Overview

overview

9

Static

static

5

Payment Ad...F_.exe

windows7-x64

9

Payment Ad...F_.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    18/08/2024, 16:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Payment Advice - Advice RefGLV626201911]Priority payment Customer_PDF_.exe
  • Size 1.8MB
  • Sample240818-twc3vasdpg
  • SHA256 8321c0b6abc15f9feeef5021f4e37c4110e629cb64f7b0861b481e23ba86d54a
  • MD5 SHA1 SHA512 SSDEEP
Score
9/10
credential_accessdiscoveryspywarestealer

Malware Config

Signatures

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 24 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice RefGLV626201911]Priority payment Customer_PDF_.exe
    "C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice RefGLV626201911]Priority payment Customer_PDF_.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2932
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Users\Admin\AppData\Local\Temp\Payment Advice - Advice RefGLV626201911]Priority payment Customer_PDF_.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2740
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:2256
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2816
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2696
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e8 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1844
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 1d4 -NGENProcess 1d8 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2900
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 25c -NGENProcess 24c -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1704
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 254 -NGENProcess 258 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2508
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 244 -NGENProcess 25c -Pipe 1f0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:536
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 26c -NGENProcess 240 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:812
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 274 -NGENProcess 24c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1828
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 27c -NGENProcess 260 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1916
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 284 -NGENProcess 258 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2096
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 28c -NGENProcess 25c -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2912
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 294 -NGENProcess 240 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2092
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 29c -NGENProcess 24c -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1636
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a4 -NGENProcess 260 -Pipe 2a0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2968
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2ac -NGENProcess 258 -Pipe 2a8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1232
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2b4 -NGENProcess 25c -Pipe 2b0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2708
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 2bc -NGENProcess 240 -Pipe 2b8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3112
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2c4 -NGENProcess 24c -Pipe 2c0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3244
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2b4 -NGENProcess 2cc -Pipe 2bc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3404
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 260 -NGENProcess 1d4 -Pipe 2c8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3540
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 29c -NGENProcess 28c -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2b4 -NGENProcess 26c -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3724
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 250 -NGENProcess 2ac -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3828
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 27c -NGENProcess 2ac -Pipe 29c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3916
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 224 -NGENProcess 2b4 -Pipe 1e8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3360
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 224 -InterruptEvent 25c -NGENProcess 26c -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1608
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 1d8 -NGENProcess 264 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1788
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 2d0 -NGENProcess 2b4 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3048
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2d4 -NGENProcess 26c -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:3516
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2d8 -NGENProcess 2d0 -Pipe 2c4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2636
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2e0 -NGENProcess 26c -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2368
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 26c -NGENProcess 2d4 -Pipe 2dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3408
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 2e8 -NGENProcess 2d0 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:2392
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2d0 -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3012
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2f0 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3844
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2d0 -NGENProcess 2b4 -Pipe 2ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:3700
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 264 -NGENProcess 2f4 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:3900
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2f4 -NGENProcess 2f0 -Pipe 2d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2488
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 300 -NGENProcess 2b4 -Pipe 2e8 -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1372
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 264 -NGENProcess 308 -Pipe 2f4 -Comment "NGen Worker Process"
      2⤵
        PID:2444
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2f8 -NGENProcess 2b4 -Pipe 2d0 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        PID:1028
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2b4 -NGENProcess 304 -Pipe 300 -Comment "NGen Worker Process"
        2⤵
          PID:3308
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b4 -InterruptEvent 310 -NGENProcess 308 -Pipe 224 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          PID:2804
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 308 -NGENProcess 2f8 -Pipe 30c -Comment "NGen Worker Process"
          2⤵
            PID:2744
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 318 -NGENProcess 304 -Pipe 264 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:3380
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 304 -NGENProcess 310 -Pipe 314 -Comment "NGen Worker Process"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:664
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 320 -NGENProcess 2f8 -Pipe 2b4 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2132
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 2f8 -NGENProcess 318 -Pipe 31c -Comment "NGen Worker Process"
            2⤵
              PID:3580
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 328 -NGENProcess 310 -Pipe 308 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              PID:3744
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 310 -NGENProcess 320 -Pipe 324 -Comment "NGen Worker Process"
              2⤵
                PID:2264
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 330 -NGENProcess 318 -Pipe 304 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:3616
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 318 -NGENProcess 328 -Pipe 32c -Comment "NGen Worker Process"
                2⤵
                  PID:2320
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 338 -NGENProcess 320 -Pipe 2f8 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:3728
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 330 -NGENProcess 340 -Pipe 318 -Comment "NGen Worker Process"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:3980
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 2e0 -NGENProcess 320 -Pipe 310 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  • System Location Discovery: System Language Discovery
                  PID:860
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 320 -NGENProcess 33c -Pipe 338 -Comment "NGen Worker Process"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:2400
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 348 -NGENProcess 340 -Pipe 2fc -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:3120
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 340 -NGENProcess 334 -Pipe 348 -Comment "NGen Worker Process"
                  2⤵
                    PID:1716
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 354 -NGENProcess 2f0 -Pipe 350 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    PID:2084
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 2f0 -NGENProcess 34c -Pipe 33c -Comment "NGen Worker Process"
                    2⤵
                    • Modifies data under HKEY_USERS
                    PID:2576
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 35c -NGENProcess 334 -Pipe 320 -Comment "NGen Worker Process"
                    2⤵
                      PID:3476
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 358 -Pipe 344 -Comment "NGen Worker Process"
                      2⤵
                        PID:3656
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 364 -NGENProcess 34c -Pipe 340 -Comment "NGen Worker Process"
                        2⤵
                          PID:3812
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 368 -NGENProcess 334 -Pipe 328 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:3424
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 334 -NGENProcess 360 -Pipe 358 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:2588
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 360 -NGENProcess 354 -Pipe 34c -Comment "NGen Worker Process"
                          2⤵
                            PID:3616
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 374 -NGENProcess 36c -Pipe 35c -Comment "NGen Worker Process"
                            2⤵
                              PID:3888
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 37c -NGENProcess 370 -Pipe 378 -Comment "NGen Worker Process"
                              2⤵
                              • Modifies data under HKEY_USERS
                              PID:1756
