1c3eabc20fcbbc87a7ebf0509c21ca67169453894ee059570cf4465634296ff1

Analysis

max time kernel
29s
max time network
149s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 17:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
Size

5.3MB
MD5

2e2b567671fb86b7e5ebc9a1d0c47f60
SHA1

38eb04703704a6ad50168984c22c386594ce63b3
SHA256

1c3eabc20fcbbc87a7ebf0509c21ca67169453894ee059570cf4465634296ff1
SHA512

ea0df4d0dbaf0e67972128f1b6dc6a9be4e85c307aaeb28bb2b0daa39639ef0d6614982efd171e9003aa7e163a993d41d06b7ae84019979cf7430350c394c3fc
SSDEEP

98304:zLXClnwPWrDSkYg5MHKO6HCD2zo47wRGpj3:ClnwPiQg+12zokF9

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 49 IoCs

pid	Process
480	Process not Found
2160	aspnet_state.exe
1780	mscorsvw.exe
1688	mscorsvw.exe
2076	mscorsvw.exe
2972	mscorsvw.exe
636	ehRecvr.exe
1420	ehsched.exe
1772	elevation_service.exe
3048	IEEtwCollector.exe
2100	GROOVE.EXE
924	maintenanceservice.exe
1636	msdtc.exe
1320	msiexec.exe
2576	OSE.EXE
2104	perfhost.exe
920	locator.exe
2884	snmptrap.exe
1004	vds.exe
2372	vssvc.exe
2776	wbengine.exe
3208	WmiApSrv.exe
3296	wmpnetwk.exe
3508	mscorsvw.exe
3608	SearchIndexer.exe
3660	mscorsvw.exe
3916	mscorsvw.exe
3136	mscorsvw.exe
2832	mscorsvw.exe
2224	mscorsvw.exe
3428	mscorsvw.exe
3852	mscorsvw.exe
2932	mscorsvw.exe
704	mscorsvw.exe
3448	mscorsvw.exe
3992	mscorsvw.exe
3868	mscorsvw.exe
3664	mscorsvw.exe
3276	mscorsvw.exe
924	mscorsvw.exe
3916	mscorsvw.exe
3572	mscorsvw.exe
3292	mscorsvw.exe
4012	mscorsvw.exe
3680	mscorsvw.exe
2520	mscorsvw.exe
3268	mscorsvw.exe
3984	mscorsvw.exe
3380	mscorsvw.exe

Loads dropped DLL 13 IoCs

pid	Process
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
1320	msiexec.exe
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
480	Process not Found
768	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3af259bdacae13d2.bin	aspnet_state.exe
File opened for modification	C:\Windows\system32\IEEtwCollector.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	GROOVE.EXE
File opened for modification	C:\Windows\System32\msdtc.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaws.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\xjc.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jre7\bin\kinit.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jre7\bin\pack200.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jconsole.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstack.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\orbd.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\airappinstaller.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jre7\bin\servertool.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jre7\bin\java-rmi.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\ODeploy.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpnetwk.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\wsimport.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ktab.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jre7\bin\ssvagent.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jre7\bin\klist.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\WksConv\Wkconv.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\minidump-analyzer.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jre7\bin\rmid.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOICONS.EXE	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{1A1CC958-2235-4531-8015-5AFE1D6CBF7D}\chrome_installer.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe

Drops file in Windows directory 27 IoCs

description	ioc	Process
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehsched.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenofflinequeuelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\ngenservice_pri1_lock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.lock	mscorsvw.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File created	C:\Windows\Microsoft.NET\ngennicupdatelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngenservicelock.dat	mscorsvw.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log	mscorsvw.exe
File opened for modification	C:\Windows\ehome\ehRecvr.exe	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OSE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GROOVE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mscorsvw.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthQuantumSeconds = "180"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health\{76600106-9C14-4C41-B9EF-B00F8ADADFB1}	wmpnetwk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Direct3D\MostRecentApplication	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheWaitForSize = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecWaitForCounts = "32"	ehRec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\ActiveMovie	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Preferences\	wmpnetwk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{45670FA8-ED97-4F44-BC93-305082590BFB} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000070cc2946dd02db01	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheLongPageCount = "32"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000505df045dd02db01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\windows journal\journal.exe,-62005 = "Tablet PC"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMinJobWaitTimeMs = "3000"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\ShadowFileMaxClients = "32"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MCTRes.dll,-200005 = "Websites for United States"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0bef245dd02db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer\Health	wmpnetwk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-304 = "Public Recorded TV"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheHashTableSize = "67"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D\MostRecentApplication	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	ehRecvr.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CacheShortPageCount = "64"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileGrowthBudgetMs = "45000"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogInitialPageCount = "16"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CriticalLowDiskSpace = "1073741824"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wmpnetwk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SearchIndexer.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\LogMaxJobDemoteTimeMs = "5000"	ehRec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007076e445dd02db01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	ehRecvr.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wmpnetwk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPoitnRateMs = "10000"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	GROOVE.EXE
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\SwagBitsPerSecond = "19922944"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MediaPlayer	wmpnetwk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\CommitMaxCheckPointPageCount = "7"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpRecCount = "32"	ehRec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\NvpClientsCount = "32"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\xpsrchvw.exe,-106 = "XPS Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Health\{76600106-9C14-4C41-B9EF-B00F8ADADFB1}	wmpnetwk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileDiscontinuitiesPerSecond = "20"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\eHome\ehepgres.dll,-312 = "Sample Media"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Direct3D	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Multimedia	SearchFilterHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE\SAL\FileInlineGrowthQuantumSeconds = "30"	ehRec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration"	SearchIndexer.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2892	chrome.exe
2892	chrome.exe
1616	ehRec.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	332	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
Token: SeTakeOwnershipPrivilege	2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2076	mscorsvw.exe
Token: SeShutdownPrivilege	2972	mscorsvw.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: 33	2548	EhTray.exe
Token: SeIncBasePriorityPrivilege	2548	EhTray.exe
Token: SeRestorePrivilege	1320	msiexec.exe
Token: SeTakeOwnershipPrivilege	1320	msiexec.exe
Token: SeSecurityPrivilege	1320	msiexec.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeBackupPrivilege	2372	vssvc.exe
Token: SeRestorePrivilege	2372	vssvc.exe
Token: SeAuditPrivilege	2372	vssvc.exe
Token: SeShutdownPrivilege	2076	mscorsvw.exe
Token: SeShutdownPrivilege	2972	mscorsvw.exe
Token: SeBackupPrivilege	2776	wbengine.exe
Token: SeRestorePrivilege	2776	wbengine.exe
Token: SeSecurityPrivilege	2776	wbengine.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeDebugPrivilege	1616	ehRec.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2076	mscorsvw.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2972	mscorsvw.exe
Token: SeShutdownPrivilege	2076	mscorsvw.exe
Token: SeShutdownPrivilege	2972	mscorsvw.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeManageVolumePrivilege	3608	SearchIndexer.exe
Token: 33	3608	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3608	SearchIndexer.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: 33	2548	EhTray.exe
Token: SeIncBasePriorityPrivilege	2548	EhTray.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: SeShutdownPrivilege	2892	chrome.exe
Token: 33	3296	wmpnetwk.exe
Token: SeIncBasePriorityPrivilege	3296	wmpnetwk.exe
Token: SeDebugPrivilege	2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
Token: SeDebugPrivilege	2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
Token: SeDebugPrivilege	2276	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2892	chrome.exe
2892	chrome.exe
2892	chrome.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
3108	SearchProtocolHost.exe
3108	SearchProtocolHost.exe
3108	SearchProtocolHost.exe
3108	SearchProtocolHost.exe
3108	SearchProtocolHost.exe
3108	SearchProtocolHost.exe
3108	SearchProtocolHost.exe
3108	SearchProtocolHost.exe
3108	SearchProtocolHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 332 wrote to memory of 2276	332	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe	30
PID 332 wrote to memory of 2276	332	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe	30
PID 332 wrote to memory of 2276	332	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe	30
PID 332 wrote to memory of 2892	332	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe	31
PID 332 wrote to memory of 2892	332	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe	31
PID 332 wrote to memory of 2892	332	2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe	31
PID 2892 wrote to memory of 2816	2892	chrome.exe	32
PID 2892 wrote to memory of 2816	2892	chrome.exe	32
PID 2892 wrote to memory of 2816	2892	chrome.exe	32
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 576	2892	chrome.exe	39
PID 2892 wrote to memory of 1848	2892	chrome.exe	40
PID 2892 wrote to memory of 1848	2892	chrome.exe	40
PID 2892 wrote to memory of 1848	2892	chrome.exe	40
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41
PID 2892 wrote to memory of 476	2892	chrome.exe	41

