugPrivilege 348 2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeDebugPrivilege 2704 alg.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe Token: SeShutdownPrivilege 1464 mscorsvw.exe Token: SeShutdownPrivilege 1496 mscorsvw.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
EhTray.exepid process 1028 EhTray.exe 1028 EhTray.exe -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
EhTray.exepid process 1028 EhTray.exe 1028 EhTray.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
SearchProtocolHost.exepid process 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe 1364 SearchProtocolHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
mscorsvw.exeSearchIndexer.exedescription pid process target process PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2592 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2592 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2592 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2592 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2276 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2276 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2276 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2276 1464 mscorsvw.exe mscorsvw.exe PID 2928 wrote to memory of 1364 2928 SearchIndexer.exe SearchProtocolHost.exe PID 2928 wrote to memory of 1364 2928 SearchIndexer.exe SearchProtocolHost.exe PID 2928 wrote to memory of 1364 2928 SearchIndexer.exe SearchProtocolHost.exe PID 2928 wrote to memory of 2340 2928 SearchIndexer.exe SearchFilterHost.exe PID 2928 wrote to memory of 2340 2928 SearchIndexer.exe SearchFilterHost.exe PID 2928 wrote to memory of 2340 2928 SearchIndexer.exe SearchFilterHost.exe PID 1464 wrote to memory of 1788 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 1788 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 1788 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 1788 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2056 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2056 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2056 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2056 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 1780 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 1780 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 1780 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 1780 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 1704 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 1704 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 1704 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 1704 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 560 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 560 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 560 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 560 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2856 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2856 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2856 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2856 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2128 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2128 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2128 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2128 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2820 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2820 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2820 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2820 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2160 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2160 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2160 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2160 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 2140 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 3044 1464 mscorsvw.exe mscorsvw.exe PID 1464 wrote to memory of 3044 1464 mscorsvw.exe mscorsvw.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_f88c4ba487f2219dd966313c33b30984_magniber_revil_zxxz.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:348
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2652
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
PID:2488
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe1⤵
- Executes dropped EXE
PID:2468
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2592 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 1d0 -NGENProcess 24c -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2276 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 238 -NGENProcess 1d4 -Pipe 234 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1788 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 258 -NGENProcess 248 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2056 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 23c -NGENProcess 1ec -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1780 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 24c -NGENProcess 230 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1704 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 260 -NGENProcess 248 -Pipe 1d4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:560 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 268 -NGENProcess 1ec -Pipe 264 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 1d0 -NGENProcess 244 -Pipe 230 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2856 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 26c -NGENProcess 258 -Pipe 238 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2128 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 1ec -Pipe 23c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2820 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1d0 -NGENProcess 278 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2160 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 27c -NGENProcess 1ec -Pipe 24c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 260 -NGENProcess 274 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:3044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 270 -NGENProcess 1ec -Pipe 248 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1284 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 270 -NGENProcess 260 -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1932 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 278 -NGENProcess 258 -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1696 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 290 -NGENProcess 260 -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1004 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 268 -NGENProcess 244 -Pipe 284 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2140 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 298 -NGENProcess 28c -Pipe 294 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1792 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 274 -NGENProcess 258 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2156 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 29c -NGENProcess 270 -Pipe 1ec -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 294 -NGENProcess 1d0 -Pipe 260 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:824 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 1e4 -NGENProcess 27c -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:680 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 210 -NGENProcess 25c -Pipe 234 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1700 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 210 -InterruptEvent 1c0 -NGENProcess 1d0 -Pipe 250 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1456 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 1cc -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1028 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 1d0 -NGENProcess 27c -Pipe 1e4 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 274 -NGENProcess 2a0 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 2a0 -NGENProcess 1cc -Pipe 288 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:2216 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 29c -NGENProcess 27c -Pipe 25c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:1376 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 258 -Pipe 2a0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:820 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 254 -NGENProcess 27c -Pipe 1d0 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
PID:484 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 27c -NGENProcess 270 -Pipe 29c -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:1620 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 244 -NGENProcess 258 -Pipe 210 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:1400 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 258 -NGENProcess 254 -Pipe 268 -Comment "NGen Worker Process"2⤵PID:2556
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 2a4 -NGENProcess 270 -Pipe 274 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
PID:2388 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 270 -NGENProcess 244 -Pipe 290 -Comment "NGen Worker Process"2⤵PID:908
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 2ac -NGENProcess 254 -Pipe 27c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2936 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 254 -NGENProcess 2a4 -Pipe 2a8 -Comment "NGen Worker Process"2⤵PID:2064
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 2b4 -NGENProcess 244 -Pipe 258 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:896 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 244 -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"2⤵PID:2216
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 2bc -NGENProcess 2a4 -Pipe 270 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1568 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2a4 -NGENProcess 2b4 -Pipe 2b8 -Comment "NGen Worker Process"2⤵PID:2444
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2c4 -NGENProcess 2ac -Pipe 254 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1676 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2ac -NGENProcess 2bc -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:1656
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2cc -NGENProcess 2b4 -Pipe 244 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3052 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2b4 -NGENProcess 2c4 -Pipe 2c8 -Comment "NGen Worker Process"2⤵PID:2396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2d4 -NGENProcess 2bc -Pipe 2a4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1004 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2bc -NGENProcess 2cc -Pipe 2d0 -Comment "NGen Worker Process"2⤵PID:1956
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2dc -NGENProcess 2c4 -Pipe 2ac -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1916 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2c4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"2⤵PID:1296
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2e4 -NGENProcess 2cc -Pipe 2b4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2988 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 2cc -NGENProcess 2dc -Pipe 2e0 -Comment "NGen Worker Process"2⤵PID:540
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2ec -NGENProcess 2d4 -Pipe 2bc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2352 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2d4 -NGENProcess 2e4 -Pipe 2e8 -Comment "NGen Worker Process"2⤵PID:1488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2c4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2040 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2dc -NGENProcess 2ec -Pipe 2f0 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1368 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2fc -NGENProcess 2e4 -Pipe 2cc -Comment "NGen Worker Process"2⤵PID:2036
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2f8 -Pipe 278 -Comment "NGen Worker Process"2⤵PID:2352