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 364 -NGENProcess 354 -Pipe 368 -Comment "NGen Worker Process"
                              2⤵
                                PID:3944
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 374 -NGENProcess 384 -Pipe 37c -Comment "NGen Worker Process"
                                2⤵
                                  PID:2492
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 330 -NGENProcess 354 -Pipe 334 -Comment "NGen Worker Process"
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2020
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 388 -NGENProcess 364 -Pipe 2f0 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:1568
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 384 -Pipe 360 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:3024
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 330 -NGENProcess 394 -Pipe 388 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:2952
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 36c -NGENProcess 384 -Pipe 380 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:3332
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 398 -NGENProcess 38c -Pipe 370 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:1828
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 394 -Pipe 374 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:3460
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a0 -NGENProcess 384 -Pipe 380 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:3548
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a0 -InterruptEvent 3a4 -NGENProcess 38c -Pipe 390 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2620
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3a8 -NGENProcess 394 -Pipe 330 -Comment "NGen Worker Process"
                                                  2⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:3448
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 39c -NGENProcess 384 -Pipe 3b0 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:3196
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 36c -NGENProcess 3ac -Pipe 398 -Comment "NGen Worker Process"
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2596
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 3b4 -NGENProcess 394 -Pipe 364 -Comment "NGen Worker Process"
                                                    2⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3768
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 384 -Pipe 3a0 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:2392
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 3ac -Pipe 3a4 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:3836
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 394 -Pipe 3a8 -Comment "NGen Worker Process"
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2348
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 384 -Pipe 39c -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:3868
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3ac -Pipe 36c -Comment "NGen Worker Process"
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4044
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 394 -Pipe 3b4 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies data under HKEY_USERS
                                                          PID:1248
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 384 -Pipe 3b8 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:584
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3ac -Pipe 3bc -Comment "NGen Worker Process"
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies data under HKEY_USERS
                                                          PID:3980
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 38c -Pipe 3c0 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:2484
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 38c -NGENProcess 3d8 -Pipe 3dc -Comment "NGen Worker Process"
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies data under HKEY_USERS
                                                          PID:3104
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3e0 -NGENProcess 3ac -Pipe 3c8 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:1564
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 394 -Pipe 3cc -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:1696
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 3d8 -Pipe 3d0 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:864
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 3ec -NGENProcess 3e0 -Pipe 3e8 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:448
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 384 -NGENProcess 3d8 -Pipe 3d4 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:3548
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 3f4 -NGENProcess 3e4 -Pipe 3c4 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies data under HKEY_USERS
                                                          PID:3664
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3f8 -NGENProcess 3e0 -Pipe 3f0 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:3168
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3fc -NGENProcess 3d8 -Pipe 3ac -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Loads dropped DLL
                                                          • Drops file in Windows directory
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies data under HKEY_USERS
                                                          PID:3408
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3d8 -NGENProcess 3f4 -Pipe 3e4 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:2912
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 408 -NGENProcess 3e0 -Pipe 3ec -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Loads dropped DLL
                                                          • Drops file in Windows directory
                                                          • Modifies data under HKEY_USERS
                                                          PID:3820
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 3e0 -NGENProcess 3fc -Pipe 404 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Modifies data under HKEY_USERS
                                                          PID:3792
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 410 -NGENProcess 3f4 -Pipe 3f8 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Loads dropped DLL
                                                          • Drops file in Windows directory
                                                          PID:3992
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 3f4 -NGENProcess 408 -Pipe 40c -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:1860
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 418 -NGENProcess 3fc -Pipe 3d8 -Comment "NGen Worker Process"
                                                            2⤵
                                                            • Modifies data under HKEY_USERS
                                                            PID:884
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 41c -NGENProcess 414 -Pipe 384 -Comment "NGen Worker Process"
                                                            2⤵
                                                            • Loads dropped DLL
                                                            • Drops file in Windows directory
                                                            • Modifies data under HKEY_USERS
                                                            PID:2488
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 414 -NGENProcess 3f4 -Pipe 408 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:1372
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 424 -NGENProcess 3fc -Pipe 38c -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:1908
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 3fc -NGENProcess 3e0 -Pipe 42c -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:3352
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 410 -NGENProcess 428 -Pipe 418 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:2080
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 430 -NGENProcess 414 -Pipe 394 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:3248
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 434 -NGENProcess 3fc -Pipe 424 -Comment "NGen Worker Process"
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:3316
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 420 -NGENProcess 414 -Pipe 41c -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:864
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 414 -NGENProcess 3e0 -Pipe 440 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:1344
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 3f4 -NGENProcess 43c -Pipe 438 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:1916
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 444 -NGENProcess 434 -Pipe 428 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:2792
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 448 -NGENProcess 3e0 -Pipe 410 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:3196
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 44c -NGENProcess 43c -Pipe 430 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:3512
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 450 -NGENProcess 434 -Pipe 420 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:3608
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 444 -NGENProcess 3e0 -Pipe 458 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:3880
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 414 -NGENProcess 454 -Pipe 3f4 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:1584
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 450 -NGENProcess 460 -Pipe 444 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:3968
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 3fc -NGENProcess 454 -Pipe 448 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:3832
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 464 -NGENProcess 414 -Pipe 43c -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:3892
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 468 -NGENProcess 460 -Pipe 44c -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:1860
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 46c -NGENProcess 454 -Pipe 434 -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                            • Loads dropped DLL
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            PID:2324
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 454 -NGENProcess 464 -Pipe 414 -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:1640
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 474 -NGENProcess 460 -Pipe 450 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                              • Loads dropped DLL
                                                                                              • Drops file in Windows directory