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:332
- C:\Users\Admin\AppData\Local\Temp\2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe
  C:\Users\Admin\AppData\Local\Temp\2024-09-09_2e2b567671fb86b7e5ebc9a1d0c47f60_cobalt-strike_ryuk.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=109.0.5414.120 --initial-client-data=0x178,0x17c,0x180,0x174,0x184,0x140431148,0x140431158,0x140431168
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7879758,0x7fef7879768,0x7fef7879778
    3⤵
    PID:2816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:2
    3⤵
    PID:576
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1468 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:8
    3⤵
    PID:1848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:8
    3⤵
    PID:476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:1
    3⤵
    PID:996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:1
    3⤵
    PID:448
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2772 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:2
    3⤵
    PID:2616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2872 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:1
    3⤵
    PID:1040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3328 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:8
    3⤵
    PID:1864
- - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
    3⤵
    PID:3016
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f817688,0x13f817698,0x13f8176a8
      4⤵
      PID:1904
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
      4⤵
      PID:3148
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f817688,0x13f817698,0x13f8176a8
        5⤵
        
        PID:3176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4012 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:8
    3⤵
    PID:3384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:8
    3⤵
    PID:760
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3104 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:8
    3⤵
    PID:4012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3944 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:8
    3⤵
    PID:3324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4072 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:8
    3⤵
    PID:3556
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1524 --field-trial-handle=1380,i,14260797710050035222,3915025014181763134,131072 /prefetch:1
    3⤵
    PID:2292

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2160

C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1780

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3136
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 258 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 260 -NGENProcess 238 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2224
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 268 -NGENProcess 23c -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3428
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 268 -NGENProcess 260 -Pipe 1ec -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3852
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 270 -NGENProcess 23c -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2932
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 1d4 -NGENProcess 254 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d4 -InterruptEvent 274 -NGENProcess 268 -Pipe 240 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 238 -NGENProcess 250 -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 24c -NGENProcess 268 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3868
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 268 -NGENProcess 1d0 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3664
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 23c -NGENProcess 280 -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3276
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 254 -NGENProcess 26c -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 288 -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3916
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 270 -NGENProcess 268 -Pipe 1d4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3572
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 254 -NGENProcess 294 -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 298 -NGENProcess 268 -Pipe 23c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4012
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2a0 -NGENProcess 288 -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a8 -NGENProcess 274 -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2520
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2ac -NGENProcess 270 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3268
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ac -InterruptEvent 2b4 -NGENProcess 288 -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3984
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 290 -NGENProcess 280 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3380
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 220 -NGENProcess 24c -Pipe 1e4 -Comment "NGen Worker Process"
  2⤵
  PID:2292
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 2c0 -NGENProcess 290 -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  PID:1592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 268 -NGENProcess 2c8 -Pipe 220 -Comment "NGen Worker Process"
  2⤵
  PID:1620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 2cc -NGENProcess 290 -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  PID:3832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2c4 -NGENProcess 2d0 -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 288 -NGENProcess 2d0 -Pipe 254 -Comment "NGen Worker Process"
  2⤵
  PID:2332
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2c0 -NGENProcess 2ec -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  PID:2320
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2a8 -NGENProcess 2ec -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  PID:3360
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2ec -NGENProcess 2e8 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:3636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2e8 -NGENProcess 2e0 -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  PID:1684
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2dc -NGENProcess 2fc -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:636
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2d0 -NGENProcess 288 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:3468
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2e0 -NGENProcess 300 -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:3836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 300 -NGENProcess 2fc -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 2e8 -NGENProcess 308 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:2632
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 308 -NGENProcess 2d0 -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:2832
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 310 -NGENProcess 300 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:2988
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 300 -NGENProcess 2e8 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:1052
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 2dc -NGENProcess 31c -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:1516
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 31c -NGENProcess 2d0 -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  PID:3708
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 324 -NGENProcess 1cc -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  PID:3364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 1cc -NGENProcess 2dc -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:2544
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 31c -NGENProcess 330 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:2228
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 2d0 -NGENProcess 308 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:1724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 334 -NGENProcess 330 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  PID:3236
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 330 -NGENProcess 320 -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  PID:3772
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 2d0 -NGENProcess 340 -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 308 -NGENProcess 344 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:3452
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 348 -NGENProcess 340 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:2088
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 31c -NGENProcess 34c -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:2976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 31c -NGENProcess 1cc -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:3600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 304 -NGENProcess 344 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:3992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 318 -NGENProcess 34c -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:3884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 34c -NGENProcess 35c -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:3640
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 330 -NGENProcess 360 -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:3264
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 360 -NGENProcess 358 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:576
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 290 -NGENProcess 368 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:1480
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 344 -NGENProcess 364 -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 320 -NGENProcess 34c -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:2188
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 360 -NGENProcess 290 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 370 -NGENProcess 2d0 -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:2120
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 2d0 -NGENProcess 320 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  PID:3600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 37c -NGENProcess 36c -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:704
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 370 -NGENProcess 34c -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  PID:2992
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 360 -NGENProcess 328 -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:3912
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 360 -InterruptEvent 320 -NGENProcess 34c -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:532
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 354 -NGENProcess 388 -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:3476
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 354 -NGENProcess 384 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:3924
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 36c -NGENProcess 390 -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 394 -NGENProcess 384 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:3840
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 39c -NGENProcess 374 -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:3060