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2ec -Pipe 2d4 -Comment "NGen Worker Process"2⤵PID:2488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 304 -NGENProcess 300 -Pipe 2e4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:688 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 300 -NGENProcess 2dc -Pipe 2ec -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2dc -NGENProcess 2f4 -Pipe 2fc -Comment "NGen Worker Process"2⤵PID:820
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 314 -NGENProcess 294 -Pipe 30c -Comment "NGen Worker Process"2⤵PID:2172
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 310 -Pipe 308 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2064 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 2f4 -Pipe 304 -Comment "NGen Worker Process"2⤵PID:2352
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 294 -Pipe 1cc -Comment "NGen Worker Process"2⤵PID:908
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 310 -Pipe 300 -Comment "NGen Worker Process"2⤵PID:632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 310 -NGENProcess 318 -Pipe 32c -Comment "NGen Worker Process"2⤵PID:560
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 2dc -NGENProcess 328 -Pipe 314 -Comment "NGen Worker Process"2⤵PID:1200
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 330 -NGENProcess 320 -Pipe 2f8 -Comment "NGen Worker Process"2⤵PID:2148
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 318 -Pipe 2f4 -Comment "NGen Worker Process"2⤵PID:2876
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 328 -Pipe 31c -Comment "NGen Worker Process"2⤵PID:2156
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 320 -Pipe 324 -Comment "NGen Worker Process"2⤵PID:1004
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 320 -NGENProcess 330 -Pipe 344 -Comment "NGen Worker Process"2⤵PID:908
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 310 -NGENProcess 340 -Pipe 2dc -Comment "NGen Worker Process"2⤵PID:2512
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 348 -NGENProcess 338 -Pipe 294 -Comment "NGen Worker Process"2⤵PID:1740
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 330 -Pipe 318 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2916 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 340 -Pipe 334 -Comment "NGen Worker Process"2⤵PID:2064
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 338 -Pipe 33c -Comment "NGen Worker Process"2⤵PID:824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 330 -Pipe 320 -Comment "NGen Worker Process"2⤵PID:2152
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 340 -Pipe 310 -Comment "NGen Worker Process"2⤵PID:1620
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 340 -NGENProcess 350 -Pipe 364 -Comment "NGen Worker Process"2⤵PID:1968
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 348 -NGENProcess 360 -Pipe 34c -Comment "NGen Worker Process"2⤵PID:820
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 368 -NGENProcess 35c -Pipe 348 -Comment "NGen Worker Process"2⤵PID:584
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 328 -NGENProcess 360 -Pipe 338 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1596 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 370 -NGENProcess 340 -Pipe 330 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2216 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 35c -Pipe 36c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2232 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 360 -Pipe 358 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1700 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 360 -NGENProcess 378 -Pipe 37c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:952 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 378 -NGENProcess 370 -Pipe 384 -Comment "NGen Worker Process"2⤵PID:1200
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 368 -NGENProcess 380 -Pipe 328 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1520 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 388 -NGENProcess 374 -Pipe 350 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:540 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 370 -Pipe 35c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2768 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 380 -Pipe 340 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2160 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 374 -Pipe 360 -Comment "NGen Worker Process"2⤵PID:792
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 370 -Pipe 35c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1456 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 380 -Pipe 368 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1676 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 380 -NGENProcess 394 -Pipe 374 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2956 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 3a4 -NGENProcess 370 -Pipe 38c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1472 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 370 -NGENProcess 39c -Pipe 3a0 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2524 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 3ac -NGENProcess 394 -Pipe 398 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1312 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 394 -NGENProcess 3a4 -Pipe 3a8 -Comment "NGen Worker Process"2⤵PID:664
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 3b4 -NGENProcess 39c -Pipe 380 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:1880 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 388 -NGENProcess 3b0 -Pipe 3bc -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:344 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 3b0 -NGENProcess 394 -Pipe 3b8 -Comment "NGen Worker Process"2⤵PID:2232
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 370 -NGENProcess 354 -Pipe 3b0 -Comment "NGen Worker Process"2⤵PID:2148
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 3c8 -NGENProcess 3b4 -Pipe 3c4 -Comment "NGen Worker Process"2⤵PID:2500
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 390 -Pipe 3a4 -Comment "NGen Worker Process"2⤵PID:484
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 354 -Pipe 394 -Comment "NGen Worker Process"2⤵PID:1624
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3b4 -Pipe 388 -Comment "NGen Worker Process"2⤵PID:3044
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 390 -Pipe 3c0 -Comment "NGen Worker Process"2⤵PID:1368
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3dc -NGENProcess 354 -Pipe 370 -Comment "NGen Worker Process"2⤵PID:1956
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e0 -NGENProcess 3b4 -Pipe 3c8 -Comment "NGen Worker Process"2⤵PID:792
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 390 -Pipe 3cc -Comment "NGen Worker Process"2⤵PID:804
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 354 -Pipe 3d0 -Comment "NGen Worker Process"2⤵PID:2444
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 3b4 -Pipe 3d4 -Comment "NGen Worker Process"2⤵PID:2196
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f0 -NGENProcess 390 -Pipe 3d8 -Comment "NGen Worker Process"2⤵PID:1492
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 354 -Pipe 3dc -Comment "NGen Worker Process"2⤵PID:2568
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3f8 -NGENProcess 3b4 -Pipe 3e0 -Comment "NGen Worker Process"2⤵PID:2948
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3fc -NGENProcess 390 -Pipe 3e4 -Comment "NGen Worker Process"2⤵PID:2232
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 404 -NGENProcess 354 -Pipe 3e8 -Comment "NGen Worker Process"2⤵PID:2396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 408 -NGENProcess 3b4 -Pipe 3ec -Comment "NGen Worker Process"2⤵PID:2880
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 40c -NGENProcess 390 -Pipe 3f0 -Comment "NGen Worker Process"2⤵PID:1740
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 410 -NGENProcess 354 -Pipe 3f4 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2488 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 354 -NGENProcess 408 -Pipe 3b4 -Comment "NGen Worker Process"2⤵PID:1844
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 418 -NGENProcess 3f8 -Pipe 40c -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:1472 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 3f8 -NGENProcess 390 -Pipe 408 -Comment "NGen Worker Process"2⤵PID:952
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 420 -NGENProcess 410 -Pipe 3ac -Comment "NGen Worker Process"2⤵PID:2356
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 3fc -Pipe 41c -Comment "NGen Worker Process"2⤵PID:2228
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 390 -Pipe 354 -Comment "NGen Worker Process"2⤵PID:760
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 42c -NGENProcess 410 -Pipe 404 -Comment "NGen Worker Process"2⤵PID:1856
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 430 -NGENProcess 3fc -Pipe 418 -Comment "NGen Worker Process"2⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2312 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 3fc -NGENProcess 428 -Pipe 390 -Comment "NGen Worker Process"2⤵PID:2676
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 438 -NGENProcess 410 -Pipe 420 -Comment "NGen Worker Process"2⤵PID:1456
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 410 -NGENProcess 430 -Pipe 434 -Comment "NGen Worker Process"2⤵PID:1924
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 430 -NGENProcess 3fc -Pipe 444 -Comment "NGen Worker Process"2⤵PID:1004
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 42c -NGENProcess 440 -Pipe 3f8 -Comment "NGen Worker Process"2⤵PID:2408
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 448 -NGENProcess 438 -Pipe 414 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:2944 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 438 -NGENProcess 430 -Pipe 3fc -Comment "NGen Worker Process"2⤵PID:560
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 450 -NGENProcess 440 -Pipe 424 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:792 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 440 -NGENProcess 448 -Pipe 44c -Comment "NGen Worker Process"2⤵PID:1952
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 458 -NGENProcess 430 -Pipe 42c -Comment "NGen Worker Process"2⤵PID:320
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 45c -NGENProcess 454 -Pipe 428 -Comment "NGen Worker Process"2⤵PID:2152
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 458 -NGENProcess 464 -Pipe 440 -Comment "NGen Worker Process"2⤵PID:1684
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 464 -NGENProcess 458 -Pipe 438 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1488 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 458 -NGENProcess 454 -Pipe 460 -Comment "NGen Worker Process"2⤵PID:1840
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 46c -NGENProcess 410 -Pipe 448 -Comment "NGen Worker Process"2⤵PID:2936
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 470 -NGENProcess 468 -Pipe 450 -Comment "NGen Worker Process"2⤵PID:2556
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 474 -NGENProcess 454 -Pipe 45c -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2068 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 478 -NGENProcess 410 -Pipe 43c -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:820 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 410 -NGENProcess 470 -Pipe 468 -Comment "NGen Worker Process"2⤵PID:2524
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 480 -NGENProcess 454 -Pipe 458 -Comment "NGen Worker Process"2⤵PID:1696
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 484 -NGENProcess 47c -Pipe 46c -Comment "NGen Worker Process"2⤵PID:2452
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 488 -NGENProcess 470 -Pipe 474 -Comment "NGen Worker Process"2⤵PID:3032
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 48c -NGENProcess 454 -Pipe 464 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 454 -NGENProcess 484 -Pipe 47c -Comment "NGen Worker Process"2⤵PID:1004
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 494 -NGENProcess 470 -Pipe 410 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2236 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 498 -NGENProcess 490 -Pipe 480 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2128 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 490 -NGENProcess 454 -Pipe 484 -Comment "NGen Worker Process"2⤵PID:1292