                                                                                              PID:2616
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 460 -NGENProcess 46c -Pipe 470 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:436
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 47c -NGENProcess 464 -Pipe 468 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:1724
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 480 -NGENProcess 478 -Pipe 45c -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:2304
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 484 -NGENProcess 46c -Pipe 454 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:3420
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 488 -NGENProcess 464 -Pipe 3fc -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:3080
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 48c -NGENProcess 478 -Pipe 474 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                      • Loads dropped DLL
                                                                                                      • Drops file in Windows directory
                                                                                                      PID:3584
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 478 -NGENProcess 484 -Pipe 46c -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:3708
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 494 -NGENProcess 464 -Pipe 47c -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:3168
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 464 -NGENProcess 48c -Pipe 490 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2832
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 49c -NGENProcess 484 -Pipe 488 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2748
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 480 -NGENProcess 498 -Pipe 4a4 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:2752
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 460 -NGENProcess 4a0 -Pipe 478 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            PID:3724
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 4a0 -NGENProcess 49c -Pipe 484 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:3668
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a0 -InterruptEvent 4ac -NGENProcess 498 -Pipe 494 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              PID:2844
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 498 -NGENProcess 460 -Pipe 4a8 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:836
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 4b4 -NGENProcess 49c -Pipe 480 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:1540
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 4b8 -NGENProcess 4b0 -Pipe 3e0 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  PID:4064
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 498 -NGENProcess 4c0 -Pipe 4b4 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:3156
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 4c0 -NGENProcess 498 -Pipe 4a0 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                    • Drops file in Windows directory
                                                                                                                    PID:1624
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 498 -NGENProcess 4b0 -Pipe 4b8 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:3100
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 4c8 -NGENProcess 464 -Pipe 4ac -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:3536
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 4cc -NGENProcess 4c4 -Pipe 460 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:3500
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 4d0 -NGENProcess 4b0 -Pipe 4bc -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                        PID:3636
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4d4 -NGENProcess 464 -Pipe 48c -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                        PID:2636
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 464 -NGENProcess 4cc -Pipe 4c4 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:3672
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 4dc -NGENProcess 4b0 -Pipe 498 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:2464
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4e0 -NGENProcess 4d8 -Pipe 4c8 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:2756
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 4e4 -NGENProcess 4cc -Pipe 4d0 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:2512
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e4 -InterruptEvent 4ec -NGENProcess 4b0 -Pipe 4e8 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:3808
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4e0 -NGENProcess 4f0 -Pipe 4e4 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:3728
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 4d8 -NGENProcess 4b0 -Pipe 4d4 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                  PID:3928
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d8 -InterruptEvent 4f4 -NGENProcess 4ec -Pipe 4cc -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:2448
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 4ec -NGENProcess 4e0 -Pipe 4f0 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:988
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ec -InterruptEvent 4fc -NGENProcess 4b0 -Pipe 49c -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:1784
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ec -InterruptEvent 120 -NGENProcess 4f4 -Pipe 4f8 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:1148
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 120 -InterruptEvent 4dc -NGENProcess 4fc -Pipe 464 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:688
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4d8 -NGENProcess 4c0 -Pipe 4b0 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:1716
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d8 -InterruptEvent 504 -NGENProcess 120 -Pipe 4ec -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:1544
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 504 -InterruptEvent 11c -NGENProcess 4c0 -Pipe 500 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:1624
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 11c -InterruptEvent 50c -NGENProcess 4dc -Pipe 4e0 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:2800
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 510 -NGENProcess 120 -Pipe 508 -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:3316
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 514 -NGENProcess 4c0 -Pipe 4f4 -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                  PID:2920
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 518 -NGENProcess 4dc -Pipe 4d8 -Comment "NGen Worker Process"
                                                                                                                                                  2⤵
                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                  PID:2168
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 518 -InterruptEvent 51c -NGENProcess 120 -Pipe 504 -Comment "NGen Worker Process"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:3252
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 520 -NGENProcess 4c0 -Pipe 11c -Comment "NGen Worker Process"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3248
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 520 -InterruptEvent 524 -NGENProcess 4dc -Pipe 50c -Comment "NGen Worker Process"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1512
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 528 -NGENProcess 120 -Pipe 510 -Comment "NGen Worker Process"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3696
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 52c -NGENProcess 4c0 -Pipe 514 -Comment "NGen Worker Process"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:2660
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 530 -NGENProcess 4dc -Pipe 518 -Comment "NGen Worker Process"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:3768
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 534 -NGENProcess 120 -Pipe 51c -Comment "NGen Worker Process"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3844
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 538 -NGENProcess 4c0 -Pipe 520 -Comment "NGen Worker Process"
                                                                                                                                                                2⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3828
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 53c -NGENProcess 4dc -Pipe 524 -Comment "NGen Worker Process"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2204
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 540 -NGENProcess 120 -Pipe 528 -Comment "NGen Worker Process"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2108
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 544 -NGENProcess 4c0 -Pipe 52c -Comment "NGen Worker Process"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:836
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 548 -NGENProcess 4dc -Pipe 530 -Comment "NGen Worker Process"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:2928
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 53c -NGENProcess 120 -Pipe 550 -Comment "NGen Worker Process"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1820
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 534 -NGENProcess 54c -Pipe 538 -Comment "NGen Worker Process"
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                          PID:3024
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 554 -NGENProcess 4dc -Pipe 4fc -Comment "NGen Worker Process"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:4080
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 558 -NGENProcess 120 -Pipe 540 -Comment "NGen Worker Process"
                                                                                                                                                                            2⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:3396
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 55c -NGENProcess 534 -Pipe 53c -Comment "NGen Worker Process"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1372
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 544 -NGENProcess 120 -Pipe 548 -Comment "NGen Worker Process"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:3084
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 564 -NGENProcess 554 -Pipe 4c0 -Comment "NGen Worker Process"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2096
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 564 -InterruptEvent 568 -NGENProcess 534 -Pipe 560 -Comment "NGen Worker Process"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:3164