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3508
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1d0 -Comment "NGen Worker Process"
  2⤵
  - Executes dropped EXE
  PID:3660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 1e0 -NGENProcess 204 -Pipe 1f4 -Comment "NGen Worker Process"
  2⤵
  PID:3132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1e0 -InterruptEvent 24c -NGENProcess 244 -Pipe 248 -Comment "NGen Worker Process"
  2⤵
  PID:3136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 250 -NGENProcess 1d8 -Pipe 22c -Comment "NGen Worker Process"
  2⤵
  PID:3856
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 254 -NGENProcess 204 -Pipe 224 -Comment "NGen Worker Process"
  2⤵
  PID:680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 258 -NGENProcess 244 -Pipe 1ac -Comment "NGen Worker Process"
  2⤵
  PID:3316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 244 -NGENProcess 250 -Pipe 228 -Comment "NGen Worker Process"
  2⤵
  PID:1052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 204 -NGENProcess 268 -Pipe 25c -Comment "NGen Worker Process"
  2⤵
  PID:2568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 258 -NGENProcess 26c -Pipe 264 -Comment "NGen Worker Process"
  2⤵
  PID:3668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 260 -NGENProcess 268 -Pipe 1e0 -Comment "NGen Worker Process"
  2⤵
  PID:1964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 268 -NGENProcess 1f0 -Pipe 204 -Comment "NGen Worker Process"
  2⤵
  PID:576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 278 -NGENProcess 26c -Pipe 274 -Comment "NGen Worker Process"
  2⤵
  PID:1936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 260 -NGENProcess 280 -Pipe 268 -Comment "NGen Worker Process"
  2⤵
  PID:3760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 24c -NGENProcess 26c -Pipe 270 -Comment "NGen Worker Process"
  2⤵
  PID:3136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 26c -NGENProcess 27c -Pipe 278 -Comment "NGen Worker Process"
  2⤵
  PID:3320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 244 -NGENProcess 1d8 -Pipe 290 -Comment "NGen Worker Process"
  2⤵
  PID:680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1d8 -NGENProcess 284 -Pipe 28c -Comment "NGen Worker Process"
  2⤵
  PID:3948
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d8 -InterruptEvent 294 -NGENProcess 27c -Pipe 250 -Comment "NGen Worker Process"
  2⤵
  PID:2024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 27c -NGENProcess 244 -Pipe 26c -Comment "NGen Worker Process"
  2⤵
  PID:2948
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2a4 -NGENProcess 24c -Pipe 2a0 -Comment "NGen Worker Process"
  2⤵
  PID:1372
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 298 -NGENProcess 24c -Pipe 2a8 -Comment "NGen Worker Process"
  2⤵
  PID:3444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 258 -NGENProcess 2ac -Pipe 29c -Comment "NGen Worker Process"
  2⤵
  PID:796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 1f0 -NGENProcess 2ac -Pipe 2b0 -Comment "NGen Worker Process"
  2⤵
  PID:2912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 2b8 -NGENProcess 2b4 -Pipe 284 -Comment "NGen Worker Process"
  2⤵
  PID:3820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 2c0 -NGENProcess 2b8 -Pipe 288 -Comment "NGen Worker Process"
  2⤵
  PID:3992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 260 -NGENProcess 2a4 -Pipe 258 -Comment "NGen Worker Process"
  2⤵
  PID:3884
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 24c -NGENProcess 2c8 -Pipe 1d8 -Comment "NGen Worker Process"
  2⤵
  PID:776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 2cc -NGENProcess 2a4 -Pipe 2ac -Comment "NGen Worker Process"
  2⤵
  PID:1960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2a4 -NGENProcess 2c4 -Pipe 2b8 -Comment "NGen Worker Process"
  2⤵
  PID:2000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 2dc -NGENProcess 2b4 -Pipe 2d8 -Comment "NGen Worker Process"
  2⤵
  PID:3504
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 27c -NGENProcess 2b4 -Pipe 2e0 -Comment "NGen Worker Process"
  2⤵
  PID:4036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 2bc -NGENProcess 2e4 -Pipe 2d4 -Comment "NGen Worker Process"
  2⤵
  PID:3756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 1f0 -NGENProcess 27c -Pipe 2c8 -Comment "NGen Worker Process"
  2⤵
  PID:356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1f0 -NGENProcess 280 -Pipe 298 -Comment "NGen Worker Process"
  2⤵
  PID:3068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 280 -NGENProcess 2c0 -Pipe 2b4 -Comment "NGen Worker Process"
  2⤵
  PID:3956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2a4 -NGENProcess 27c -Pipe 2bc -Comment "NGen Worker Process"
  2⤵
  PID:3700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1f0 -InterruptEvent 24c -NGENProcess 2cc -Pipe 27c -Comment "NGen Worker Process"
  2⤵
  PID:3320
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2d0 -NGENProcess 2c0 -Pipe 1f0 -Comment "NGen Worker Process"
  2⤵
  PID:3908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 244 -NGENProcess 2cc -Pipe 2a4 -Comment "NGen Worker Process"
  2⤵
  PID:3468
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 244 -NGENProcess 2d0 -Pipe 280 -Comment "NGen Worker Process"
  2⤵
  PID:236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 260 -NGENProcess 2ec -Pipe 2e8 -Comment "NGen Worker Process"
  2⤵
  PID:3052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 2c4 -NGENProcess 2d0 -Pipe 2c0 -Comment "NGen Worker Process"
  2⤵
  PID:1804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 24c -NGENProcess 2f4 -Pipe 260 -Comment "NGen Worker Process"
  2⤵
  PID:3396
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 2f4 -NGENProcess 244 -Pipe 2d0 -Comment "NGen Worker Process"
  2⤵
  PID:3408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 2c4 -Pipe 2dc -Comment "NGen Worker Process"
  2⤵
  PID:4056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2c4 -NGENProcess 24c -Pipe 294 -Comment "NGen Worker Process"
  2⤵
  PID:3356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 304 -NGENProcess 244 -Pipe 300 -Comment "NGen Worker Process"
  2⤵
  PID:3632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2ec -Pipe 2f0 -Comment "NGen Worker Process"
  2⤵
  PID:1944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2f4 -NGENProcess 310 -Pipe 304 -Comment "NGen Worker Process"
  2⤵
  PID:2236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2fc -NGENProcess 2ec -Pipe 2cc -Comment "NGen Worker Process"
  2⤵
  PID:796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 318 -NGENProcess 308 -Pipe 314 -Comment "NGen Worker Process"
  2⤵
  PID:3776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 320 -NGENProcess 244 -Pipe 31c -Comment "NGen Worker Process"
  2⤵
  PID:4044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 328 -NGENProcess 2c4 -Pipe 324 -Comment "NGen Worker Process"
  2⤵
  PID:236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 330 -NGENProcess 310 -Pipe 32c -Comment "NGen Worker Process"
  2⤵
  PID:2620
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 338 -NGENProcess 2ec -Pipe 334 -Comment "NGen Worker Process"
  2⤵
  PID:3316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 328 -NGENProcess 340 -Pipe 330 -Comment "NGen Worker Process"
  2⤵
  PID:3520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 344 -NGENProcess 2ec -Pipe 2e4 -Comment "NGen Worker Process"
  2⤵
  PID:1052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2f8 -NGENProcess 320 -Pipe 2fc -Comment "NGen Worker Process"
  2⤵
  PID:3408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 318 -NGENProcess 348 -Pipe 2f4 -Comment "NGen Worker Process"
  2⤵
  PID:2188
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 310 -NGENProcess 320 -Pipe 33c -Comment "NGen Worker Process"
  2⤵
  PID:1448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 320 -NGENProcess 24c -Pipe 2ec -Comment "NGen Worker Process"
  2⤵
  PID:2004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 34c -NGENProcess 344 -Pipe 308 -Comment "NGen Worker Process"