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 490 -InterruptEvent 4a0 -NGENProcess 470 -Pipe 478 -Comment "NGen Worker Process"2⤵PID:2208
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a0 -InterruptEvent 4a4 -NGENProcess 49c -Pipe 48c -Comment "NGen Worker Process"2⤵PID:1880
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a4 -InterruptEvent 4a8 -NGENProcess 454 -Pipe 494 -Comment "NGen Worker Process"2⤵PID:2916
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4ac -NGENProcess 470 -Pipe 488 -Comment "NGen Worker Process"2⤵PID:2172
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 4b0 -NGENProcess 49c -Pipe 498 -Comment "NGen Worker Process"2⤵PID:584
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4b4 -NGENProcess 454 -Pipe 490 -Comment "NGen Worker Process"2⤵PID:2236
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 4a8 -NGENProcess 470 -Pipe 4bc -Comment "NGen Worker Process"2⤵PID:1736
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4a0 -NGENProcess 4b8 -Pipe 4a4 -Comment "NGen Worker Process"2⤵PID:2220
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a0 -InterruptEvent 4c0 -NGENProcess 454 -Pipe 430 -Comment "NGen Worker Process"2⤵PID:2856
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4c4 -NGENProcess 470 -Pipe 4ac -Comment "NGen Worker Process"2⤵PID:1844
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c4 -InterruptEvent 4c8 -NGENProcess 4b8 -Pipe 4b0 -Comment "NGen Worker Process"2⤵PID:872
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 4cc -NGENProcess 454 -Pipe 4b4 -Comment "NGen Worker Process"2⤵PID:2776
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 4d0 -NGENProcess 470 -Pipe 4a8 -Comment "NGen Worker Process"2⤵PID:2232
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4d4 -NGENProcess 4b8 -Pipe 4a0 -Comment "NGen Worker Process"2⤵PID:792
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 4d8 -NGENProcess 454 -Pipe 4c0 -Comment "NGen Worker Process"2⤵PID:2160
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d8 -InterruptEvent 4dc -NGENProcess 470 -Pipe 4c4 -Comment "NGen Worker Process"2⤵PID:540
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4e0 -NGENProcess 4b8 -Pipe 4c8 -Comment "NGen Worker Process"2⤵PID:1028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 4e4 -NGENProcess 454 -Pipe 4cc -Comment "NGen Worker Process"2⤵PID:2832
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 4dc -NGENProcess 4ec -Pipe 4e0 -Comment "NGen Worker Process"2⤵PID:1004
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4d0 -NGENProcess 454 -Pipe 4d4 -Comment "NGen Worker Process"2⤵PID:2432
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4f0 -NGENProcess 4e4 -Pipe 49c -Comment "NGen Worker Process"2⤵PID:2200
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f0 -InterruptEvent 4f4 -NGENProcess 4ec -Pipe 4d8 -Comment "NGen Worker Process"2⤵PID:1456
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 4f8 -NGENProcess 454 -Pipe 470 -Comment "NGen Worker Process"2⤵PID:1860
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 4fc -NGENProcess 4e4 -Pipe 4e8 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2856 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4fc -InterruptEvent 500 -NGENProcess 4ec -Pipe 4dc -Comment "NGen Worker Process"2⤵PID:484
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 504 -NGENProcess 454 -Pipe 4d0 -Comment "NGen Worker Process"2⤵PID:3052
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 504 -InterruptEvent 508 -NGENProcess 4e4 -Pipe 4f0 -Comment "NGen Worker Process"2⤵PID:1552
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 50c -NGENProcess 4ec -Pipe 4f4 -Comment "NGen Worker Process"2⤵PID:1488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 510 -NGENProcess 454 -Pipe 4f8 -Comment "NGen Worker Process"2⤵PID:792
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 514 -NGENProcess 4e4 -Pipe 4fc -Comment "NGen Worker Process"2⤵PID:3032
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 518 -NGENProcess 4ec -Pipe 500 -Comment "NGen Worker Process"2⤵PID:1348
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 518 -InterruptEvent 51c -NGENProcess 454 -Pipe 504 -Comment "NGen Worker Process"2⤵PID:1656
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 510 -NGENProcess 4e4 -Pipe 524 -Comment "NGen Worker Process"2⤵PID:1176
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 508 -NGENProcess 520 -Pipe 50c -Comment "NGen Worker Process"2⤵PID:2076
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 528 -NGENProcess 454 -Pipe 4b8 -Comment "NGen Worker Process"2⤵PID:2156
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 52c -NGENProcess 4e4 -Pipe 514 -Comment "NGen Worker Process"2⤵PID:2636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 530 -NGENProcess 520 -Pipe 518 -Comment "NGen Worker Process"2⤵PID:788
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 534 -NGENProcess 454 -Pipe 51c -Comment "NGen Worker Process"2⤵PID:632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 52c -NGENProcess 53c -Pipe 530 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2856 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 510 -NGENProcess 454 -Pipe 508 -Comment "NGen Worker Process"2⤵PID:760
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 540 -NGENProcess 534 -Pipe 4ec -Comment "NGen Worker Process"2⤵PID:2216
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 544 -NGENProcess 53c -Pipe 528 -Comment "NGen Worker Process"2⤵PID:876
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 548 -NGENProcess 454 -Pipe 4e4 -Comment "NGen Worker Process"2⤵PID:2576
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 54c -NGENProcess 534 -Pipe 538 -Comment "NGen Worker Process"2⤵PID:2444
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 550 -NGENProcess 53c -Pipe 52c -Comment "NGen Worker Process"2⤵PID:2800
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 550 -InterruptEvent 554 -NGENProcess 454 -Pipe 510 -Comment "NGen Worker Process"2⤵PID:2440
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 558 -NGENProcess 534 -Pipe 540 -Comment "NGen Worker Process"2⤵PID:1412
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 55c -NGENProcess 53c -Pipe 544 -Comment "NGen Worker Process"2⤵PID:1572
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 560 -NGENProcess 454 -Pipe 548 -Comment "NGen Worker Process"2⤵PID:1552
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 564 -NGENProcess 534 -Pipe 54c -Comment "NGen Worker Process"2⤵PID:2880
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 564 -InterruptEvent 568 -NGENProcess 53c -Pipe 550 -Comment "NGen Worker Process"2⤵PID:804
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 568 -InterruptEvent 56c -NGENProcess 454 -Pipe 554 -Comment "NGen Worker Process"2⤵PID:1924
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 56c -InterruptEvent 570 -NGENProcess 534 -Pipe 558 -Comment "NGen Worker Process"2⤵PID:2512
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 574 -NGENProcess 53c -Pipe 55c -Comment "NGen Worker Process"2⤵PID:1840
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 56c -NGENProcess 57c -Pipe 570 -Comment "NGen Worker Process"2⤵PID:1348
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 56c -InterruptEvent 560 -NGENProcess 53c -Pipe 564 -Comment "NGen Worker Process"2⤵PID:2960
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 53c -NGENProcess 454 -Pipe 584 -Comment "NGen Worker Process"2⤵PID:584
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 520 -NGENProcess 580 -Pipe 568 -Comment "NGen Worker Process"2⤵PID:1952
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 520 -InterruptEvent 588 -NGENProcess 56c -Pipe 534 -Comment "NGen Worker Process"2⤵PID:1080
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 588 -InterruptEvent 58c -NGENProcess 454 -Pipe 574 -Comment "NGen Worker Process"2⤵PID:632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 590 -NGENProcess 580 -Pipe 578 -Comment "NGen Worker Process"2⤵PID:2916
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 590 -InterruptEvent 594 -NGENProcess 56c -Pipe 560 -Comment "NGen Worker Process"2⤵PID:536
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 594 -InterruptEvent 598 -NGENProcess 454 -Pipe 53c -Comment "NGen Worker Process"2⤵PID:1740
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 59c -NGENProcess 580 -Pipe 520 -Comment "NGen Worker Process"2⤵PID:2200
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 5a0 -NGENProcess 56c -Pipe 588 -Comment "NGen Worker Process"2⤵PID:1312
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 5a4 -NGENProcess 454 -Pipe 58c -Comment "NGen Worker Process"2⤵PID:1968
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 5a8 -NGENProcess 59c -Pipe 598 -Comment "NGen Worker Process"2⤵PID:1640
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a8 -InterruptEvent 590 -NGENProcess 454 -Pipe 594 -Comment "NGen Worker Process"2⤵PID:2800
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 590 -InterruptEvent 5b0 -NGENProcess 5a0 -Pipe 57c -Comment "NGen Worker Process"2⤵PID:2676
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b0 -InterruptEvent 5b4 -NGENProcess 59c -Pipe 5ac -Comment "NGen Worker Process"2⤵PID:2092
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 5b8 -NGENProcess 454 -Pipe 580 -Comment "NGen Worker Process"2⤵PID:2988
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b8 -InterruptEvent 5bc -NGENProcess 5a0 -Pipe 5a4 -Comment "NGen Worker Process"2⤵PID:2228
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5bc -InterruptEvent 5c0 -NGENProcess 59c -Pipe 5a8 -Comment "NGen Worker Process"2⤵PID:1956
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 5c4 -NGENProcess 454 -Pipe 590 -Comment "NGen Worker Process"2⤵PID:1492
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c4 -InterruptEvent 5c8 -NGENProcess 5a0 -Pipe 5b0 -Comment "NGen Worker Process"2⤵PID:2068
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c8 -InterruptEvent 5cc -NGENProcess 59c -Pipe 5b4 -Comment "NGen Worker Process"2⤵PID:2500
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5cc -InterruptEvent 5d0 -NGENProcess 454 -Pipe 5b8 -Comment "NGen Worker Process"2⤵PID:1412
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d0 -InterruptEvent 5d4 -NGENProcess 5a0 -Pipe 5bc -Comment "NGen Worker Process"2⤵PID:2524
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d4 -InterruptEvent 5d8 -NGENProcess 59c -Pipe 5c0 -Comment "NGen Worker Process"2⤵PID:1696
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 5dc -NGENProcess 454 -Pipe 5c4 -Comment "NGen Worker Process"2⤵PID:2576
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5dc -InterruptEvent 5e0 -NGENProcess 5a0 -Pipe 5c8 -Comment "NGen Worker Process"2⤵PID:1620
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5e0 -InterruptEvent 5e4 -NGENProcess 59c -Pipe 5cc -Comment "NGen Worker Process"2⤵PID:680
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5e4 -InterruptEvent 59c -NGENProcess 5d8 -Pipe 5ec -Comment "NGen Worker Process"2⤵PID:1396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 5d0 -NGENProcess 5e8 -Pipe 5d4 -Comment "NGen Worker Process"2⤵PID:2172
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d0 -InterruptEvent 5f0 -NGENProcess 5e0 -Pipe 56c -Comment "NGen Worker Process"2⤵PID:892
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f0 -InterruptEvent 5f4 -NGENProcess 5d8 -Pipe 454 -Comment "NGen Worker Process"2⤵PID:1488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 5f8 -NGENProcess 5e8 -Pipe 5dc -Comment "NGen Worker Process"2⤵PID:1700
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f8 -InterruptEvent 5fc -NGENProcess 5e0 -Pipe 5e4 -Comment "NGen Worker Process"2⤵PID:1924
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5fc -InterruptEvent 600 -NGENProcess 5d8 -Pipe 59c -Comment "NGen Worker Process"2⤵PID:1796
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 600 -InterruptEvent 604 -NGENProcess 5e8 -Pipe 5d0 -Comment "NGen Worker Process"2⤵PID:2072
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 604 -InterruptEvent 608 -NGENProcess 5e0 -Pipe 5f0 -Comment "NGen Worker Process"2⤵PID:1840