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 56c -InterruptEvent 544 -NGENProcess 570 -Pipe 564 -Comment "NGen Worker Process"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3548
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 54c -NGENProcess 534 -Pipe 558 -Comment "NGen Worker Process"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3476
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 574 -NGENProcess 568 -Pipe 4dc -Comment "NGen Worker Process"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:2988
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 578 -NGENProcess 570 -Pipe 55c -Comment "NGen Worker Process"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                        PID:3168
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 570 -NGENProcess 544 -Pipe 580 -Comment "NGen Worker Process"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3036
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 120 -NGENProcess 57c -Pipe 56c -Comment "NGen Worker Process"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3696
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 120 -InterruptEvent 584 -NGENProcess 578 -Pipe 554 -Comment "NGen Worker Process"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:2660
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 584 -InterruptEvent 588 -NGENProcess 544 -Pipe 534 -Comment "NGen Worker Process"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3996
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 120 -NGENProcess 590 -Pipe 584 -Comment "NGen Worker Process"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                                                                                PID:3844
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 120 -InterruptEvent 590 -NGENProcess 574 -Pipe 594 -Comment "NGen Worker Process"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3968
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 570 -NGENProcess 598 -Pipe 120 -Comment "NGen Worker Process"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2884
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 568 -NGENProcess 574 -Pipe 578 -Comment "NGen Worker Process"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:2200
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 568 -InterruptEvent 59c -NGENProcess 590 -Pipe 588 -Comment "NGen Worker Process"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2020
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 590 -NGENProcess 57c -Pipe 5a4 -Comment "NGen Worker Process"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3148
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 590 -InterruptEvent 544 -NGENProcess 5a0 -Pipe 54c -Comment "NGen Worker Process"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2556
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 5a0 -NGENProcess 570 -Pipe 5ac -Comment "NGen Worker Process"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3156
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 58c -NGENProcess 5a8 -Pipe 598 -Comment "NGen Worker Process"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:2496
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 5b0 -NGENProcess 590 -Pipe 574 -Comment "NGen Worker Process"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:3380
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b0 -InterruptEvent 5b4 -NGENProcess 570 -Pipe 568 -Comment "NGen Worker Process"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3604
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b4 -InterruptEvent 5b8 -NGENProcess 5a8 -Pipe 59c -Comment "NGen Worker Process"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:2800
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b8 -InterruptEvent 5bc -NGENProcess 590 -Pipe 544 -Comment "NGen Worker Process"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3316
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5bc -InterruptEvent 5c0 -NGENProcess 570 -Pipe 5a0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3524
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c4 -InterruptEvent 5b8 -NGENProcess 5c8 -Pipe 5bc -Comment "NGen Worker Process"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2168
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b8 -InterruptEvent 58c -NGENProcess 570 -Pipe 5b0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:1688
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 5cc -NGENProcess 5c0 -Pipe 57c -Comment "NGen Worker Process"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2664
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5cc -InterruptEvent 5d0 -NGENProcess 5c8 -Pipe 5b4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:780
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d0 -InterruptEvent 5d4 -NGENProcess 570 -Pipe 5a8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2752
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d4 -InterruptEvent 5d8 -NGENProcess 5c0 -Pipe 5c4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:3424
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5dc -InterruptEvent 5d0 -NGENProcess 5e0 -Pipe 5d4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:3940
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d0 -InterruptEvent 5b8 -NGENProcess 5c0 -Pipe 58c -Comment "NGen Worker Process"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:112
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b8 -InterruptEvent 5e4 -NGENProcess 5d8 -Pipe 590 -Comment "NGen Worker Process"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1232
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5e4 -InterruptEvent 5e8 -NGENProcess 5e0 -Pipe 5cc -Comment "NGen Worker Process"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:3936
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5e8 -InterruptEvent 5ec -NGENProcess 5c0 -Pipe 5c8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2108
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5ec -InterruptEvent 5f0 -NGENProcess 5d8 -Pipe 5dc -Comment "NGen Worker Process"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:2548
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f0 -InterruptEvent 5f4 -NGENProcess 5e0 -Pipe 5d0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1784
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 5f8 -NGENProcess 5c0 -Pipe 5b8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1608
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f8 -InterruptEvent 5fc -NGENProcess 5d8 -Pipe 5e4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:3308
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5fc -InterruptEvent 600 -NGENProcess 5e0 -Pipe 5e8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:2064
                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 600 -InterruptEvent 604 -NGENProcess 5c0 -Pipe 5ec -Comment "NGen Worker Process"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:3348
                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 604 -InterruptEvent 608 -NGENProcess 5d8 -Pipe 5f0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2628
                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 608 -InterruptEvent 60c -NGENProcess 5e0 -Pipe 5f4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1036
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 60c -InterruptEvent 610 -NGENProcess 5c0 -Pipe 5f8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:2136
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 610 -InterruptEvent 614 -NGENProcess 5d8 -Pipe 5fc -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:3520
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 60c -InterruptEvent 1b4 -NGENProcess 2b8 -Pipe 2b0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:3524
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1b4 -InterruptEvent 5d8 -NGENProcess 5e0 -Pipe 614 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:3372
                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 5c0 -NGENProcess 618 -Pipe 610 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:2596
                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 608 -NGENProcess 2b8 -Pipe 230 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:1512
                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 608 -InterruptEvent 570 -NGENProcess 5e0 -Pipe 2a8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                            PID:2748
                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 604 -NGENProcess 618 -Pipe 60c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:4008
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 604 -InterruptEvent 61c -NGENProcess 2b8 -Pipe 1b4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:3768
                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 61c -InterruptEvent 620 -NGENProcess 5e0 -Pipe 5d8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:3964
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 620 -InterruptEvent 624 -NGENProcess 618 -Pipe 5c0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:2848
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 628 -NGENProcess 2b8 -Pipe 608 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 628 -InterruptEvent 62c -NGENProcess 5e0 -Pipe 570 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:336
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 62c -NGENProcess 628 -Pipe 618 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:1076
                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 62c -InterruptEvent 604 -NGENProcess 5e0 -Pipe 61c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:592
                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 604 -InterruptEvent 638 -NGENProcess 624 -Pipe 600 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1784
                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 62c -NGENProcess 620 -Pipe 638 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:3024
                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 62c -InterruptEvent 640 -NGENProcess 630 -Pipe 63c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1988
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 644 -NGENProcess cc -Pipe 5e0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:3428
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 644 -InterruptEvent 648 -NGENProcess 620 -Pipe 624 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:2304
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 64c -NGENProcess 630 -Pipe 628 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:3084
                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 630 -NGENProcess 640 -Pipe 654 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1516
                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 630 -InterruptEvent 634 -NGENProcess 650 -Pipe 62c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:2972