  2⤵
  PID:1108
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 244 -NGENProcess 310 -Pipe 34c -Comment "NGen Worker Process"
  2⤵
  PID:3448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 30c -NGENProcess 344 -Pipe 2f8 -Comment "NGen Worker Process"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2c4 -NGENProcess 320 -Pipe 338 -Comment "NGen Worker Process"
  2⤵
  PID:3964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 350 -NGENProcess 24c -Pipe 348 -Comment "NGen Worker Process"
  2⤵
  PID:3128
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 358 -NGENProcess 344 -Pipe 354 -Comment "NGen Worker Process"
  2⤵
  PID:1724
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 318 -NGENProcess 2c4 -Pipe 340 -Comment "NGen Worker Process"
  2⤵
  PID:3348
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 318 -NGENProcess 350 -Pipe 358 -Comment "NGen Worker Process"
  2⤵
  PID:3136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 350 -NGENProcess 30c -Pipe 2c4 -Comment "NGen Worker Process"
  2⤵
  PID:592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 368 -NGENProcess 360 -Pipe 364 -Comment "NGen Worker Process"
  2⤵
  PID:3552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 35c -Pipe 328 -Comment "NGen Worker Process"
  2⤵
  PID:4036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 36c -NGENProcess 368 -Pipe 30c -Comment "NGen Worker Process"
  2⤵
  PID:3324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 368 -NGENProcess 318 -Pipe 374 -Comment "NGen Worker Process"
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 378 -NGENProcess 344 -Pipe 310 -Comment "NGen Worker Process"
  2⤵
  PID:3440
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 378 -InterruptEvent 380 -NGENProcess 350 -Pipe 37c -Comment "NGen Worker Process"
  2⤵
  PID:3820
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 388 -NGENProcess 244 -Pipe 384 -Comment "NGen Worker Process"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 390 -NGENProcess 24c -Pipe 38c -Comment "NGen Worker Process"
  2⤵
  PID:3044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 380 -NGENProcess 398 -Pipe 388 -Comment "NGen Worker Process"
  2⤵
  PID:600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 380 -InterruptEvent 39c -NGENProcess 24c -Pipe 360 -Comment "NGen Worker Process"
  2⤵
  PID:3964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a4 -NGENProcess 244 -Pipe 3a0 -Comment "NGen Worker Process"
  2⤵
  PID:2932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 3a4 -NGENProcess 344 -Pipe 368 -Comment "NGen Worker Process"
  2⤵
  PID:1804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 394 -NGENProcess 318 -Pipe 378 -Comment "NGen Worker Process"
  2⤵
  PID:3052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 244 -Pipe 344 -Comment "NGen Worker Process"
  2⤵
  PID:936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 350 -NGENProcess 380 -Pipe 36c -Comment "NGen Worker Process"
  2⤵
  PID:1964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 390 -NGENProcess 3a4 -Pipe 35c -Comment "NGen Worker Process"
  2⤵
  PID:2188
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 3ac -NGENProcess 39c -Pipe 3a8 -Comment "NGen Worker Process"
  2⤵
  PID:1956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 350 -NGENProcess 3b4 -Pipe 390 -Comment "NGen Worker Process"
  2⤵
  PID:4040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 3b8 -NGENProcess 39c -Pipe 320 -Comment "NGen Worker Process"
  2⤵
  PID:2068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3bc -NGENProcess 3a4 -Pipe 380 -Comment "NGen Worker Process"
  2⤵
  PID:2604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3c0 -NGENProcess 3b4 -Pipe 3ac -Comment "NGen Worker Process"
  2⤵
  PID:1864
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3b8 -NGENProcess 3c8 -Pipe 3bc -Comment "NGen Worker Process"
  2⤵
  PID:3384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 398 -NGENProcess 3b4 -Pipe 3cc -Comment "NGen Worker Process"
  2⤵
  PID:3440
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 24c -NGENProcess 318 -Pipe 244 -Comment "NGen Worker Process"
  2⤵
  PID:3972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3b8 -NGENProcess 3d4 -Pipe 398 -Comment "NGen Worker Process"
  2⤵
  PID:2976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3a4 -NGENProcess 318 -Pipe 39c -Comment "NGen Worker Process"
  2⤵
  PID:1276
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3dc -NGENProcess 24c -Pipe 3d8 -Comment "NGen Worker Process"
  2⤵
  PID:2520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3e4 -NGENProcess 3b4 -Pipe 3e0 -Comment "NGen Worker Process"
  2⤵
  PID:2016
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3ec -NGENProcess 370 -Pipe 3e8 -Comment "NGen Worker Process"
  2⤵
  PID:912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f4 -NGENProcess 3d4 -Pipe 3f0 -Comment "NGen Worker Process"
  2⤵
  PID:1960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f4 -NGENProcess 3f8 -Pipe 394 -Comment "NGen Worker Process"
  2⤵
  PID:2568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3b8 -NGENProcess 3d0 -Pipe 3c4 -Comment "NGen Worker Process"
  2⤵
  PID:1860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3c8 -NGENProcess 318 -Pipe 3b0 -Comment "NGen Worker Process"
  2⤵
  PID:776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3a4 -NGENProcess 3fc -Pipe 3d0 -Comment "NGen Worker Process"
  2⤵
  PID:1436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 350 -NGENProcess 3ec -Pipe 3f8 -Comment "NGen Worker Process"
  2⤵
  PID:3164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 3b8 -NGENProcess 3fc -Pipe 318 -Comment "NGen Worker Process"
  2⤵
  PID:3172
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 24c -NGENProcess 3e4 -Pipe 350 -Comment "NGen Worker Process"
  2⤵
  PID:2096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 3e4 -NGENProcess 3a4 -Pipe 3fc -Comment "NGen Worker Process"
  2⤵
  PID:3552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 3c8 -NGENProcess 370 -Pipe 3ec -Comment "NGen Worker Process"
  2⤵
  PID:2992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 370 -NGENProcess 3d4 -Pipe 3dc -Comment "NGen Worker Process"
  2⤵
  PID:3668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 408 -NGENProcess 3b8 -Pipe 3b4 -Comment "NGen Worker Process"
  2⤵
  PID:2772
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3a4 -InterruptEvent 3c8 -NGENProcess 40c -Pipe 370 -Comment "NGen Worker Process"
  2⤵
  PID:3920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 3c0 -NGENProcess 410 -Pipe 3a4 -Comment "NGen Worker Process"
  2⤵
  PID:1884
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3b8 -NGENProcess 414 -Pipe 24c -Comment "NGen Worker Process"
  2⤵
  PID:2912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 418 -NGENProcess 410 -Pipe 3d4 -Comment "NGen Worker Process"
  2⤵
  PID:3464
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 420 -NGENProcess 3c8 -Pipe 41c -Comment "NGen Worker Process"
  2⤵
  PID:2444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 40c -NGENProcess 3e4 -Pipe 428 -Comment "NGen Worker Process"
  2⤵
  PID:2516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 410 -NGENProcess 424 -Pipe 3c0 -Comment "NGen Worker Process"
  2⤵
  PID:3040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 404 -NGENProcess 418 -Pipe 414 -Comment "NGen Worker Process"
  2⤵
  PID:3776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 430 -NGENProcess 3c8 -Pipe 42c -Comment "NGen Worker Process"
  2⤵
  PID:576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 438 -NGENProcess 3f4 -Pipe 434 -Comment "NGen Worker Process"
  2⤵
  PID:2592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 440 -NGENProcess 3e4 -Pipe 43c -Comment "NGen Worker Process"
  2⤵
  PID:1924
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 448 -NGENProcess 424 -Pipe 444 -Comment "NGen Worker Process"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 424 -NGENProcess 418 -Pipe 450 -Comment "NGen Worker Process"
  2⤵
  PID:3444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 454 -NGENProcess 44c -Pipe 420 -Comment "NGen Worker Process"