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 608 -InterruptEvent 60c -NGENProcess 5d8 -Pipe 5f4 -Comment "NGen Worker Process"2⤵PID:1296
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 60c -InterruptEvent 610 -NGENProcess 5e8 -Pipe 5f8 -Comment "NGen Worker Process"2⤵PID:2056
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 610 -InterruptEvent 614 -NGENProcess 5e0 -Pipe 5fc -Comment "NGen Worker Process"2⤵PID:1520
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 614 -InterruptEvent 618 -NGENProcess 5d8 -Pipe 600 -Comment "NGen Worker Process"2⤵PID:2588
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 618 -InterruptEvent 61c -NGENProcess 5e8 -Pipe 604 -Comment "NGen Worker Process"2⤵PID:2476
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 61c -InterruptEvent 620 -NGENProcess 5e0 -Pipe 608 -Comment "NGen Worker Process"2⤵PID:484
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 620 -InterruptEvent 624 -NGENProcess 5d8 -Pipe 60c -Comment "NGen Worker Process"2⤵PID:1380
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 628 -NGENProcess 5e8 -Pipe 610 -Comment "NGen Worker Process"2⤵PID:2388
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 628 -InterruptEvent 62c -NGENProcess 5e0 -Pipe 614 -Comment "NGen Worker Process"2⤵PID:3052
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 624 -NGENProcess 634 -Pipe 628 -Comment "NGen Worker Process"2⤵PID:2160
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 618 -NGENProcess 5e0 -Pipe 61c -Comment "NGen Worker Process"2⤵PID:2012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 638 -InterruptEvent 630 -NGENProcess 63c -Pipe 624 -Comment "NGen Worker Process"2⤵PID:1924
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 5a0 -NGENProcess 5e0 -Pipe 620 -Comment "NGen Worker Process"2⤵PID:916
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 640 -NGENProcess 618 -Pipe 5e8 -Comment "NGen Worker Process"2⤵PID:2676
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 644 -NGENProcess 63c -Pipe 5d8 -Comment "NGen Worker Process"2⤵PID:2500
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 644 -InterruptEvent 630 -NGENProcess 5e0 -Pipe 64c -Comment "NGen Worker Process"2⤵PID:2988
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 62c -NGENProcess 648 -Pipe 638 -Comment "NGen Worker Process"2⤵PID:2444
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 62c -InterruptEvent 650 -NGENProcess 63c -Pipe 634 -Comment "NGen Worker Process"2⤵PID:1624
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 650 -InterruptEvent 654 -NGENProcess 5e0 -Pipe 5a0 -Comment "NGen Worker Process"2⤵PID:1952
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 654 -InterruptEvent 658 -NGENProcess 648 -Pipe 640 -Comment "NGen Worker Process"2⤵
- Modifies data under HKEY_USERS
PID:2152 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 658 -InterruptEvent 65c -NGENProcess 63c -Pipe 644 -Comment "NGen Worker Process"2⤵PID:2896
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 660 -NGENProcess 5e0 -Pipe 630 -Comment "NGen Worker Process"2⤵PID:2172
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 660 -InterruptEvent 664 -NGENProcess 648 -Pipe 62c -Comment "NGen Worker Process"2⤵PID:688
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 668 -InterruptEvent 664 -NGENProcess 660 -Pipe 63c -Comment "NGen Worker Process"2⤵PID:1196
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 664 -InterruptEvent 650 -NGENProcess 648 -Pipe 654 -Comment "NGen Worker Process"2⤵PID:1080
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 650 -InterruptEvent 670 -NGENProcess 65c -Pipe 618 -Comment "NGen Worker Process"2⤵PID:408
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 670 -InterruptEvent 674 -NGENProcess 660 -Pipe 66c -Comment "NGen Worker Process"2⤵PID:2576
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 674 -InterruptEvent 678 -NGENProcess 648 -Pipe 658 -Comment "NGen Worker Process"2⤵PID:1472
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 67c -NGENProcess 65c -Pipe 668 -Comment "NGen Worker Process"2⤵PID:1608
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 674 -NGENProcess 684 -Pipe 678 -Comment "NGen Worker Process"2⤵PID:1176
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 674 -InterruptEvent 664 -NGENProcess 65c -Pipe 650 -Comment "NGen Worker Process"2⤵PID:1568
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 664 -InterruptEvent 688 -NGENProcess 67c -Pipe 5e0 -Comment "NGen Worker Process"2⤵PID:2444
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 688 -InterruptEvent 68c -NGENProcess 684 -Pipe 670 -Comment "NGen Worker Process"2⤵PID:1844
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 68c -InterruptEvent 690 -NGENProcess 65c -Pipe 660 -Comment "NGen Worker Process"2⤵PID:1624
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 690 -InterruptEvent 694 -NGENProcess 67c -Pipe 680 -Comment "NGen Worker Process"2⤵PID:632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 698 -NGENProcess 684 -Pipe 674 -Comment "NGen Worker Process"2⤵PID:1596
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 69c -NGENProcess 65c -Pipe 664 -Comment "NGen Worker Process"2⤵PID:2352
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 6a0 -NGENProcess 67c -Pipe 688 -Comment "NGen Worker Process"2⤵PID:2388
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 6a4 -NGENProcess 684 -Pipe 68c -Comment "NGen Worker Process"2⤵PID:2228
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 6a0 -NGENProcess 690 -Pipe 684 -Comment "NGen Worker Process"2⤵PID:2232
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 690 -NGENProcess 6a4 -Pipe 648 -Comment "NGen Worker Process"2⤵PID:2012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 690 -InterruptEvent 6c0 -NGENProcess 694 -Pipe 6b4 -Comment "NGen Worker Process"2⤵PID:1396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 694 -NGENProcess 6a0 -Pipe 6bc -Comment "NGen Worker Process"2⤵PID:1296
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 6c8 -NGENProcess 6a4 -Pipe 67c -Comment "NGen Worker Process"2⤵PID:1348
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 6cc -NGENProcess 6c4 -Pipe 6b8 -Comment "NGen Worker Process"2⤵PID:2444
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6cc -InterruptEvent 6d0 -NGENProcess 6a0 -Pipe 690 -Comment "NGen Worker Process"2⤵PID:2440
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6d0 -InterruptEvent 6d4 -NGENProcess 6a4 -Pipe 6ac -Comment "NGen Worker Process"2⤵PID:2064
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6d4 -InterruptEvent 6dc -NGENProcess 6c4 -Pipe 6d8 -Comment "NGen Worker Process"2⤵PID:1232
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6dc -InterruptEvent 6c0 -NGENProcess 6b0 -Pipe 6a0 -Comment "NGen Worker Process"2⤵PID:2012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 6e0 -NGENProcess 6c8 -Pipe 694 -Comment "NGen Worker Process"2⤵PID:1684
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6e0 -InterruptEvent 6e4 -NGENProcess 6c4 -Pipe 6cc -Comment "NGen Worker Process"2⤵PID:1196
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 6e8 -NGENProcess 6b0 -Pipe 6d0 -Comment "NGen Worker Process"2⤵PID:2636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6e8 -InterruptEvent 6ec -NGENProcess 6c8 -Pipe 6d4 -Comment "NGen Worker Process"2⤵PID:2412
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6ec -InterruptEvent 6f0 -NGENProcess 6e4 -Pipe 6e0 -Comment "NGen Worker Process"2⤵PID:2464
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6f0 -InterruptEvent 6dc -NGENProcess 6c8 -Pipe 6c0 -Comment "NGen Worker Process"2⤵PID:2184
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6dc -InterruptEvent 6fc -NGENProcess 6e8 -Pipe 6f8 -Comment "NGen Worker Process"2⤵PID:1840
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6fc -InterruptEvent 6a4 -NGENProcess 6b0 -Pipe 6e4 -Comment "NGen Worker Process"2⤵PID:2300
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a4 -InterruptEvent 700 -NGENProcess 6c4 -Pipe 6f4 -Comment "NGen Worker Process"2⤵PID:2072
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 700 -InterruptEvent 704 -NGENProcess 6e8 -Pipe 6ec -Comment "NGen Worker Process"2⤵PID:2092
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 708 -InterruptEvent 6a4 -NGENProcess 70c -Pipe 700 -Comment "NGen Worker Process"2⤵PID:2396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a4 -InterruptEvent 6f0 -NGENProcess 6e8 -Pipe 6dc -Comment "NGen Worker Process"2⤵PID:792
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6f0 -InterruptEvent 710 -NGENProcess 704 -Pipe 6c8 -Comment "NGen Worker Process"2⤵PID:540
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 710 -InterruptEvent 714 -NGENProcess 70c -Pipe 6fc -Comment "NGen Worker Process"2⤵PID:1624
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 714 -InterruptEvent 718 -NGENProcess 6e8 -Pipe 6b0 -Comment "NGen Worker Process"2⤵PID:1860
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 718 -InterruptEvent 71c -NGENProcess 704 -Pipe 708 -Comment "NGen Worker Process"2⤵PID:2216
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 71c -InterruptEvent 720 -NGENProcess 70c -Pipe 6a4 -Comment "NGen Worker Process"2⤵PID:1676
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 724 -NGENProcess 6e8 -Pipe 6f0 -Comment "NGen Worker Process"2⤵PID:2072
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 728 -NGENProcess 704 -Pipe 710 -Comment "NGen Worker Process"2⤵PID:3032
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 728 -InterruptEvent 72c -NGENProcess 70c -Pipe 714 -Comment "NGen Worker Process"2⤵PID:304
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 72c -InterruptEvent 730 -NGENProcess 6e8 -Pipe 718 -Comment "NGen Worker Process"2⤵PID:1200
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 730 -InterruptEvent 734 -NGENProcess 704 -Pipe 71c -Comment "NGen Worker Process"2⤵PID:2856
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 734 -InterruptEvent 73c -NGENProcess 70c -Pipe 738 -Comment "NGen Worker Process"2⤵PID:876
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 73c -InterruptEvent 720 -NGENProcess 6c4 -Pipe 6e8 -Comment "NGen Worker Process"2⤵PID:3052
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 6c4 -NGENProcess 730 -Pipe 744 -Comment "NGen Worker Process"2⤵PID:2148
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 724 -NGENProcess 740 -Pipe 72c -Comment "NGen Worker Process"2⤵PID:1676
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 748 -NGENProcess 73c -Pipe 704 -Comment "NGen Worker Process"2⤵PID:2388
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 748 -InterruptEvent 74c -NGENProcess 730 -Pipe 728 -Comment "NGen Worker Process"2⤵PID:2056
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 74c -InterruptEvent 750 -NGENProcess 740 -Pipe 734 -Comment "NGen Worker Process"2⤵PID:304
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 750 -InterruptEvent 754 -NGENProcess 73c -Pipe 720 -Comment "NGen Worker Process"2⤵PID:2364
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 754 -InterruptEvent 758 -NGENProcess 730 -Pipe 6c4 -Comment "NGen Worker Process"2⤵PID:2068
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 75c -NGENProcess 740 -Pipe 724 -Comment "NGen Worker Process"2⤵PID:344
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 75c -InterruptEvent 760 -NGENProcess 73c -Pipe 748 -Comment "NGen Worker Process"2⤵PID:820
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 764 -NGENProcess 730 -Pipe 74c -Comment "NGen Worker Process"2⤵PID:984
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 764 -InterruptEvent 768 -NGENProcess 740 -Pipe 750 -Comment "NGen Worker Process"2⤵PID:952
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 768 -InterruptEvent 76c -NGENProcess 73c -Pipe 754 -Comment "NGen Worker Process"2⤵PID:2016
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 76c -InterruptEvent 770 -NGENProcess 730 -Pipe 758 -Comment "NGen Worker Process"2⤵PID:2152
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 774 -NGENProcess 740 -Pipe 75c -Comment "NGen Worker Process"2⤵PID:2064
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 774 -InterruptEvent 77c -NGENProcess 73c -Pipe 778 -Comment "NGen Worker Process"2⤵PID:680