                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 658 -NGENProcess 648 -Pipe 2b8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1344
                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 658 -InterruptEvent 65c -NGENProcess 640 -Pipe cc -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:3524
                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 660 -NGENProcess 650 -Pipe 644 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:3372
                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 660 -InterruptEvent 664 -NGENProcess 648 -Pipe 64c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:2596
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 664 -InterruptEvent 668 -NGENProcess 640 -Pipe 630 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:3664
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 668 -InterruptEvent 66c -NGENProcess 650 -Pipe 634 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:3388
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 66c -InterruptEvent 670 -NGENProcess 648 -Pipe 658 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:4008
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 670 -InterruptEvent 674 -NGENProcess 640 -Pipe 65c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:4004
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 674 -InterruptEvent 678 -NGENProcess 650 -Pipe 660 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:3948
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 67c -NGENProcess 648 -Pipe 664 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:4060
                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 680 -NGENProcess 640 -Pipe 668 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:884
                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 684 -NGENProcess 650 -Pipe 66c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:2680
                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 688 -NGENProcess 648 -Pipe 670 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:3032
                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 688 -InterruptEvent 68c -NGENProcess 640 -Pipe 674 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1148
                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 68c -InterruptEvent 690 -NGENProcess 650 -Pipe 678 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:2468
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 690 -InterruptEvent 694 -NGENProcess 648 -Pipe 67c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:3352
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 698 -NGENProcess 640 -Pipe 680 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                      PID:3368
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 69c -NGENProcess 650 -Pipe 684 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:3564
                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 6a0 -NGENProcess 648 -Pipe 688 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:3180
                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a0 -InterruptEvent 6a4 -NGENProcess 640 -Pipe 68c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:2132
                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a4 -InterruptEvent 6a8 -NGENProcess 650 -Pipe 690 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:3448
                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6a8 -InterruptEvent 6ac -NGENProcess 648 -Pipe 694 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:1672
                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 6ac -NGENProcess 6a8 -Pipe 640 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:2292
                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6ac -InterruptEvent 698 -NGENProcess 648 -Pipe 69c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:748
                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 648 -NGENProcess 6a0 -Pipe 6bc -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:3740
                                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 620 -NGENProcess 6b8 -Pipe 6b4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:2464
                                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 620 -InterruptEvent 6c0 -NGENProcess 6ac -Pipe 650 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:3792
                                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 6c4 -NGENProcess 6a0 -Pipe 6a4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:3680
                                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 6c8 -NGENProcess 6b8 -Pipe 6b0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:4044
                                                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 6cc -NGENProcess 6ac -Pipe 698 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:4004
                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6cc -InterruptEvent 6c0 -NGENProcess 6a0 -Pipe 6d4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 6c0 -InterruptEvent 648 -NGENProcess 6d0 -Pipe 620 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:4056
                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 6d8 -NGENProcess 6ac -Pipe 6a8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:884
                                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  PID:556
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 1b8 -NGENProcess 1bc -Pipe 1c8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    PID:4016
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 230 -NGENProcess 238 -Pipe 23c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    PID:2556
                                                                                                                                                                                                                                                                                                                                • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:848
                                                                                                                                                                                                                                                                                                                                • C:\Windows\ehome\ehsched.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\ehome\ehsched.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:1080
                                                                                                                                                                                                                                                                                                                                • C:\Windows\eHome\EhTray.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                                  PID:1584
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\getmac.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\getmac.exe"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                                                                                                    • Modifies Internet Explorer settings
                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                                                                                                                                    PID:1664
                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:2860
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:2196
                                                                                                                                                                                                                                                                                                                                • C:\Windows\ehome\ehRec.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  PID:3000
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                  PID:2840
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:2092
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\msdtc.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\msdtc.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                  PID:1960
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  PID:3004
                                                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:1868
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:2388
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\locator.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\locator.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:2732
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\snmptrap.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\snmptrap.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:2216
                                                                                                                                                                                                                                                                                                                                • C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:2776
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  PID:1032
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wbengine.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  PID:1340
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  PID:560
                                                                                                                                                                                                                                                                                                                                • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  PID:2992
                                                                                                                                                                                                                                                                                                                                • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                  PID:1528
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                                    PID:3228
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:3320
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\ehome\ehsched.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\ehome\ehsched.exe
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                    PID:3364
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\ehome\ehRec.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                                                    PID:2596