  2⤵
  PID:3672
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 45c -NGENProcess 3e4 -Pipe 458 -Comment "NGen Worker Process"
  2⤵
  PID:3932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 408 -NGENProcess 464 -Pipe 454 -Comment "NGen Worker Process"
  2⤵
  PID:3964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 468 -NGENProcess 408 -Pipe 40c -Comment "NGen Worker Process"
  2⤵
  PID:2968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 418 -NGENProcess 3c8 -Pipe 440 -Comment "NGen Worker Process"
  2⤵
  PID:3356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 3e4 -NGENProcess 430 -Pipe 3b8 -Comment "NGen Worker Process"
  2⤵
  PID:3644
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 464 -InterruptEvent 424 -NGENProcess 448 -Pipe 3c8 -Comment "NGen Worker Process"
  2⤵
  PID:2056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 460 -InterruptEvent 424 -NGENProcess 464 -Pipe 418 -Comment "NGen Worker Process"
  2⤵
  PID:1744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 3f4 -NGENProcess 448 -Pipe 430 -Comment "NGen Worker Process"
  2⤵
  PID:1480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 424 -NGENProcess 410 -Pipe 448 -Comment "NGen Worker Process"
  2⤵
  PID:3316
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 438 -NGENProcess 44c -Pipe 464 -Comment "NGen Worker Process"
  2⤵
  PID:2624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 424 -NGENProcess 404 -Pipe 45c -Comment "NGen Worker Process"
  2⤵
  PID:3600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 470 -NGENProcess 3e4 -Pipe 460 -Comment "NGen Worker Process"
  2⤵
  PID:1716
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 438 -NGENProcess 478 -Pipe 424 -Comment "NGen Worker Process"
  2⤵
  PID:600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 47c -NGENProcess 3e4 -Pipe 46c -Comment "NGen Worker Process"
  2⤵
  PID:2848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 480 -NGENProcess 404 -Pipe 44c -Comment "NGen Worker Process"
  2⤵
  PID:912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 488 -NGENProcess 478 -Pipe 484 -Comment "NGen Worker Process"
  2⤵
  PID:876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 48c -NGENProcess 410 -Pipe 474 -Comment "NGen Worker Process"
  2⤵
  PID:1788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 48c -NGENProcess 408 -Pipe 488 -Comment "NGen Worker Process"
  2⤵
  PID:4040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 438 -NGENProcess 3e4 -Pipe 468 -Comment "NGen Worker Process"
  2⤵
  PID:2444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 470 -NGENProcess 408 -Pipe 490 -Comment "NGen Worker Process"
  2⤵
  PID:2324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 498 -NGENProcess 3f4 -Pipe 494 -Comment "NGen Worker Process"
  2⤵
  PID:3948
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 470 -NGENProcess 480 -Pipe 404 -Comment "NGen Worker Process"
  2⤵
  PID:3136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 49c -NGENProcess 4a4 -Pipe 470 -Comment "NGen Worker Process"
  2⤵
  PID:4000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 4a4 -NGENProcess 4a0 -Pipe 498 -Comment "NGen Worker Process"
  2⤵
  PID:1924
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a4 -InterruptEvent 4a8 -NGENProcess 408 -Pipe 3f4 -Comment "NGen Worker Process"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4b0 -NGENProcess 3e4 -Pipe 4ac -Comment "NGen Worker Process"
  2⤵
  PID:3924
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4b8 -NGENProcess 47c -Pipe 4b4 -Comment "NGen Worker Process"
  2⤵
  PID:3920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b8 -InterruptEvent 4bc -NGENProcess 4a8 -Pipe 478 -Comment "NGen Worker Process"
  2⤵
  PID:1036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 4a8 -NGENProcess 438 -Pipe 47c -Comment "NGen Worker Process"
  2⤵
  PID:2732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 4a8 -NGENProcess 4b0 -Pipe 48c -Comment "NGen Worker Process"
  2⤵
  PID:3052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 480 -NGENProcess 408 -Pipe 410 -Comment "NGen Worker Process"
  2⤵
  PID:2932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 4c0 -NGENProcess 4b8 -Pipe 3e4 -Comment "NGen Worker Process"
  2⤵
  PID:3060
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4b8 -NGENProcess 49c -Pipe 4c4 -Comment "NGen Worker Process"
  2⤵
  PID:2028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b8 -InterruptEvent 49c -NGENProcess 4a8 -Pipe 4b0 -Comment "NGen Worker Process"
  2⤵
  PID:3808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 4c8 -NGENProcess 480 -Pipe 4a4 -Comment "NGen Worker Process"
  2⤵
  PID:4004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 4d0 -NGENProcess 4bc -Pipe 4cc -Comment "NGen Worker Process"
  2⤵
  PID:828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4bc -NGENProcess 49c -Pipe 438 -Comment "NGen Worker Process"
  2⤵
  PID:3004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 4dc -NGENProcess 480 -Pipe 4d8 -Comment "NGen Worker Process"
  2⤵
  PID:356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4e4 -NGENProcess 4dc -Pipe 4a0 -Comment "NGen Worker Process"
  2⤵
  PID:704
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e4 -InterruptEvent 4a8 -NGENProcess 4d0 -Pipe 4d4 -Comment "NGen Worker Process"
  2⤵
  PID:1908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 4c0 -NGENProcess 4ec -Pipe 4e4 -Comment "NGen Worker Process"
  2⤵
  PID:636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4f0 -NGENProcess 4d0 -Pipe 49c -Comment "NGen Worker Process"
  2⤵
  PID:2040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f0 -InterruptEvent 4d0 -NGENProcess 408 -Pipe 4f8 -Comment "NGen Worker Process"
  2⤵
  PID:912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4fc -NGENProcess 4f4 -Pipe 4e0 -Comment "NGen Worker Process"
  2⤵
  PID:2444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4fc -InterruptEvent 504 -NGENProcess 4ec -Pipe 500 -Comment "NGen Worker Process"
  2⤵
  PID:2752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4fc -InterruptEvent 4b8 -NGENProcess 4d0 -Pipe 480 -Comment "NGen Worker Process"
  2⤵
  PID:3552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b8 -InterruptEvent 408 -NGENProcess 504 -Pipe 4f4 -Comment "NGen Worker Process"
  2⤵
  PID:1944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 510 -NGENProcess 508 -Pipe 4a8 -Comment "NGen Worker Process"
  2⤵
  PID:3236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 4b8 -NGENProcess 518 -Pipe 408 -Comment "NGen Worker Process"
  2⤵
  PID:2668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4b8 -InterruptEvent 51c -NGENProcess 508 -Pipe 4ec -Comment "NGen Worker Process"
  2⤵
  PID:3380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 524 -NGENProcess 504 -Pipe 520 -Comment "NGen Worker Process"
  2⤵
  PID:3172
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 524 -NGENProcess 4bc -Pipe 4b8 -Comment "NGen Worker Process"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 518 -NGENProcess 51c -Pipe 508 -Comment "NGen Worker Process"
  2⤵
  PID:4040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 4f0 -NGENProcess 518 -Pipe 4e8 -Comment "NGen Worker Process"
  2⤵
  PID:3916
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 4f0 -NGENProcess 50c -Pipe 52c -Comment "NGen Worker Process"
  2⤵
  PID:4052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 518 -InterruptEvent 4c0 -NGENProcess 4c8 -Pipe 528 -Comment "NGen Worker Process"
  2⤵
  PID:600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4d0 -NGENProcess 51c -Pipe 524 -Comment "NGen Worker Process"
  2⤵
  PID:888
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 530 -NGENProcess 4d0 -Pipe 4bc -Comment "NGen Worker Process"
  2⤵
  PID:3968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 514 -NGENProcess 518 -Pipe 4c8 -Comment "NGen Worker Process"
  2⤵
  PID:3964
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f0 -InterruptEvent 510 -NGENProcess 504 -Pipe 530 -Comment "NGen Worker Process"
  2⤵