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 77c -InterruptEvent 760 -NGENProcess 70c -Pipe 730 -Comment "NGen Worker Process"2⤵PID:2068
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 780 -NGENProcess 768 -Pipe 764 -Comment "NGen Worker Process"2⤵PID:896
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 780 -InterruptEvent 784 -NGENProcess 73c -Pipe 76c -Comment "NGen Worker Process"2⤵PID:1628
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 73c -InterruptEvent 70c -NGENProcess 780 -Pipe 784 -Comment "NGen Worker Process"2⤵PID:2072
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 70c -InterruptEvent 790 -NGENProcess 77c -Pipe 78c -Comment "NGen Worker Process"2⤵PID:2408
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 790 -InterruptEvent 798 -NGENProcess 768 -Pipe 794 -Comment "NGen Worker Process"2⤵PID:584
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 798 -InterruptEvent 740 -NGENProcess 774 -Pipe 780 -Comment "NGen Worker Process"2⤵PID:2352
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 79c -InterruptEvent 790 -NGENProcess 7a0 -Pipe 798 -Comment "NGen Worker Process"2⤵PID:688
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 790 -InterruptEvent 788 -NGENProcess 774 -Pipe 73c -Comment "NGen Worker Process"2⤵PID:2040
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 788 -InterruptEvent 7a4 -NGENProcess 740 -Pipe 77c -Comment "NGen Worker Process"2⤵PID:2776
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a4 -InterruptEvent 7a8 -NGENProcess 7a0 -Pipe 70c -Comment "NGen Worker Process"2⤵PID:2108
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a8 -InterruptEvent 7ac -NGENProcess 774 -Pipe 770 -Comment "NGen Worker Process"2⤵PID:1596
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7ac -InterruptEvent 7b0 -NGENProcess 740 -Pipe 79c -Comment "NGen Worker Process"2⤵PID:1552
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7b0 -InterruptEvent 7b4 -NGENProcess 7a0 -Pipe 790 -Comment "NGen Worker Process"2⤵PID:2208
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7b4 -InterruptEvent 7a8 -NGENProcess 774 -Pipe 7bc -Comment "NGen Worker Process"2⤵PID:2488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7a8 -InterruptEvent 788 -NGENProcess 7b8 -Pipe 7a4 -Comment "NGen Worker Process"2⤵PID:2012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 788 -InterruptEvent 7c0 -NGENProcess 7a0 -Pipe 768 -Comment "NGen Worker Process"2⤵PID:344
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c0 -InterruptEvent 7c4 -NGENProcess 774 -Pipe 7ac -Comment "NGen Worker Process"2⤵PID:2936
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c4 -InterruptEvent 7c8 -NGENProcess 7b8 -Pipe 7b0 -Comment "NGen Worker Process"2⤵PID:2236
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7c8 -InterruptEvent 7cc -NGENProcess 7a0 -Pipe 7b4 -Comment "NGen Worker Process"2⤵PID:3032
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7cc -InterruptEvent 7d0 -NGENProcess 774 -Pipe 7a8 -Comment "NGen Worker Process"2⤵PID:892
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d0 -InterruptEvent 7d4 -NGENProcess 7b8 -Pipe 788 -Comment "NGen Worker Process"2⤵PID:908
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d4 -InterruptEvent 7d8 -NGENProcess 7a0 -Pipe 7c0 -Comment "NGen Worker Process"2⤵PID:1232
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 7dc -NGENProcess 774 -Pipe 7c4 -Comment "NGen Worker Process"2⤵PID:664
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7dc -InterruptEvent 7e0 -NGENProcess 7b8 -Pipe 7c8 -Comment "NGen Worker Process"2⤵PID:824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e0 -InterruptEvent 7e4 -NGENProcess 7a0 -Pipe 7cc -Comment "NGen Worker Process"2⤵PID:2476
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e4 -InterruptEvent 7e8 -NGENProcess 774 -Pipe 7d0 -Comment "NGen Worker Process"2⤵PID:1856
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e8 -InterruptEvent 7ec -NGENProcess 7b8 -Pipe 7d4 -Comment "NGen Worker Process"2⤵PID:2556
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 7f0 -NGENProcess 7a0 -Pipe 7d8 -Comment "NGen Worker Process"2⤵PID:3032
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7f0 -InterruptEvent 7f4 -NGENProcess 774 -Pipe 7dc -Comment "NGen Worker Process"2⤵PID:892
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7f4 -InterruptEvent 774 -NGENProcess 7e8 -Pipe 7fc -Comment "NGen Worker Process"2⤵PID:1968
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 774 -InterruptEvent 7e0 -NGENProcess 7f8 -Pipe 7e4 -Comment "NGen Worker Process"2⤵PID:304
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 7e0 -InterruptEvent 804 -NGENProcess 7f0 -Pipe 740 -Comment "NGen Worker Process"2⤵PID:320
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 804 -InterruptEvent 808 -NGENProcess 7e8 -Pipe 7b8 -Comment "NGen Worker Process"2⤵PID:1640
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 808 -InterruptEvent 80c -NGENProcess 7f8 -Pipe 7ec -Comment "NGen Worker Process"2⤵PID:792
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 80c -InterruptEvent 810 -NGENProcess 7f0 -Pipe 7f4 -Comment "NGen Worker Process"2⤵PID:1740
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 810 -InterruptEvent 814 -NGENProcess 7e8 -Pipe 774 -Comment "NGen Worker Process"2⤵PID:300
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 814 -InterruptEvent 818 -NGENProcess 7f8 -Pipe 7e0 -Comment "NGen Worker Process"2⤵PID:2352
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 818 -InterruptEvent 81c -NGENProcess 7f0 -Pipe 804 -Comment "NGen Worker Process"2⤵PID:1396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 820 -NGENProcess 7e8 -Pipe 808 -Comment "NGen Worker Process"2⤵PID:1980
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 820 -InterruptEvent 824 -NGENProcess 7f8 -Pipe 80c -Comment "NGen Worker Process"2⤵PID:304
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 824 -InterruptEvent 828 -NGENProcess 7f0 -Pipe 810 -Comment "NGen Worker Process"2⤵PID:1844
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 828 -InterruptEvent 81c -NGENProcess 7e8 -Pipe 830 -Comment "NGen Worker Process"2⤵PID:1856
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 81c -InterruptEvent 814 -NGENProcess 82c -Pipe 818 -Comment "NGen Worker Process"2⤵PID:2200
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 814 -InterruptEvent 834 -NGENProcess 7f0 -Pipe 7a0 -Comment "NGen Worker Process"2⤵PID:1004
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 834 -InterruptEvent 838 -NGENProcess 7e8 -Pipe 820 -Comment "NGen Worker Process"2⤵PID:2056
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 838 -InterruptEvent 83c -NGENProcess 82c -Pipe 824 -Comment "NGen Worker Process"2⤵PID:2488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 83c -InterruptEvent 840 -NGENProcess 7f0 -Pipe 828 -Comment "NGen Worker Process"2⤵PID:1028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 840 -InterruptEvent 844 -NGENProcess 7e8 -Pipe 81c -Comment "NGen Worker Process"2⤵PID:1568
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 844 -InterruptEvent 848 -NGENProcess 82c -Pipe 814 -Comment "NGen Worker Process"2⤵PID:2092
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 848 -InterruptEvent 84c -NGENProcess 7f0 -Pipe 834 -Comment "NGen Worker Process"2⤵PID:920
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 84c -InterruptEvent 850 -NGENProcess 7e8 -Pipe 838 -Comment "NGen Worker Process"2⤵PID:1740
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 850 -InterruptEvent 854 -NGENProcess 82c -Pipe 83c -Comment "NGen Worker Process"2⤵PID:2200
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 854 -InterruptEvent 858 -NGENProcess 7f0 -Pipe 840 -Comment "NGen Worker Process"2⤵PID:3052
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 858 -InterruptEvent 85c -NGENProcess 7e8 -Pipe 844 -Comment "NGen Worker Process"2⤵PID:2012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 85c -InterruptEvent 860 -NGENProcess 82c -Pipe 848 -Comment "NGen Worker Process"2⤵PID:2876
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 860 -InterruptEvent 864 -NGENProcess 7f0 -Pipe 84c -Comment "NGen Worker Process"2⤵PID:2860
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 850 -InterruptEvent 868 -NGENProcess 7e8 -Pipe 85c -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1624 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 860 -InterruptEvent 7f0 -NGENProcess 854 -Pipe 86c -Comment "NGen Worker Process"2⤵PID:1956
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 868 -InterruptEvent 858 -NGENProcess 7f8 -Pipe 870 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1196
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1496 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:536 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 234 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"2⤵
- Executes dropped EXE
PID:344 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 1fc -NGENProcess 218 -Pipe 214 -Comment "NGen Worker Process"2⤵PID:1684
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1fc -InterruptEvent 248 -NGENProcess 1ac -Pipe 244 -Comment "NGen Worker Process"2⤵PID:1696
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 24c -NGENProcess 228 -Pipe 230 -Comment "NGen Worker Process"2⤵PID:1292
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 250 -NGENProcess 218 -Pipe 1bc -Comment "NGen Worker Process"2⤵PID:1880
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 254 -NGENProcess 1ac -Pipe 208 -Comment "NGen Worker Process"2⤵PID:984
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 218 -NGENProcess 1ac -Pipe 248 -Comment "NGen Worker Process"2⤵PID:1992
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 218 -InterruptEvent 260 -NGENProcess 258 -Pipe 25c -Comment "NGen Worker Process"2⤵PID:1652
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 254 -NGENProcess 24c -Pipe 260 -Comment "NGen Worker Process"2⤵PID:2936
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 26c -NGENProcess 1c0 -Pipe 268 -Comment "NGen Worker Process"2⤵PID:788
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 1c0 -NGENProcess 264 -Pipe 228 -Comment "NGen Worker Process"2⤵PID:2108
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 274 -NGENProcess 24c -Pipe 218 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:2160 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 24c -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"2⤵PID:1552
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 27c -NGENProcess 264 -Pipe 254 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1796 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 264 -NGENProcess 274 -Pipe 278 -Comment "NGen Worker Process"2⤵PID:2832
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 284 -NGENProcess 26c -Pipe 1c0 -Comment "NGen Worker Process"2⤵PID:2488
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 26c -NGENProcess 27c -Pipe 280 -Comment "NGen Worker Process"2⤵PID:1640
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 28c -NGENProcess 274 -Pipe 24c -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1676 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 274 -NGENProcess 284 -Pipe 288 -Comment "NGen Worker Process"2⤵PID:1860
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 294 -NGENProcess 27c -Pipe 264 -Comment "NGen Worker Process"2⤵PID:1624
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 27c -NGENProcess 28c -Pipe 290 -Comment "NGen Worker Process"2⤵PID:2992
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 29c -NGENProcess 284 -Pipe 26c -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:3032 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 284 -NGENProcess 294 -Pipe 298 -Comment "NGen Worker Process"2⤵PID:2476
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 274 -NGENProcess 28c -Pipe 2a4 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:2356 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 28c -NGENProcess 29c -Pipe 2a0 -Comment "NGen Worker Process"2⤵PID:2564
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 2ac -NGENProcess 294 -Pipe 27c -Comment "NGen Worker Process"2⤵PID:952
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 294 -NGENProcess 274 -Pipe 2a8 -Comment "NGen Worker Process"2⤵PID:984