                                                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                                                        OSE.EXE
                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                                                                                                                                                                                                        • Size 1.4MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 5b08789355f832d864bc2464274502c87a745273eb85f3c8de4a9b5d1b107822
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        GROOVE.EXE
                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                                                                                                                                                                                                        • Size 30.1MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 45c41740a9a67163801c5553a80f0a3431060430f705fb27187e6292d6664cd9
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        maintenanceservice.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.4MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 51be5923ecd241bb9ae1e02d4ecb07a1cbb81bc87cb5496a7ec102608d048341
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        elevation_service.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 8cf78a5c7bb24b02dd3f77daca1ba1ba68fa1946a08009e407c7a77eb489ec24
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        MSS.log
                                                                                                                                                                                                                                                                                                                                        • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                                                                                                                                                                                                                        • Size 1024KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 9c7bc0480510edd003dc9ee6c8b9cbd42301900b8dfcafc18698c896db1aea1e
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        biopsies
                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Local\Temp\biopsies
                                                                                                                                                                                                                                                                                                                                        • Size 282KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 68ef82f7835c969f710ef2aa34bd75581a5bbdd7c2e99841cd7a32f498db4403
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                        • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                                                                                                                                                                                                        • Size 24B
                                                                                                                                                                                                                                                                                                                                        • SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        ngen_service.log
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                                                                                                                                                                                                                        • Size 872KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 2f27061a467551024c0b2acc4c5b5d69fc765a5c6340911942cde9b7e54687fb
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 5bd101a89364c65484ed2cb5e109eb54261513ab8518270cf22b7cb6ca6568d0
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 2bcd83b1217135d6a0bddbbdbb05b4ca5a9076ae821fc976a9542d680cfd47aa
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 d6a9e5a860a8dec4547655cee97299386844e03925c273b3cc630e2fa40ee049
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        ngen_service.log
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
                                                                                                                                                                                                                                                                                                                                        • Size 8KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 2fd52900179d4c807cacc9b8b29a9be954e6f1d7f1385ea28b1c3e3179e3a74f
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        perfhost.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 2ca18748cf6f81e10f2e4bd7875418c54bd94d2f268096adfb8b9cb55a2af525
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Locator.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\System32\Locator.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 7374e7faa37e6f883e2d285ea1f02d03ac4f29e40aa895d5be7eb940d40f2896
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        SearchIndexer.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\System32\SearchIndexer.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.1MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 d5c99e1671c86be6b315335d597784195d65888e1b3de18de23c359c254d130e
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        VSSVC.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\System32\VSSVC.exe
                                                                                                                                                                                                                                                                                                                                        • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 e009198bb707fa9d862cbb91012d5d5efe883f21960263ddc575dadea4232a28
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        ieetwcollector.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\System32\ieetwcollector.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 91d5429571707c3abe29726ad60937f38bc3fc5066911afe0a22f3a28eb78788
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        msdtc.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\System32\msdtc.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.4MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 ab01a06ee0c3d087d1fc3f51ebd2ad0d8906fe60527f05598e9268c4771d60d0
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        snmptrap.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\System32\snmptrap.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 605aba747936bc99c7c8735834277d0d53448f2aa825a0272e3fb37dd2d3539f
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        vds.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.7MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 c119b29c1ea6d85061bb80e473b5767da58654029010e6f55dcedeb526a26d6b
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        wbengine.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\System32\wbengine.exe
                                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 7773f1de4378595ce06db32ffbbd6373534c1aa207984b40e7af3a25ff63ae06
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.Office.Tools.Word.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 834KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 797KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 4c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 163KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 99facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 148KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 34KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 109KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\181356b1bbb85fe2401c4dfad1a45133\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 158KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 b2f9dce9baca3e56fb3587ffe30ca38eb0f89ed30985b328a853778480c0f87b
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 41KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\437be8cccaba2c34e2c863a89b1e6b86\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 83KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 f0feeb2383f0a38b4da2ce921a8d80743b900ace3b5eef2aadf02ea4c8610d63