  PID:3496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 51c -NGENProcess 518 -Pipe 4fc -Comment "NGen Worker Process"
  2⤵
  PID:3076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 538 -NGENProcess 514 -Pipe 534 -Comment "NGen Worker Process"
  2⤵
  PID:3444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 53c -NGENProcess 4d0 -Pipe 50c -Comment "NGen Worker Process"
  2⤵
  PID:3912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 51c -NGENProcess 544 -Pipe 538 -Comment "NGen Worker Process"
  2⤵
  PID:3052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4f0 -InterruptEvent 51c -NGENProcess 540 -Pipe 4d0 -Comment "NGen Worker Process"
  2⤵
  PID:2024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 510 -NGENProcess 548 -Pipe 4f0 -Comment "NGen Worker Process"
  2⤵
  PID:760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 514 -NGENProcess 540 -Pipe 53c -Comment "NGen Worker Process"
  2⤵
  PID:3560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 550 -NGENProcess 51c -Pipe 54c -Comment "NGen Worker Process"
  2⤵
  PID:1776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 550 -InterruptEvent 558 -NGENProcess 518 -Pipe 554 -Comment "NGen Worker Process"
  2⤵
  PID:2852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 514 -NGENProcess 560 -Pipe 550 -Comment "NGen Worker Process"
  2⤵
  PID:2568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 564 -NGENProcess 518 -Pipe 4dc -Comment "NGen Worker Process"
  2⤵
  PID:776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 544 -NGENProcess 510 -Pipe 568 -Comment "NGen Worker Process"
  2⤵
  PID:4044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 544 -NGENProcess 55c -Pipe 4c0 -Comment "NGen Worker Process"
  2⤵
  PID:1448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 558 -NGENProcess 510 -Pipe 518 -Comment "NGen Worker Process"
  2⤵
  PID:3356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 570 -NGENProcess 51c -Pipe 540 -Comment "NGen Worker Process"
  2⤵
  PID:1760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 578 -NGENProcess 514 -Pipe 574 -Comment "NGen Worker Process"
  2⤵
  PID:588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 57c -NGENProcess 56c -Pipe 564 -Comment "NGen Worker Process"
  2⤵
  PID:4000
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 548 -NGENProcess 504 -Pipe 57c -Comment "NGen Worker Process"
  2⤵
  PID:3280
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 55c -NGENProcess 51c -Pipe 56c -Comment "NGen Worker Process"
  2⤵
  PID:3872
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 544 -NGENProcess 560 -Pipe 514 -Comment "NGen Worker Process"
  2⤵
  PID:2732
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 588 -NGENProcess 570 -Pipe 510 -Comment "NGen Worker Process"
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 588 -InterruptEvent 570 -NGENProcess 590 -Pipe 584 -Comment "NGen Worker Process"
  2⤵
  PID:3960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 51c -NGENProcess 55c -Pipe 560 -Comment "NGen Worker Process"
  2⤵
  PID:2868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 594 -NGENProcess 58c -Pipe 580 -Comment "NGen Worker Process"
  2⤵
  PID:2852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 594 -InterruptEvent 504 -NGENProcess 544 -Pipe 590 -Comment "NGen Worker Process"
  2⤵
  PID:3660
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 504 -NGENProcess 594 -Pipe 548 -Comment "NGen Worker Process"
  2⤵
  PID:3520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 504 -InterruptEvent 578 -NGENProcess 544 -Pipe 588 -Comment "NGen Worker Process"
  2⤵
  PID:876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 544 -NGENProcess 558 -Pipe 5a0 -Comment "NGen Worker Process"
  2⤵
  PID:4056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 5a4 -NGENProcess 55c -Pipe 59c -Comment "NGen Worker Process"
  2⤵
  PID:3600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 5ac -NGENProcess 570 -Pipe 5a8 -Comment "NGen Worker Process"
  2⤵
  PID:3920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5ac -InterruptEvent 5a4 -NGENProcess 598 -Pipe 570 -Comment "NGen Worker Process"
  2⤵
  PID:2020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 504 -InterruptEvent 594 -NGENProcess 558 -Pipe 5ac -Comment "NGen Worker Process"
  2⤵
  PID:4040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 5b0 -NGENProcess 5b4 -Pipe 504 -Comment "NGen Worker Process"
  2⤵
  PID:2744
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b0 -InterruptEvent 5b8 -NGENProcess 558 -Pipe 58c -Comment "NGen Worker Process"
  2⤵
  PID:2968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b8 -InterruptEvent 5c0 -NGENProcess 5a4 -Pipe 5bc -Comment "NGen Worker Process"
  2⤵
  PID:2976
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 5c8 -NGENProcess 544 -Pipe 5c4 -Comment "NGen Worker Process"
  2⤵
  PID:2260
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 5c8 -NGENProcess 594 -Pipe 51c -Comment "NGen Worker Process"
  2⤵
  PID:2568
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c8 -InterruptEvent 558 -NGENProcess 5b8 -Pipe 5a4 -Comment "NGen Worker Process"
  2⤵
  PID:2548
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 5d4 -NGENProcess 5cc -Pipe 55c -Comment "NGen Worker Process"
  2⤵
  PID:3476
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d4 -InterruptEvent 5dc -NGENProcess 5d0 -Pipe 5d8 -Comment "NGen Worker Process"
  2⤵
  PID:3360
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5dc -InterruptEvent 5e0 -NGENProcess 5b0 -Pipe 5b4 -Comment "NGen Worker Process"
  2⤵
  PID:3520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5e0 -InterruptEvent 5e8 -NGENProcess 5cc -Pipe 5e4 -Comment "NGen Worker Process"
  2⤵
  PID:3984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5e8 -InterruptEvent 5f0 -NGENProcess 594 -Pipe 5ec -Comment "NGen Worker Process"
  2⤵
  PID:1436
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5f0 -InterruptEvent 5f8 -NGENProcess 5c8 -Pipe 5f4 -Comment "NGen Worker Process"
  2⤵
  PID:4056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d0 -InterruptEvent 5fc -NGENProcess 5f8 -Pipe 578 -Comment "NGen Worker Process"
  2⤵
  PID:2648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5f8 -InterruptEvent 598 -NGENProcess 5d0 -Pipe 5e8 -Comment "NGen Worker Process"
  2⤵
  PID:3052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 5b8 -NGENProcess 5f0 -Pipe 594 -Comment "NGen Worker Process"
  2⤵
  PID:3896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c8 -InterruptEvent 5b8 -NGENProcess 598 -Pipe 5fc -Comment "NGen Worker Process"
  2⤵
  PID:3868
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b8 -InterruptEvent 5cc -NGENProcess 5f0 -Pipe 5c0 -Comment "NGen Worker Process"
  2⤵
  PID:1348
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 600 -InterruptEvent 5c8 -NGENProcess 604 -Pipe 5b8 -Comment "NGen Worker Process"
  2⤵
  PID:3972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5c8 -InterruptEvent 5e0 -NGENProcess 5f0 -Pipe 5d0 -Comment "NGen Worker Process"
  2⤵
  PID:3960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b0 -InterruptEvent 600 -NGENProcess 608 -Pipe 5c8 -Comment "NGen Worker Process"
  2⤵
  PID:2068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 600 -InterruptEvent 60c -NGENProcess 5f0 -Pipe 598 -Comment "NGen Worker Process"
  2⤵
  PID:2980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 610 -InterruptEvent 5b0 -NGENProcess 614 -Pipe 600 -Comment "NGen Worker Process"
  2⤵
  PID:4044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5d4 -InterruptEvent 5b0 -NGENProcess 610 -Pipe 5f0 -Comment "NGen Worker Process"
  2⤵
  PID:3380
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b0 -InterruptEvent 61c -NGENProcess 614 -Pipe 5e0 -Comment "NGen Worker Process"
  2⤵
  PID:4048
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 61c -InterruptEvent 624 -NGENProcess 60c -Pipe 620 -Comment "NGen Worker Process"
  2⤵
  PID:3636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 62c -NGENProcess 608 -Pipe 628 -Comment "NGen Worker Process"
  2⤵
  PID:3980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 62c -InterruptEvent 634 -NGENProcess 604 -Pipe 630 -Comment "NGen Worker Process"