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2b4 -NGENProcess 29c -Pipe 284 -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1476 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 294 -NGENProcess 2b0 -Pipe 1fc -Comment "NGen Worker Process"2⤵PID:2500
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 1e0 -NGENProcess 2b8 -Pipe 28c -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:344 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 2b8 -NGENProcess 2b4 -Pipe 29c -Comment "NGen Worker Process"2⤵PID:2440
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 1ac -NGENProcess 2b0 -Pipe 2ac -Comment "NGen Worker Process"2⤵
- Drops file in Windows directory
PID:1956 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1ac -InterruptEvent 2b0 -NGENProcess 1e0 -Pipe 2c0 -Comment "NGen Worker Process"2⤵PID:1704
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2cc -NGENProcess 2b4 -Pipe 294 -Comment "NGen Worker Process"2⤵PID:988
-
C:\Windows\ehome\ehRecvr.exeC:\Windows\ehome\ehRecvr.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1196
-
C:\Windows\ehome\ehsched.exeC:\Windows\ehome\ehsched.exe1⤵
- Executes dropped EXE
PID:1972
-
C:\Windows\eHome\EhTray.exe"C:\Windows\eHome\EhTray.exe" /nav:-21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1028
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
PID:1392
-
C:\Windows\system32\IEEtwCollector.exeC:\Windows\system32\IEEtwCollector.exe /V1⤵
- Executes dropped EXE
PID:860
-
C:\Windows\ehome\ehRec.exeC:\Windows\ehome\ehRec.exe -Embedding1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2124
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1300
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2128
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1148
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1524
-
C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:2520
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"1⤵
- Executes dropped EXE
PID:2560
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
PID:752
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1664
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:2024
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:2248
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2436
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:3056
-
C:\Program Files\Windows Media Player\wmpnetwk.exe"C:\Program Files\Windows Media Player\wmpnetwk.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1364 -
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 5962⤵PID:2340
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Executes dropped EXE
PID:1576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXEFilesize
1.3MB
MD53cf965e9fac8dff9fca9fed7acc6eed8
SHA1fd00721e51deed89ad18d6d2dc42fbfdeb9dcec1
SHA256b4676da30427063391e002ca7c06b1d231755a731d21d87918a31d3397b84bcc
SHA5120fac74ed191c4e3c7f3e89398d0842224e8c104d73a6a4c490831eec66a7ffdd9545807f9841d32b672e074ec0b99f7f9457cd89145bb1a67f4f9c5949b84dd5
-
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXEFilesize
30.1MB
MD5462c4ba7c5c38f90667bdf9ba5bbdf2c
SHA1ac5a4189781b916694194e33794dbc267838dc28
SHA2560d25f041fafcfc3ca63583bb8916bb2dd3bfee647f8aac62ab49a4c77a39d4b1
SHA5125e505a598931911ede7c5649088370b909754a4ae595217b37aa1ae683e5b32314d7cbedf7fc4c02210d3f8ff43383fde61f21d507fe1a186c90e6113ba21b01
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exeFilesize
1.4MB
MD59e8e79daa541fd0dbb35b927af90fae9
SHA15a20b8fb79dff45cf05b45b50138005a5f188c7a
SHA2561e006f1569e575858030c6c7fa9758b3040d9282ec1c1fc6cef300e65d4f1c1f
SHA51281c50cbb8f641a351dd84ea29c99b5c91fee639339d1d4459d5498e3b5616eb831f6574315b5277339195c4ad4b78d5feb640f914bfd92dad935b238673f4136
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXEFilesize
5.2MB
MD556bffb2bb98aff8c525214c615a84efb
SHA10ba2d04a6475b30c62b1d9f336dd425196916216
SHA2569e445dc4b9fee5354013d9d1004477f0128f985e9ee3ac5e4bac855a4cc3adfa
SHA5129fcf1dbed16734531bc7390f7593345b8b8993e8a8eaf6bb422a66d55e9b0f817d511e469fd9bf9be4245d97c3ad5ad36fd65bab3f1859fe2a929eac42730310
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exeFilesize
2.1MB
MD5d768cfae26f1761eba54ead5ae69a05c
SHA1e1b73d449f700471a539d704335c2095712426c0
SHA256c2c0a1df4e2b12497956b5b95a47d30710f13c17fd8d75f00bbf0d66cc5c7565
SHA512590e2c89bffdd78776ebea2aa325fc940b2874afe6149e613da8722cdaf07c194d2c5d8501ee78338e6b0a24ede116b161158f81489682c0a0cef52608c80b14
-
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.logFilesize
1024KB
MD57655a71129c86eaa0ed0888804c6c767
SHA1dc466e30a2185269f8f9cf6bbb503295874e02b7
SHA25687ab1f1c9b876082959b590e542e3559241c2142493ac88330e30547b22df759
SHA51252ba427b6748b42092a47b0458de46e9981455ad24abb63b36a6889e09e72f192aa4494030c998875fc0c4026326a3b68289f070b914c350e9e38e8a2cb47b3a
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-msFilesize
24B
MD5b9bd716de6739e51c620f2086f9c31e4
SHA19733d94607a3cba277e567af584510edd9febf62
SHA2567116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
SHA512cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exeFilesize
1.3MB
MD5bdd3d25173a1878b5a54c861216aed37
SHA1e37efec229ae5dd958bd2767216fcc62db9b5c76
SHA256c0977d1e1cc2672e0ccaf7e7dffc575612bf49d91d76566c079b529a2e2f42a3
SHA512befd10d956604f49c706e6d4856263692a6052eb32789b34d4c0c2d88ac902151bc4361d237f92abb3bca1ae3d3a04cae9902d8f7503658cbbefab8d8c7413e2
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.logFilesize
872KB
MD51c58fb2987aa00d552dd9193a511d430
SHA12bc500fc22c3b89e32411a1429e16c8b1774d3cb
SHA25651e5cfdf33c7ed82fc73657cb505c5bee68f39e64de5bf409b5008940864ccd3
SHA512f6692f7f7eec98098082f131e33a0825e6c5254159f77000294c8c1ec80b0879854f12c77c70968cf1d9b4ff3038a04f5ea78daac6cc35628f483e7b9c0f2312
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exeFilesize
1.2MB
MD5417090bf6e18ad026933834dfec1f569
SHA15fc4e54e189cd05865e4b6f9e23065485fcfa286
SHA256e392fc12b3c4ad88dc27fd373b37608b6b7913c1a7b3facb98327d8d102115c5
SHA5125b256126a7fea3669c6ed98b9cfedc4e3cef2e2b25ef49fd95b279c7c6e7cf942381c1b81f49e112665a4491730cd9d8bb562729ba6d9c35916913e5e435feab
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exeFilesize
1.3MB
MD56795cef0a69d66edc6524c36e9bf96d3
SHA1705937c9a0879b8be768f45933aa954b00d8efba
SHA25624a0a5f574b51059b3577fbe1033b911854c45b4cec2b02081dd5a3f422d1b52
SHA512373bd87413acfcbd282308b9977878f9ad90a1ce9b5652e627b7441e7f1a7019cae70a6f4bb5151ca093a0322e1418464ba28a69eee4f57c01b7ea9993baed1a
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.logFilesize
8KB
MD552c327926b9167ce7e051dedbe02f0a6
SHA105f53797dc42be1ed631b52bdb884ab0c9e96307
SHA256973d3b9367243f5483da6d179ae372ed9e95b7fefbbe5aa0dcfc21e39c46c5ba
SHA51219b666bd4484675492fcd8585d27ca8bb98ce88efc361a90c8871e0436c7d5a60aeab6bf320285818974671d062e4d33b54ab1b679acfbfa2acadff64ecfe9a2
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exeFilesize
1.2MB
MD53d40f800bcb7dca5f64b7069b795a1c3
SHA1925cd6e67fc521a50857b75d08e857128f71ff39
SHA2565fa4bbe746d1525b0650cbebee4b4c28ac1b59c3588e562f478fca131c177d05
SHA5120bb54201630c76c3ea379e3b7f9a304c63349fb72227391fd99d94b930842fce03adbc9ea676848165b5f82de6e4bda4c4a9a3ae50f65a4838983334e43c598b
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.logFilesize
1003KB
MD5c11bd62f6576f82a99063237700503a5
SHA1eea7e511ad60554cd0537444f444460149e12037
SHA2568b177ed469e95bf5b0a9fb49e269d4a746ac3b3512f20c296c2d8cef7c19ac58
SHA512843736de8aa13129a9fc30c61c48846d12c17be5fd6d2c0ba1a3364f2d5c720837ddf96dff73b7736e00887abf5be2d86ee912edab0e88759ee5ded0ac73d071
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exeFilesize
1.3MB
MD5525f1472969da3a8c45dc55257f63c91
SHA12b74b8b64eaf6d282d3ce9f7f8ea40642f09264b
SHA25690a4085e14e2bb91e2b72a95c586ee3de258d3bdb4a9bb9da8b891db49210bff
SHA51275f627cdbe43032019f7219642633e5a94fef6ec407f07596fa33632005cb05bef59e159a19b13847857160c24d14bfc2b836a3b46b5cc5ad8ff0c3b561adb2a
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.logFilesize
8KB
MD52ff85821c350bca3803593fd55d4d795
SHA1dd100e09a32aa92db5cc9564f62a5af20225e297
SHA256f570711c0a607060e2b2baa9bca8f28134b41b623bc01e0591d2d9f68925cf30
SHA512cc34ee1fc699b53dbc7e8fad176ca52b82ce31efafb05b1388a6b72c1a3f24afa784fb8e71eca2a5d0eb6552fbc6d7c3322616ae54b2c8f83b2689f8c39e6bce
-
C:\Windows\SysWOW64\perfhost.exeFilesize
1.2MB
MD538a0c9889bced40797456daf00df9719
SHA1b52b5062deefaaa5bea6bb5825aa05ca8a706b61
SHA256b4755b6f518034bf65f893b2c25636fae1b6d6489f5c0f0011ea60d1dac0ba86
SHA5125fc5cbe0786d33444993b6ed97b9d1aca8ed6246fa4f43dd50f00fb0afbd6fd204c53fdb1a7d7a89be132be04546c8365bf051f955f64756f59d0500cfe5efd9
-
C:\Windows\System32\SearchIndexer.exeFilesize
1.1MB
MD5eb931167980a8699a861133d3f1b4f30
SHA12e789fff8ccbca2d4423c6bb2bc6f9349f0a9baf
SHA2561fb7d70c47f3067d2d9381f4928531d156f96b848139d82b40196b54be49b26f
SHA5128d8c250ed44d1b0dbaab034562b1d070f0c6a1273d3ba2abc07c414ca037cd991e68f6b64bc710505f4dcecca54fa74ff406ebcc4d47de1b918a08ee7117de2e
-
C:\Windows\System32\VSSVC.exeFilesize
2.1MB
MD5d4d29f2c58c47f23508a51995166c12a
SHA1c50c5df3ffa2a042e7820a224fa47021880868d3
SHA256f62971d40ec7442be47c13c21804a393f74ebe3612ae78b803934f02d3fb81e1
SHA5128a24f4c16cb2c9d6469e7eb9ff56dee6b2d3df9343131c8183b8be429b867c3325e3ab2821ed372ab80b57eb484cf8318be172a9a0253e7e1a5b2eb705ccb011
-
C:\Windows\System32\ieetwcollector.exeFilesize
1.3MB
MD5539bd4f143c0eb5114ae59da369b22f9
SHA1bb43ae151c6d5b81c17153c0730134f316c0c767
SHA256e65dd9c8030d3543b7d6d1d5ce3c2d5645b2ddf2cbedecbc24feff9d7c9eb0e7
SHA51299f13b92ae6796c8b70f518f9131528ddf5ee0e18614d4332238a673fdff658767bcec41dfba4e5d020371b7dab171a945990c580a2b8ffe2b56ea5cfeee8d51
-
C:\Windows\System32\vds.exeFilesize
1.7MB
MD5d6797e403c0081059b17d6b1b091d1c6
SHA196b4fd0a64dad339fc94de4bb913615755214dd2
SHA256dce7c03190fc13e6697bbf40f178d79c046c5595d671e06d1b966e132ab4fa0a
SHA5125cd4f031dc2b438f2fcae08ecca09af68f25d560a0f20bbb2d4e0543f16369c955551fecfc7b0482830f6b844da7643970b29975efb66e4f28824ac07f955828
-
C:\Windows\System32\wbengine.exeFilesize
2.0MB
MD5c515dad5ff53401156fe92b74c713721
SHA1f2498197c3c0c93b0003b8978d9ea9d9a11104bc
SHA256e9544ce3c514a51021b26fec07b0661f5229315ca1603e8020ca6f1264036924
SHA512e73fc61dc71a92f41e1d753fe63fc13ca979cc638616d0c9d9dc14dd9bcd6344cef0dd08bc6f59ff282c11b8bec551f95d106be0f193ab86819df4044256f6ef
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dllFilesize
834KB
MD5c76656b09bb7df6bd2ac1a6177a0027c
SHA10c296994a249e8649b19be84dce27c9ddafef3e0
SHA256a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
SHA5128390879b8812fc98c17702a52259d510a7fe8bc3cf4972e89f705e93bc8fa98300c34d49f3aec869da8d9f786d33004742e4538019c0f852c61db89c302d5fdf
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dllFilesize
797KB
MD5aeb0b6e6c5d32d1ada231285ff2ae881
SHA11f04a1c059503896336406aed1dc93340e90b742
SHA2564c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
SHA512e55fd4c4d2966b3f0b6e88292fbd6c20ffa34766e076e763442c15212d19b6dea5d9dc9e7c359d999674a5b2c8a3849c2bbaaf83e7aa8c12715028b06b5a48e1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dllFilesize
163KB
MD5e88828b5a35063aa16c68ffb8322215d
SHA18225660ba3a9f528cf6ac32038ae3e0ec98d2331
SHA25699facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
SHA512e4d2f5a5aeaa29d4d3392588f15db0d514ca4c86c629f0986ee8dba61e34af5ca9e06b94479efd8dd154026ae0da276888a0214e167129db18316a17d9718a57
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dllFilesize
1.3MB
MD5006498313e139299a5383f0892c954b9
SHA17b3aa10930da9f29272154e2674b86876957ce3a
SHA256489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
SHA5126a15a10ae66ce0e5b18e060bb53c3108d09f6b07ee2c4a834856f0a35bec2453b32f891620e787731985719831302160678eb52acada102fdb0b87a14288d925
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dllFilesize
148KB
MD5ac901cf97363425059a50d1398e3454b
SHA12f8bd4ac2237a7b7606cb77a3d3c58051793c5c7
SHA256f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
SHA5126a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dllFilesize
34KB
MD5c26b034a8d6ab845b41ed6e8a8d6001d
SHA13a55774cf22d3244d30f9eb5e26c0a6792a3e493
SHA256620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
SHA512483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dllFilesize
109KB
MD50fd0f978e977a4122b64ae8f8541de54
SHA1153d3390416fdeba1b150816cbbf968e355dc64f