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\43ac81bed18b52d77a8011ada80939b5\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 296KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 ad8d210d001d3298ad4e1cbf08449b2cbd2b358d28cfad99db78639627a7cb86
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\47443addf9f3012cb638ed20b948410f\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 180KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 cbcbdbc40b16fddb8d87da5bd2acf7ce26b67eaa55a85c7b276e117c9629d171
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 356KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 971188681028501d5ac8143b9127feb95d6982417590af42cf1a43483e38bd42
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5c8b40c69a2293c8f499b38b25c41117\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 157KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 0406be7235661a62f68bff4c7640b4e241a0c392d548bf242ed08ba0eeaee66b
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f2320d38621eb541713e6cd421c2b8a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 648KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 637dc357ff9011902186f2fd128ca74ac84fdb6d984f15036803b6a8fe28868a
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 868c297cb00b2d298f594ad7e3fd4e38aeaac78042613626d6f919b2bca25c4f
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 210KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9248a710d7fe2485a557ce5d3cbcf2df\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 607KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 a09436c1df8fcd8ecd1732d6e4e68f32b092e71e0c5d3308b0f3f20abd03d4e0
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 53KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 65KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ac2e1ab5cae0ba75d0a7173ad624c222\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 143KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 b56eb87a81a8777ae81fe8099d7f18dd11757dff104a9609a0568ca0b4ce0856
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 28KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b8e029b1434d965380b363483e376df0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 329KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 e94a4ad1ef9de2886a231e857c8691328c2e6e344cc9e82440e5c45b8a788256
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bb63c81d306795319eaf7af25f67342a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 141KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 124a0869df89ec2c9f0b307dd6b6d17e1e1e7ad638e0b4abf4483c15f842d270
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 278KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 54701cbe719b08b2393b9f4a604c372f9a280b5d3dd520b563d2aea7d69a1496
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 27KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 57KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e9f13d8aac806eaaa7f27184d8e16ab7\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 187KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 c733241c9bbb8baa1c5c667b400b8a9f3ddc34d321e7704f5ccf7e0142c8e57d
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 130KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 59KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 42KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        ehiVidCtl.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 855KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        stdole.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
                                                                                                                                                                                                                                                                                                                                        • Size 43KB
                                                                                                                                                                                                                                                                                                                                        • SHA256 6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        ehrecvr.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\ehome\ehrecvr.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 45b7158998f4cbded7df1323703ddf6b59af74796f6cc8ddc3487f25ff9e095d
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        ehsched.exe
                                                                                                                                                                                                                                                                                                                                        • Path C:\Windows\ehome\ehsched.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 3f883609f9e6b816a9f46d2eaf8ee15d6de50cfb91cef9cdd45d356795958545
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        wmpnetwk.exe
                                                                                                                                                                                                                                                                                                                                        • Path \Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                                                                                                                                                                                                        • Size 2.0MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 c66a4e2f2fbe07b36c0ad86a1461bec4354429a96a8eac5186b1a8ed2cd14b97
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                        • Path \Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 662d0da9a560d616e7bce4fff5247892a91e7f9d48d5320ddea913965cadd4bd
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        aspnet_state.exe
                                                                                                                                                                                                                                                                                                                                        • Path \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 0f418885cbba59f0ecf4203914f659bc4c433f8a9bdac916bd568ff6219eddec
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        alg.exe
                                                                                                                                                                                                                                                                                                                                        • Path \Windows\System32\alg.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 7623e2a9182cbb2286b8e980e5e14b223f7b36fd6ab434b2d14c0328a763778e
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        msiexec.exe
                                                                                                                                                                                                                                                                                                                                        • Path \Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.3MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 084e632d9645e6c8c8700f6bcdc21fd9c670bb3828aa9ffd2ba26dd673aada41
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                        • Path \Windows\System32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                                        • Size 1.4MB
                                                                                                                                                                                                                                                                                                                                        • SHA256 0cecff7b866120e4f979058342f5c091609e7216db1a84a89efbf6c75b242796
                                                                                                                                                                                                                                                                                                                                        • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                                        Submit Download