  2⤵
  PID:3988
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 634 -InterruptEvent 63c -NGENProcess 610 -Pipe 638 -Comment "NGen Worker Process"
  2⤵
  PID:3068
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 63c -NGENProcess 634 -Pipe 614 -Comment "NGen Worker Process"
  2⤵
  PID:2668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 63c -InterruptEvent 648 -NGENProcess 610 -Pipe 5cc -Comment "NGen Worker Process"
  2⤵
  PID:2384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 64c -NGENProcess 604 -Pipe 608 -Comment "NGen Worker Process"
  2⤵
  PID:760
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 648 -InterruptEvent 5f8 -NGENProcess 63c -Pipe 634 -Comment "NGen Worker Process"
  2⤵
  PID:908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5f8 -InterruptEvent 624 -NGENProcess 64c -Pipe 610 -Comment "NGen Worker Process"
  2⤵
  PID:4032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 658 -NGENProcess 650 -Pipe 62c -Comment "NGen Worker Process"
  2⤵
  PID:3312
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 658 -InterruptEvent 65c -NGENProcess 60c -Pipe 604 -Comment "NGen Worker Process"
  2⤵
  PID:2188
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 664 -NGENProcess 64c -Pipe 660 -Comment "NGen Worker Process"
  2⤵
  PID:1956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 664 -InterruptEvent 668 -NGENProcess 544 -Pipe 63c -Comment "NGen Worker Process"
  2⤵
  PID:592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 668 -InterruptEvent 670 -NGENProcess 60c -Pipe 66c -Comment "NGen Worker Process"
  2⤵
  PID:1684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 670 -InterruptEvent 678 -NGENProcess 648 -Pipe 674 -Comment "NGen Worker Process"
  2⤵
  PID:1052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 680 -NGENProcess 624 -Pipe 67c -Comment "NGen Worker Process"
  2⤵
  PID:2996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 684 -NGENProcess 64c -Pipe 650 -Comment "NGen Worker Process"
  2⤵
  PID:1480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 618 -NGENProcess 678 -Pipe 648 -Comment "NGen Worker Process"
  2⤵
  PID:3656
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 618 -InterruptEvent 60c -NGENProcess 684 -Pipe 668 -Comment "NGen Worker Process"
  2⤵
  PID:3052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 60c -InterruptEvent 694 -NGENProcess 544 -Pipe 690 -Comment "NGen Worker Process"
  2⤵
  PID:3616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 69c -NGENProcess 64c -Pipe 698 -Comment "NGen Worker Process"
  2⤵
  PID:2408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 69c -InterruptEvent 6a4 -NGENProcess 688 -Pipe 6a0 -Comment "NGen Worker Process"
  2⤵
  PID:3828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a4 -InterruptEvent 6a8 -NGENProcess 678 -Pipe 624 -Comment "NGen Worker Process"
  2⤵
  PID:588
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a8 -InterruptEvent 6b0 -NGENProcess 64c -Pipe 6ac -Comment "NGen Worker Process"
  2⤵
  PID:2932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b0 -InterruptEvent 6b4 -NGENProcess 684 -Pipe 544 -Comment "NGen Worker Process"
  2⤵
  PID:600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b8 -InterruptEvent 6b4 -NGENProcess 6b0 -Pipe 678 -Comment "NGen Worker Process"
  2⤵
  PID:3136
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b4 -InterruptEvent 688 -NGENProcess 684 -Pipe 69c -Comment "NGen Worker Process"
  2⤵
  PID:3780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 688 -InterruptEvent 6c4 -NGENProcess 64c -Pipe 6c0 -Comment "NGen Worker Process"
  2⤵
  PID:2020
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c4 -InterruptEvent 6c8 -NGENProcess 6a8 -Pipe 60c -Comment "NGen Worker Process"
  2⤵
  PID:3404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 6d0 -NGENProcess 684 -Pipe 6cc -Comment "NGen Worker Process"
  2⤵
  PID:1036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6d0 -InterruptEvent 6d8 -NGENProcess 6bc -Pipe 6d4 -Comment "NGen Worker Process"
  2⤵
  PID:3680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 5b0 -InterruptEvent 640 -NGENProcess 5f8 -Pipe 61c -Comment "NGen Worker Process"
  2⤵
  PID:2624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 640 -InterruptEvent 6b8 -NGENProcess 6e0 -Pipe 5dc -Comment "NGen Worker Process"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b8 -InterruptEvent 65c -NGENProcess 5d4 -Pipe 658 -Comment "NGen Worker Process"
  2⤵
  PID:3464
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6dc -InterruptEvent 654 -NGENProcess 65c -Pipe 5b0 -Comment "NGen Worker Process"
  2⤵
  PID:776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6d8 -InterruptEvent 6b8 -NGENProcess 664 -Pipe 6dc -Comment "NGen Worker Process"
  2⤵
  PID:2440
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b8 -InterruptEvent 6c8 -NGENProcess 65c -Pipe 6e0 -Comment "NGen Worker Process"
  2⤵
  PID:2024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6c8 -InterruptEvent 64c -NGENProcess 6d0 -Pipe 6bc -Comment "NGen Worker Process"
  2⤵
  PID:1620
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 64c -NGENProcess 6c8 -Pipe 5f8 -Comment "NGen Worker Process"
  2⤵
  PID:3384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 64c -InterruptEvent 6b0 -NGENProcess 6d0 -Pipe 5d4 -Comment "NGen Worker Process"
  2⤵
  PID:2208
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 684 -NGENProcess 6e8 -Pipe 64c -Comment "NGen Worker Process"
  2⤵
  PID:3684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6d0 -InterruptEvent 618 -NGENProcess 680 -Pipe 6ec -Comment "NGen Worker Process"
  2⤵
  PID:3928
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 618 -InterruptEvent 654 -NGENProcess 664 -Pipe 6b0 -Comment "NGen Worker Process"
  2⤵
  PID:3256
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 654 -InterruptEvent 6f0 -NGENProcess 6e8 -Pipe 6b8 -Comment "NGen Worker Process"
  2⤵
  PID:2680
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6f0 -InterruptEvent 6f4 -NGENProcess 684 -Pipe 6c8 -Comment "NGen Worker Process"
  2⤵
  PID:3960
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6f4 -InterruptEvent 6fc -NGENProcess 664 -Pipe 6f8 -Comment "NGen Worker Process"
  2⤵
  PID:2980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 6b4 -NGENProcess 694 -Pipe 700 -Comment "NGen Worker Process"
  2⤵
  PID:3992
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b4 -InterruptEvent 6d0 -NGENProcess 680 -Pipe 654 -Comment "NGen Worker Process"
  2⤵
  PID:3244
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6b4 -InterruptEvent 688 -NGENProcess 6e4 -Pipe 664 -Comment "NGen Worker Process"
  2⤵
  PID:3756
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a8 -InterruptEvent 670 -NGENProcess 558 -Pipe 68c -Comment "NGen Worker Process"
  2⤵
  PID:2332
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 714 -InterruptEvent 6b4 -NGENProcess 558 -Pipe 6d8 -Comment "NGen Worker Process"
  2⤵
  PID:592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 618 -NGENProcess 710 -Pipe 714 -Comment "NGen Worker Process"
  2⤵
  PID:3664
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 618 -InterruptEvent 688 -NGENProcess 558 -Pipe 640 -Comment "NGen Worker Process"
  2⤵
  PID:3632
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6d0 -InterruptEvent 65c -NGENProcess 704 -Pipe 618 -Comment "NGen Worker Process"
  2⤵
  PID:3896
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 65c -InterruptEvent 6e4 -NGENProcess 558 -Pipe 670 -Comment "NGen Worker Process"
  2⤵
  PID:3692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 6d0 -NGENProcess 6f4 -Pipe 65c -Comment "NGen Worker Process"
  2⤵
  PID:2708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6d0 -InterruptEvent 6f0 -NGENProcess 558 -Pipe 688 -Comment "NGen Worker Process"
  2⤵
  PID:1276
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6f0 -InterruptEvent 558 -NGENProcess 6a8 -Pipe 70c -Comment "NGen Worker Process"
  2⤵
  PID:3892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 718 -NGENProcess 708 -Pipe 644 -Comment "NGen Worker Process"
  2⤵
  PID:776