SHA256211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
SHA512ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\181356b1bbb85fe2401c4dfad1a45133\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dllFilesize
158KB
MD5a763a9348ab4ee3bd593bb17d854e51b
SHA14d0c97ba6877e2f9ab32fe1316936a4f2e0ff2c9
SHA256b2f9dce9baca3e56fb3587ffe30ca38eb0f89ed30985b328a853778480c0f87b
SHA512e8d3896d4bd788d3ed923e0c9d3ba19fe9fc507060e2e5e8e410964f4c9d7331928324a79336079ccc84c050d8f0acfb03126a2e3622daac3846b0bfd028f602
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dllFilesize
41KB
MD53c269caf88ccaf71660d8dc6c56f4873
SHA1f9481bf17e10fe1914644e1b590b82a0ecc2c5c4
SHA256de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
SHA512bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\43ac81bed18b52d77a8011ada80939b5\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dllFilesize
296KB
MD57687295a6e19cc656b077e6a61629d4e
SHA1fa1025de5cffb56a3d1f8cae9d09b7171b33326e
SHA256ad8d210d001d3298ad4e1cbf08449b2cbd2b358d28cfad99db78639627a7cb86
SHA51219de95fd90bc6f091e785074ee71dc15d450d65fbdea933e26650fb9c747d81ae2fca7f5f83192f17451a49a314d264cabea2202c805b6ffab729d381675734c
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dllFilesize
356KB
MD587111e9d98dc79165dfc98a1fb93100b
SHA14f5182e5ce810f6ba3bdb3418ad33c916b6013c8
SHA256971188681028501d5ac8143b9127feb95d6982417590af42cf1a43483e38bd42
SHA512abbb246d620e8a2ab1973dde19ff56ea1c02afa39e889925fe2a1ba43af1ad4ff6eb017e68578ae520109b3e290b3d9054d7537eb2df0ede6e0fbca8519cc104
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5c8b40c69a2293c8f499b38b25c41117\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dllFilesize
157KB
MD57bdf8e0c9aa04b71a52dd964005f4363
SHA1a87e809146d3c70093a189c37f0a96b8bd0ce525
SHA2560406be7235661a62f68bff4c7640b4e241a0c392d548bf242ed08ba0eeaee66b
SHA5124983ebf42241723cf258407c7d2a0773f395c861741f4e98bd7ac86e1ef0a597f89263bb5a986b69ffd43836a5e49d8f03342736b4c3183ea0c58b8099af2051
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f2320d38621eb541713e6cd421c2b8a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dllFilesize
648KB
MD57ebbba07bc6d54efd912bcd78b560b7b
SHA1a6aee1a80ddcdf201301ac29293c62d58bcc941d
SHA256637dc357ff9011902186f2fd128ca74ac84fdb6d984f15036803b6a8fe28868a
SHA5122139a0d520ed70b72dc76fdd0555185386c9c22de1e1fb7eaac0607b313500c44f856c76ac6e2cd72148ea0b86b10bdd2b0ab7daacfc945cb66a637b8d99cfe8
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dllFilesize
1.2MB
MD50637ad2bf6fc5ac1d29e547155bc818c
SHA1a502879466b6dd37eae5881bbb18353f97623852
SHA256868c297cb00b2d298f594ad7e3fd4e38aeaac78042613626d6f919b2bca25c4f
SHA5121d18a16ec3b91c3143c4371de305a7ea464d41661752ece65bf1ce19a8342a265c024a740afa6be8baf4d1edfdac6c6fcdad7395c1294342cd1f4388428e52c1
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dllFilesize
210KB
MD54f40997b51420653706cb0958086cd2d
SHA10069b956d17ce7d782a0e054995317f2f621b502
SHA2568cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
SHA512e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8e2c19c68ed37124b864703955c39dbe\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dllFilesize
83KB
MD5643b263882c4a1af4b3272359b90fc70
SHA1a54eb3aaeff67ac1cd92ebaabbbb09b8cae27bb2
SHA256dfa25d7978449ee66d303508878db8f69a770d51bf493e37a4a7942867b7af78
SHA5129f782b72baf0cb92692d21d97025aae6c4d46d9dfb945e5a972526b349193f86e2e225d5083a1aca5060bdfc87db305c3628175123299aa6b4c4d93fd1d99b21
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9248a710d7fe2485a557ce5d3cbcf2df\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dllFilesize
607KB
MD5e9ca062e4958cc25400c804029a5bf62
SHA11ed4374d0d0f568936fdebe17d9110481d6b3344
SHA256a09436c1df8fcd8ecd1732d6e4e68f32b092e71e0c5d3308b0f3f20abd03d4e0
SHA51243a9ea20d1e636201c0ce7098c198b893465b45f747ed2a002e8dd0bfc7739c28e166d259faf3a0087ae1fe59c74cc8e598f2b283cc7ebc345b6f3b5c388e520
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dllFilesize
53KB
MD5e3a7a2b65afd8ab8b154fdc7897595c3
SHA1b21eefd6e23231470b5cf0bd0d7363879a2ed228
SHA256e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
SHA5126537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dllFilesize
65KB
MD5da9f9a01a99bd98104b19a95eeef256c
SHA1272071d5bbc0c234bc2f63dfcd5a90f83079bbab
SHA256b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d
SHA512dcb3273e33b7df02461e81a4f65ae99c0a9ae98188a612ce6d605a058bd2dcb6ddb5b7c78abe1f0a955b7f0c07c323dbfd77a2b6a629a9c87e4ecc1c57e4d81d
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dllFilesize
28KB
MD5aefc3f3c8e7499bad4d05284e8abd16c
SHA17ab718bde7fdb2d878d8725dc843cfeba44a71f7
SHA2564436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
SHA5121d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b8e029b1434d965380b363483e376df0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dllFilesize
329KB
MD5eb09a7062a66a50fe2cb16c4a80561a7
SHA133b4c71ced7644be9802374a4f04c866394daaca
SHA256e94a4ad1ef9de2886a231e857c8691328c2e6e344cc9e82440e5c45b8a788256
SHA512c57a4c626c87032ca422df04ce7c3322662a9b0c6c06a46e93f08ca8f431295c9ae802cd79f53cae5de2b39a30bbeb756c966880e874ed44115cf511cc1ff920
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bb63c81d306795319eaf7af25f67342a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dllFilesize
141KB
MD558cacef7cbc000bb5ddeedc08a598f36
SHA1f8963d4ac1f7b72c2ee4a0a6d45b921f4f88bab7
SHA256124a0869df89ec2c9f0b307dd6b6d17e1e1e7ad638e0b4abf4483c15f842d270
SHA5129cf04e365abcdcfcb9c1f927da83a2dfe0791cccb80cd84ed63b03264d1e253060c455ed8664f35aee0a59e8c172f859ba49c67c9eec811a53e656c076c6bf66
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dllFilesize
278KB
MD5d74d434aa70ce827715b5e0ac7eda5be
SHA1b53f3374be4c96af51c78fd873de1360f17c200f
SHA25654701cbe719b08b2393b9f4a604c372f9a280b5d3dd520b563d2aea7d69a1496
SHA512631d09a0ff39ece829f5c23278c2c030e5ff758b285128edb7805682de75b5be1aedd914d2325f79ec98d0103660a39ae1f1a5782f5dad038b143f3774c098df
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dllFilesize
27KB
MD59c60454398ce4bce7a52cbda4a45d364
SHA1da1e5de264a6f6051b332f8f32fa876d297bf620
SHA256edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
SHA512533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dllFilesize
57KB
MD56eaaa1f987d6e1d81badf8665c55a341
SHA1e52db4ad92903ca03a5a54fdb66e2e6fad59efd5
SHA2564b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
SHA512dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e1b5c7b6470421f04663a0c011172165\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dllFilesize
180KB
MD57eef199efd5d2825b493622057c0b516
SHA1d60b05c8e0135dd8e6462986afb63ec7575fbe49
SHA256d56c7e712a07e88ae1d136fa81ad5c25f36361d5d59b0a236431cb0333bc1c4b
SHA5122488a72404e9543b129a7071c5f8bf504abca2735ab288407469deac7a1c4d4a7099f808d5f62219df9aa0c958cd4c525e6970d83de3a6940e95bae337037a02
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dllFilesize
130KB
MD52735d2ab103beb0f7c1fbd6971838274
SHA16063646bc072546798bf8bf347425834f2bfad71
SHA256f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
SHA512fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f030ae7a0ac8395493f8afcd319ee692\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dllFilesize
143KB
MD5f786ebe6116b55d4dc62a63dfede2ca6
SHA1ab82f3b24229cf9ad31484b3811cdb84d5e916e9
SHA2569805ae745d078fc9d64e256d4472c0edd369958a6872d71bd28d245a0239fe12
SHA51280832872329611c5c68784196f890859f6f7c5795f6a62542ad20be813e587341b36ade410363646c43f9ced48d2cf89a4537fe60d90e868324270f7040c2738
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dllFilesize
59KB
MD58c69bbdfbc8cc3fa3fa5edcd79901e94
SHA1b8028f0f557692221d5c0160ec6ce414b2bdf19b
SHA256a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
SHA512825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dllFilesize
42KB
MD571d4273e5b77cf01239a5d4f29e064fc
SHA1e8876dea4e4c4c099e27234742016be3c80d8b62
SHA256f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
SHA51241fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fdb270af0ab13f6f750dd36df7de00fa\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dllFilesize
187KB
MD59e1ff7f82a6543b10ab2161c820c7fa4
SHA18a6c00b7b0cd17dffc03d70f90bdbe3f33ac5ff5
SHA2560a51e3aa8c6ae5aaff878ac795017624129ca091b6248b1d026ea7288f61af7f
SHA5129b5629ba4b2160c57dbed7e211025a3d567bc1b77671454adae19f2fa49fe3de21e8729b54f04ae09b6e1c2873de593932f5163857c00ca278ed210c4c3bda04
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dllFilesize
855KB
MD57812b0a90d92b4812d4063b89a970c58
SHA13c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea
SHA256897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
SHA512634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed
-
C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dllFilesize
43KB
MD53e72bdd0663c5b2bcd530f74139c83e3
SHA166069bcac0207512b9e07320f4fa5934650677d2
SHA2566a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
SHA512b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dllFilesize
248KB
MD54bbf44ea6ee52d7af8e58ea9c0caa120
SHA1f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2
SHA256c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08
SHA512c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dllFilesize
58KB
MD53d6987fc36386537669f2450761cdd9d
SHA17a35de593dce75d1cb6a50c68c96f200a93eb0c9
SHA25634c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb
SHA5121d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dllFilesize
205KB
MD50a41e63195a60814fe770be368b4992f
SHA1d826fd4e4d1c9256abd6c59ce8adb6074958a3e7
SHA2564a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1
SHA5121c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dllFilesize
43KB
MD568c51bcdc03e97a119431061273f045a
SHA16ecba97b7be73bf465adf3aa1d6798fedcc1e435
SHA2564a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf
SHA512d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dllFilesize
198KB
MD59d9305a1998234e5a8f7047e1d8c0efe
SHA1ba7e589d4943cd4fc9f26c55e83c77559e7337a8
SHA256469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268
SHA51258b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dllFilesize
70KB
MD557b601497b76f8cd4f0486d8c8bf918e
SHA1da797c446d4ca5a328f6322219f14efe90a5be54
SHA2561380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d
SHA5121347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dllFilesize
87KB
MD5ed5c3f3402e320a8b4c6a33245a687d1
SHA14da11c966616583a817e98f7ee6fce6cde381dae
SHA256b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88
SHA512d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dllFilesize
82KB
MD52eeeff61d87428ae7a2e651822adfdc4
SHA166f3811045a785626e6e1ea7bab7e42262f4c4c1
SHA25637f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047
SHA512cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dllFilesize
58KB
MD5a8b651d9ae89d5e790ab8357edebbffe
SHA1500cff2ba14e4c86c25c045a51aec8aa6e62d796
SHA2561c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7
SHA512b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a8d264739b7180ae4e024d1be7184381\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dllFilesize
271KB
MD5a550fc9be4cbf8160e017fd38b8baf1a
SHA174f71b58483d9fd5a65df8bf0cb46769c45c3b2d
SHA256b56a86672ac307e3e3bd30de4ca9bc420ea3e84781371e8fecb491dda516d1e0
SHA51209f3205a6c2ebb1812a0936d03fe81546a0bfd9489b79b83d1fed3ffb471849bdd396f3381b18a8d629cf51e0276c0155eb555adeaf4127f8b1115ffb94a120d
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dllFilesize
85KB
MD55180107f98e16bdca63e67e7e3169d22
SHA1dd2e82756dcda2f5a82125c4d743b4349955068d
SHA256d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01
SHA51227d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\d5c529408847079669109e5303852339\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dllFilesize
221KB
MD555bd756031f2af6b417e830fe1df5dfd
SHA1b60c324ad7bedb3d22dac1111203905624b2720f
SHA2564f713427c8e2bfa619ae8f3c035b0c9a2cb2a44649c6f0ab0844933cce1a0346
SHA512d7214ae4c986fafb3f61edff1e3372d8a24a7277db1f44db52ff5e0e9efca505885d1f2a02c405ff2d28ce20cf11f550eb3015e33edde01f9f25c37c8e911c0b
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dllFilesize
298KB
MD55fd34a21f44ccbeda1bf502aa162a96a
SHA11f3b1286c01dea47be5e65cb72956a2355e1ae5e
SHA2565d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01
SHA51258c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125