                                                                                                                                                                                                                                                                                                                                        memory/536-290-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/536-361-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/556-80-0x0000000000220000-0x0000000000280000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/556-82-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/556-74-0x0000000000220000-0x0000000000280000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/560-252-0x0000000100000000-0x000000010021B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/560-554-0x0000000100000000-0x000000010021B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/812-327-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/812-439-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/848-114-0x0000000001990000-0x00000000019A0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/848-95-0x0000000000250000-0x00000000002B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/848-89-0x0000000000250000-0x00000000002B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/848-181-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/848-97-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/848-113-0x0000000000E60000-0x0000000000E70000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/848-888-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1032-217-0x0000000100000000-0x0000000100219000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1032-326-0x0000000100000000-0x0000000100219000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1080-192-0x0000000140000000-0x0000000140209000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1080-110-0x0000000140000000-0x0000000140209000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1080-774-0x0000000140000000-0x0000000140209000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1080-108-0x0000000000250000-0x00000000002B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1340-248-0x0000000100000000-0x0000000100202000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1340-503-0x0000000100000000-0x0000000100202000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-912-0x00000000023C0000-0x0000000002426000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-910-0x00000000023C0000-0x00000000023C8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-908-0x00000000023C0000-0x0000000002448000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-907-0x00000000023C0000-0x00000000023D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-901-0x00000000023C0000-0x00000000023DE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-900-0x00000000023C0000-0x00000000023CA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-903-0x00000000023C0000-0x000000000244C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-905-0x00000000023C0000-0x000000000255E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-166-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-57-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-902-0x00000000023C0000-0x00000000023DA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-909-0x00000000023C0000-0x00000000023E4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-906-0x00000000023C0000-0x00000000024AC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-63-0x00000000007D0000-0x0000000000836000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-58-0x00000000007D0000-0x0000000000836000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-911-0x00000000023C0000-0x00000000023EA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1492-904-0x00000000023C0000-0x0000000002464000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1528-755-0x0000000100000000-0x0000000100123000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1528-295-0x0000000100000000-0x0000000100123000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1704-291-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1704-241-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1828-424-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1828-480-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1844-229-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1844-193-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1868-247-0x000000002E000000-0x000000002E20C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1868-191-0x000000002E000000-0x000000002E20C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1916-481-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1916-507-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1960-157-0x0000000140000000-0x000000014020D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/1960-216-0x0000000140000000-0x000000014020D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2092-161-0x0000000140000000-0x0000000140221000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2092-569-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2092-151-0x0000000140000000-0x0000000140221000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2092-555-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2096-506-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2096-519-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2132-3589-0x0000000003D40000-0x0000000003D48000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2196-799-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2196-202-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2196-129-0x0000000140000000-0x0000000140205000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2216-210-0x0000000100000000-0x00000001001ED000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2216-289-0x0000000100000000-0x00000001001ED000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2256-25-0x0000000100000000-0x00000001001FB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2256-125-0x0000000100000000-0x00000001001FB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2388-264-0x0000000001000000-0x00000000011ED000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2388-197-0x0000000001000000-0x00000000011ED000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2508-277-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2508-292-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2696-51-0x0000000010000000-0x00000000101FE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2708-609-0x0000000003D30000-0x0000000003DEA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2732-276-0x0000000100000000-0x00000001001EC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2732-204-0x0000000100000000-0x00000001001EC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2740-156-0x0000000000400000-0x0000000000447000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2740-44-0x0000000000400000-0x0000000000447000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2740-508-0x0000000000400000-0x0000000000447000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2776-296-0x0000000100000000-0x000000010026B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2776-213-0x0000000100000000-0x000000010026B000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2816-31-0x0000000000830000-0x0000000000890000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2816-30-0x0000000140000000-0x00000001401F4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2816-139-0x0000000140000000-0x00000001401F4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2816-39-0x0000000000830000-0x0000000000890000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2840-208-0x000000002E000000-0x000000002FE1E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2840-140-0x000000002E000000-0x000000002FE1E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2840-132-0x0000000000B00000-0x0000000000B66000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2860-116-0x0000000000410000-0x0000000000470000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2860-195-0x0000000140000000-0x0000000140237000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2860-122-0x0000000000410000-0x0000000000470000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2860-126-0x0000000140000000-0x0000000140237000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2900-243-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2900-226-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2912-558-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2912-530-0x0000000000400000-0x00000000005FF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2932-26-0x00000000029E0000-0x00000000029E4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2932-8-0x0000000000E20000-0x0000000000E86000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2932-7-0x0000000000400000-0x00000000005CC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2932-0-0x0000000000E20000-0x0000000000E86000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2932-46-0x0000000000400000-0x00000000005CC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2992-265-0x0000000100000000-0x000000010020A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/2992-620-0x0000000100000000-0x000000010020A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/3004-167-0x0000000100000000-0x0000000100209000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/3004-169-0x0000000000650000-0x0000000000859000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/3004-240-0x0000000100000000-0x0000000100209000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/3004-246-0x0000000000650000-0x0000000000859000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/3180-3579-0x0000000003D60000-0x0000000003D8C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download

                                                                                                                                                                                                                                                                                                                                        memory/3448-3599-0x0000000003D70000-0x0000000003DB0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                        Download