-
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dllFilesize
43KB
MD5dd1dfa421035fdfb6fd96d301a8c3d96
SHA1d535030ad8d53d57f45bc14c7c7b69efd929efb3
SHA256f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c
SHA5128e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1
-
\Program Files\Windows Media Player\wmpnetwk.exeFilesize
2.0MB
MD5656f6323cae35b60fc1f94abe426d3da
SHA16007c7d7be65701cc9bdf411dfa3ab9864de2d93
SHA256837dc50247ff3cb22e7de3f97f44db0d793cfcdda4338ebbc447a6f1b8db8493
SHA512851a9fb193d481051d252a21b9df492f851715a173e1abb97e5bb0956f982e3684201e542912d41343c6a78e6c35eff50f257dc17eac73040422ad1a858e673c
-
\Windows\System32\Locator.exeFilesize
1.2MB
MD5a44c2876e89460857f0cc434c14bdad3
SHA12baba901a7d2bbe91a6b187f2064a835baced5f2
SHA256548756a12161ffebe4d51410d18a0af9b02eb46abfeed95939e110a25db9a434
SHA512a03b029a2ee7b9cf068cfd579217bb2bf314928eb667f968514af2c179048d9c9216dccba7f2dea22b1ca9f619fcf264138976bb7e379919feb3dd6e13e8d5fe
-
\Windows\System32\alg.exeFilesize
1.3MB
MD5e4bcf7626a5ff681803aa28b0e590c34
SHA1a1bc9d9177382c22201e3c3a47fafe7fff6d7a65
SHA256169cb02aec8a2e2286af38cb7e213dc9f04c1b4983cca24a3f389d18e3830211
SHA5124dfdf64034ad5e407b5d61a616a0b8f435dd24cb9cf5011bb04ba03d145d8ef332dfad0fc8d5418f231c6f2709eb7f100e6a873f3eff7d052b132faa6648da20
-
\Windows\System32\msdtc.exeFilesize
1.3MB
MD5ed1a24067a81b615fe5c87156fc305b1
SHA1b69161f70532f6c5f6b0c2b080d5cc8b05bc9abc
SHA256104d3e6d105301f989755b899d2c291383d0efcd97927173f5821f5724056b1a
SHA512b7b117f0b9f7be6cc705136b259e9e70377d6222a5d9cc73e7cf52dacf2e3354634823b373b13e4bdf9d57160726ac1f442e2cdc16889dfb2e295d952d5a66bc
-
\Windows\System32\msiexec.exeFilesize
1.3MB
MD5456b285b691cc2477e7424252ccc4eee
SHA1341691ebe17e61caa16d28492cc9b1aa18ac00b8
SHA256e992987b862884e65ee2bae435f4d0d154a7dfbd859e5351454218f9d18f22fc
SHA5121b3143771fe9b06515bd1898c797990d0fbf7d9a7075bdb30cb721b6f0d1b30851417a8de8db8cfd76d90aba3e0421283b79bc938082182116a90009a2178a5d
-
\Windows\System32\snmptrap.exeFilesize
1.2MB
MD5a4e75f2f9566d87dbc588f9f54105638
SHA17743af9b374b0ffb0b7937b0f6ee973d7ea8d94d
SHA2565e120a84fd6f214e837f2f81649c62f6611efd77c4de360f1de5e9b089c57a7e
SHA5124500c100ae525afc1463e8e5dcb536518f94d04ad6cfa24846055798be9bfbf6fedc582b6d46d052d07202123c14e1ff57424555c59901f3364c16fb3e00ff2c
-
\Windows\System32\wbem\WmiApSrv.exeFilesize
1.4MB
MD59624ea07177e4b24233e2058d6565408
SHA1f450decd730cc99ae60756dcd12490c37158794c
SHA256ed801e3a53e518b76f9a7e07de01bb071b5c22f18d9f8410bcb3efb96d76872d
SHA5126952d0151be4e67acbf20ddca98204dee008e9efddf58141ad8dde640854ecde723637053983dd6b0b81ce51c98e0898eafddbf0ad1542eb001a51c1ba94114f
-
\Windows\ehome\ehrecvr.exeFilesize
1.2MB
MD530d22d727364f44aa307850dde50d8dd
SHA18f82a8c30c0b480f669c031081153ac2124b98fb
SHA256214a3cc1195ee9bb0a6b05887479e09af8a7f9edfd6ae5f6f608304dc091e7a5
SHA512586a201495095b1b16065c992fb0138fb81153ed95ecbee89030fe45d7ccb407c12bc9c54d1ef6d82f516e6d1bcd93c646e9866c7bc61484a8894de20d214380
-
\Windows\ehome\ehsched.exeFilesize
1.3MB
MD541d241df876a17b9b831613075c0078e
SHA1f7e727d5b224ad86e775b8f2dde7be3129d9d20c
SHA2562e6b8b69b1aabcfe2d145660ce274496f73367e566f0f4f0d8c94e70fe1fa143
SHA51205c82fec261c05d07d8ce4428ab5573506efe212289d5b118d09077b00de0b05f8708ecf9be995cdbfaeb05ffb8ca30a3739e06c69ff9975413d37d1d3352c79
-
memory/348-23-0x0000000000400000-0x0000000001EFA000-memory.dmpFilesize
27.0MB
-
memory/348-0-0x00000000038E0000-0x0000000003947000-memory.dmpFilesize
412KB
-
memory/348-5-0x00000000038E0000-0x0000000003947000-memory.dmpFilesize
412KB
-
memory/348-11-0x0000000000400000-0x0000000001EFA000-memory.dmpFilesize
27.0MB
-
memory/408-3657-0x0000000003D50000-0x0000000003D78000-memory.dmpFilesize
160KB
-
memory/688-3627-0x0000000001AB0000-0x0000000001AB8000-memory.dmpFilesize
32KB
-
memory/752-844-0x0000000001000000-0x00000000011D5000-memory.dmpFilesize
1.8MB
-
memory/752-247-0x0000000001000000-0x00000000011D5000-memory.dmpFilesize
1.8MB
-
memory/860-878-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/860-264-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/860-155-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/984-4876-0x00000000019D0000-0x00000000019DC000-memory.dmpFilesize
48KB
-
memory/984-4877-0x0000000001B60000-0x0000000001BA8000-memory.dmpFilesize
288KB
-
memory/984-4878-0x0000000001BB0000-0x0000000001BC6000-memory.dmpFilesize
88KB
-
memory/984-4881-0x000000001AED0000-0x000000001AEDE000-memory.dmpFilesize
56KB
-
memory/984-4880-0x000000001AED0000-0x000000001AEDE000-memory.dmpFilesize
56KB
-
memory/984-4875-0x0000000000E30000-0x0000000000E3E000-memory.dmpFilesize
56KB
-
memory/1080-3647-0x0000000003D50000-0x0000000003D74000-memory.dmpFilesize
144KB
-
memory/1148-182-0x0000000140000000-0x00000001401F5000-memory.dmpFilesize
2.0MB
-
memory/1148-697-0x0000000140000000-0x00000001401F5000-memory.dmpFilesize
2.0MB
-
memory/1196-233-0x0000000140000000-0x000000014013C000-memory.dmpFilesize
1.2MB
-
memory/1196-112-0x0000000000A60000-0x0000000000AC0000-memory.dmpFilesize
384KB
-
memory/1196-114-0x0000000140000000-0x000000014013C000-memory.dmpFilesize
1.2MB
-
memory/1196-3637-0x0000000003D60000-0x0000000003DA0000-memory.dmpFilesize
256KB
-
memory/1196-106-0x0000000000A60000-0x0000000000AC0000-memory.dmpFilesize
384KB
-
memory/1196-918-0x0000000140000000-0x000000014013C000-memory.dmpFilesize
1.2MB
-
memory/1300-165-0x000000002E000000-0x000000002FE1E000-memory.dmpFilesize
30.1MB
-
memory/1300-273-0x000000002E000000-0x000000002FE1E000-memory.dmpFilesize
30.1MB
-
memory/1348-3864-0x0000000003D20000-0x0000000003E9A000-memory.dmpFilesize
1.5MB
-
memory/1392-143-0x0000000140000000-0x0000000140237000-memory.dmpFilesize
2.2MB
-
memory/1392-251-0x0000000140000000-0x0000000140237000-memory.dmpFilesize
2.2MB
-
memory/1396-3828-0x0000000003E60000-0x0000000003E7E000-memory.dmpFilesize
120KB
-
memory/1464-938-0x00000000023B0000-0x00000000023BA000-memory.dmpFilesize
40KB
-
memory/1464-947-0x00000000023B0000-0x00000000023D4000-memory.dmpFilesize
144KB
-
memory/1464-943-0x00000000023B0000-0x000000000254E000-memory.dmpFilesize
1.6MB
-
memory/1464-944-0x00000000023B0000-0x000000000249C000-memory.dmpFilesize
944KB
-
memory/1464-945-0x00000000023B0000-0x00000000023C0000-memory.dmpFilesize
64KB
-
memory/1464-946-0x00000000023B0000-0x0000000002438000-memory.dmpFilesize
544KB
-
memory/1464-948-0x00000000023B0000-0x00000000023B8000-memory.dmpFilesize
32KB
-
memory/1464-74-0x0000000000350000-0x00000000003B7000-memory.dmpFilesize
412KB
-
memory/1464-949-0x00000000023B0000-0x00000000023DA000-memory.dmpFilesize
168KB
-
memory/1464-68-0x0000000000400000-0x00000000005E7000-memory.dmpFilesize
1.9MB
-
memory/1464-69-0x0000000000350000-0x00000000003B7000-memory.dmpFilesize
412KB
-
memory/1464-939-0x00000000023B0000-0x00000000023CE000-memory.dmpFilesize
120KB
-
memory/1464-950-0x00000000023B0000-0x0000000002416000-memory.dmpFilesize
408KB
-
memory/1464-940-0x00000000023B0000-0x00000000023CA000-memory.dmpFilesize
104KB
-
memory/1464-942-0x00000000023B0000-0x0000000002454000-memory.dmpFilesize
656KB
-
memory/1464-210-0x0000000000400000-0x00000000005E7000-memory.dmpFilesize
1.9MB
-
memory/1464-941-0x00000000023B0000-0x000000000243C000-memory.dmpFilesize
560KB
-
memory/1496-93-0x0000000140000000-0x00000001401ED000-memory.dmpFilesize
1.9MB
-
memory/1496-85-0x00000000004B0000-0x0000000000510000-memory.dmpFilesize
384KB
-
memory/1496-91-0x00000000004B0000-0x0000000000510000-memory.dmpFilesize
384KB
-
memory/1524-825-0x0000000100000000-0x00000001001F1000-memory.dmpFilesize
1.9MB
-
memory/1524-212-0x0000000000620000-0x0000000000811000-memory.dmpFilesize
1.9MB
-
memory/1524-209-0x0000000100000000-0x00000001001F1000-memory.dmpFilesize
1.9MB
-
memory/1524-833-0x0000000000620000-0x0000000000811000-memory.dmpFilesize
1.9MB
-
memory/1652-4916-0x0000000001A20000-0x0000000001A36000-memory.dmpFilesize
88KB
-
memory/1652-4919-0x000000001B250000-0x000000001B26E000-memory.dmpFilesize
120KB
-
memory/1652-4915-0x0000000001A10000-0x0000000001A1E000-memory.dmpFilesize
56KB
-
memory/1652-4917-0x000000001AD10000-0x000000001AD58000-memory.dmpFilesize
288KB
-
memory/1652-4918-0x000000001AD60000-0x000000001AD7A000-memory.dmpFilesize
104KB
-
memory/1652-4914-0x00000000019B0000-0x00000000019C8000-memory.dmpFilesize
96KB
-
memory/1652-4924-0x000000001B6B0000-0x000000001B6C8000-memory.dmpFilesize
96KB
-
memory/1652-4925-0x000000001B6B0000-0x000000001B6C8000-memory.dmpFilesize
96KB
-
memory/1664-252-0x0000000100000000-0x00000001001D4000-memory.dmpFilesize
1.8MB
-
memory/1664-845-0x0000000100000000-0x00000001001D4000-memory.dmpFilesize
1.8MB
-
memory/1880-4863-0x000000001AE20000-0x000000001AE36000-memory.dmpFilesize
88KB
-
memory/1880-4862-0x0000000001B60000-0x0000000001BA8000-memory.dmpFilesize
288KB
-
memory/1880-4861-0x0000000001B40000-0x0000000001B4C000-memory.dmpFilesize
48KB
-
memory/1880-4860-0x0000000001B00000-0x0000000001B0E000-memory.dmpFilesize
56KB
-
memory/1972-239-0x0000000140000000-0x00000001401F1000-memory.dmpFilesize
1.9MB
-
memory/1972-128-0x0000000140000000-0x00000001401F1000-memory.dmpFilesize
1.9MB
-
memory/1972-838-0x0000000140000000-0x00000001401F1000-memory.dmpFilesize
1.9MB
-
memory/1992-4900-0x0000000001A60000-0x0000000001A6E000-memory.dmpFilesize
56KB
-
memory/1992-4902-0x000000001AE80000-0x000000001AE9E000-memory.dmpFilesize
120KB
-
memory/1992-4901-0x000000001AE60000-0x000000001AE7A000-memory.dmpFilesize
104KB
-
memory/1992-4899-0x0000000001A00000-0x0000000001A18000-memory.dmpFilesize
96KB
-
memory/2012-3816-0x0000000003EB0000-0x0000000003ECE000-memory.dmpFilesize
120KB
-
memory/2012-3815-0x0000000003EA0000-0x0000000003EA8000-memory.dmpFilesize
32KB
-
memory/2012-3814-0x0000000003E60000-0x0000000003E7E000-memory.dmpFilesize
120KB
-
memory/2012-3817-0x0000000003ED0000-0x0000000003EDA000-memory.dmpFilesize
40KB
-
memory/2024-863-0x0000000100000000-0x00000001001D5000-memory.dmpFilesize
1.8MB
-
memory/2024-274-0x0000000100000000-0x00000001001D5000-memory.dmpFilesize
1.8MB
-
memory/2128-177-0x0000000140000000-0x0000000140209000-memory.dmpFilesize
2.0MB
-
memory/2128-193-0x0000000140000000-0x0000000140209000-memory.dmpFilesize
2.0MB
-
memory/2172-3617-0x0000000003D50000-0x0000000003D7C000-memory.dmpFilesize
176KB
-
memory/2228-3775-0x0000000003D30000-0x0000000003DAC000-memory.dmpFilesize
496KB
-
memory/2228-3776-0x0000000003DB0000-0x0000000003DBA000-memory.dmpFilesize
40KB
-
memory/2232-3787-0x0000000003D30000-0x0000000003DAC000-memory.dmpFilesize
496KB
-
memory/2248-871-0x0000000100000000-0x0000000100253000-memory.dmpFilesize
2.3MB
-
memory/2248-277-0x0000000100000000-0x0000000100253000-memory.dmpFilesize
2.3MB
-
memory/2468-63-0x0000000010000000-0x00000000101E6000-memory.dmpFilesize
1.9MB
-
memory/2468-52-0x00000000003E0000-0x0000000000440000-memory.dmpFilesize
384KB
-
memory/2468-58-0x00000000003E0000-0x0000000000440000-memory.dmpFilesize
384KB
-
memory/2488-38-0x0000000010000000-0x00000000101DE000-memory.dmpFilesize
1.9MB
-
memory/2488-98-0x0000000010000000-0x00000000101DE000-memory.dmpFilesize
1.9MB
-
memory/2488-39-0x0000000000570000-0x00000000005D7000-memory.dmpFilesize
412KB
-
memory/2488-44-0x0000000000570000-0x00000000005D7000-memory.dmpFilesize
412KB
-
memory/2520-834-0x000000002E000000-0x000000002E1F4000-memory.dmpFilesize
2.0MB
-
memory/2520-223-0x000000002E000000-0x000000002E1F4000-memory.dmpFilesize
2.0MB
-
memory/2560-237-0x0000000100000000-0x0000000100542000-memory.dmpFilesize
5.3MB
-
memory/2560-835-0x0000000100000000-0x0000000100542000-memory.dmpFilesize
5.3MB
-
memory/2652-28-0x0000000000200000-0x0000000000260000-memory.dmpFilesize
384KB
-
memory/2652-146-0x0000000140000000-0x00000001401DC000-memory.dmpFilesize
1.9MB
-
memory/2652-34-0x0000000000200000-0x0000000000260000-memory.dmpFilesize
384KB
-
memory/2652-27-0x0000000140000000-0x00000001401DC000-memory.dmpFilesize
1.9MB
-
memory/2704-127-0x0000000100000000-0x00000001001E3000-memory.dmpFilesize
1.9MB
-
memory/2704-20-0x0000000000890000-0x00000000008F0000-memory.dmpFilesize
384KB
-
memory/2704-19-0x0000000000890000-0x00000000008F0000-memory.dmpFilesize
384KB
-
memory/2704-12-0x0000000000890000-0x00000000008F0000-memory.dmpFilesize
384KB
-
memory/2704-18-0x0000000100000000-0x00000001001E3000-memory.dmpFilesize
1.9MB
-
memory/3044-721-0x0000000003D20000-0x0000000003DDA000-memory.dmpFilesize
744KB