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 718 -InterruptEvent 720 -NGENProcess 6f4 -Pipe 71c -Comment "NGen Worker Process"
  2⤵
  PID:1700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 724 -NGENProcess 704 -Pipe 6b4 -Comment "NGen Worker Process"
  2⤵
  PID:3496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 724 -InterruptEvent 72c -NGENProcess 708 -Pipe 728 -Comment "NGen Worker Process"
  2⤵
  PID:2228
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 72c -InterruptEvent 734 -NGENProcess 6d0 -Pipe 730 -Comment "NGen Worker Process"
  2⤵
  PID:4048
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 738 -InterruptEvent 724 -NGENProcess 73c -Pipe 72c -Comment "NGen Worker Process"
  2⤵
  PID:1740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6a8 -InterruptEvent 684 -NGENProcess 740 -Pipe 738 -Comment "NGen Worker Process"
  2⤵
  PID:1808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 744 -NGENProcess 73c -Pipe 704 -Comment "NGen Worker Process"
  2⤵
  PID:2040
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 744 -InterruptEvent 748 -NGENProcess 734 -Pipe 6f4 -Comment "NGen Worker Process"
  2⤵
  PID:3324
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 748 -InterruptEvent 750 -NGENProcess 740 -Pipe 74c -Comment "NGen Worker Process"
  2⤵
  PID:184
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 750 -InterruptEvent 758 -NGENProcess 708 -Pipe 754 -Comment "NGen Worker Process"
  2⤵
  PID:2392
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 760 -NGENProcess 6d0 -Pipe 75c -Comment "NGen Worker Process"
  2⤵
  PID:1944
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 760 -InterruptEvent 768 -NGENProcess 73c -Pipe 764 -Comment "NGen Worker Process"
  2⤵
  PID:3692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 76c -InterruptEvent 758 -NGENProcess 770 -Pipe 760 -Comment "NGen Worker Process"
  2⤵
  PID:2440
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 758 -InterruptEvent 774 -NGENProcess 73c -Pipe 724 -Comment "NGen Worker Process"
  2⤵
  PID:3700
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 774 -InterruptEvent 77c -NGENProcess 6d0 -Pipe 778 -Comment "NGen Worker Process"
  2⤵
  PID:1092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 77c -InterruptEvent 784 -NGENProcess 740 -Pipe 780 -Comment "NGen Worker Process"
  2⤵
  PID:2132
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 784 -InterruptEvent 78c -NGENProcess 768 -Pipe 788 -Comment "NGen Worker Process"
  2⤵
  PID:3216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 794 -NGENProcess 770 -Pipe 790 -Comment "NGen Worker Process"
  2⤵
  PID:3164
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 794 -InterruptEvent 79c -NGENProcess 73c -Pipe 798 -Comment "NGen Worker Process"
  2⤵
  PID:3112
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 79c -InterruptEvent 7a0 -NGENProcess 6d0 -Pipe 708 -Comment "NGen Worker Process"
  2⤵
  PID:1500
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 7a8 -NGENProcess 770 -Pipe 7a4 -Comment "NGen Worker Process"
  2⤵
  PID:2980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ac -InterruptEvent 7a8 -NGENProcess 7a0 -Pipe 740 -Comment "NGen Worker Process"
  2⤵
  PID:3560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7a8 -InterruptEvent 7b4 -NGENProcess 770 -Pipe 768 -Comment "NGen Worker Process"
  2⤵
  PID:3076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7b4 -InterruptEvent 7bc -NGENProcess 6d0 -Pipe 7b8 -Comment "NGen Worker Process"
  2⤵
  PID:2336
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7bc -InterruptEvent 7c4 -NGENProcess 190 -Pipe 7c0 -Comment "NGen Worker Process"
  2⤵
  PID:1980
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7c4 -InterruptEvent 7cc -NGENProcess 79c -Pipe 7c8 -Comment "NGen Worker Process"
  2⤵
  PID:4064
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d0 -InterruptEvent 7bc -NGENProcess 7d4 -Pipe 7c4 -Comment "NGen Worker Process"
  2⤵
  PID:3444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 73c -InterruptEvent 7a0 -NGENProcess 7d8 -Pipe 7d0 -Comment "NGen Worker Process"
  2⤵
  PID:784
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7a0 -InterruptEvent 7dc -NGENProcess 7d4 -Pipe 6d0 -Comment "NGen Worker Process"
  2⤵
  PID:4056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7dc -InterruptEvent 7e4 -NGENProcess 7cc -Pipe 7e0 -Comment "NGen Worker Process"
  2⤵
  PID:1604
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7e4 -InterruptEvent 7ec -NGENProcess 190 -Pipe 7e8 -Comment "NGen Worker Process"
  2⤵
  PID:1592
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 6f0 -NGENProcess 750 -Pipe 6a8 -Comment "NGen Worker Process"
  2⤵
  PID:3236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6f0 -InterruptEvent 7ec -NGENProcess 7bc -Pipe 7e4 -Comment "NGen Worker Process"
  2⤵
  PID:3552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 7f0 -NGENProcess 710 -Pipe 718 -Comment "NGen Worker Process"
  2⤵
  PID:3984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f0 -InterruptEvent 190 -NGENProcess 750 -Pipe 7dc -Comment "NGen Worker Process"
  2⤵
  PID:3384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 190 -InterruptEvent 748 -NGENProcess 720 -Pipe 710 -Comment "NGen Worker Process"
  2⤵
  PID:2984
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 748 -InterruptEvent 770 -NGENProcess 758 -Pipe 7bc -Comment "NGen Worker Process"
  2⤵
  PID:2648
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7cc -InterruptEvent 770 -NGENProcess 748 -Pipe 76c -Comment "NGen Worker Process"
  2⤵
  PID:936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 770 -InterruptEvent 7d8 -NGENProcess 758 -Pipe 6f0 -Comment "NGen Worker Process"
  2⤵
  PID:2384
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 7f4 -NGENProcess 720 -Pipe 7d4 -Comment "NGen Worker Process"
  2⤵
  PID:3692
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7d8 -InterruptEvent 77c -NGENProcess 770 -Pipe 774 -Comment "NGen Worker Process"
  2⤵
  PID:4044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 77c -InterruptEvent 684 -NGENProcess 7b0 -Pipe 794 -Comment "NGen Worker Process"
  2⤵
  PID:3372
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f8 -InterruptEvent 684 -NGENProcess 77c -Pipe 7f4 -Comment "NGen Worker Process"
  2⤵
  PID:236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 190 -NGENProcess 7b0 -Pipe 758 -Comment "NGen Worker Process"
  2⤵
  PID:3804
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 7f8 -NGENProcess 750 -Pipe 684 -Comment "NGen Worker Process"
  2⤵
  PID:912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f8 -InterruptEvent 804 -NGENProcess 7b0 -Pipe 7fc -Comment "NGen Worker Process"
  2⤵
  PID:3408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 808 -InterruptEvent 720 -NGENProcess 80c -Pipe 7f8 -Comment "NGen Worker Process"
  2⤵
  PID:3052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 720 -InterruptEvent 7ac -NGENProcess 7b0 -Pipe 190 -Comment "NGen Worker Process"
  2⤵
  PID:3772
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 810 -InterruptEvent 808 -NGENProcess 814 -Pipe 720 -Comment "NGen Worker Process"
  2⤵
  PID:2260
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 808 -InterruptEvent 818 -NGENProcess 7b0 -Pipe 748 -Comment "NGen Worker Process"
  2⤵
  PID:3636
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 818 -InterruptEvent 820 -NGENProcess 80c -Pipe 81c -Comment "NGen Worker Process"
  2⤵
  PID:3076
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 820 -InterruptEvent 824 -NGENProcess 808 -Pipe 558 -Comment "NGen Worker Process"
  2⤵
  PID:4044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 82c -InterruptEvent 750 -NGENProcess 828 -Pipe 820 -Comment "NGen Worker Process"
  2⤵
  PID:1092
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 750 -InterruptEvent 814 -NGENProcess 808 -Pipe 7ac -Comment "NGen Worker Process"
  2⤵
  PID:1616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 814 -InterruptEvent 834 -NGENProcess 7b0 -Pipe 830 -Comment "NGen Worker Process"
  2⤵
  PID:2224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 834 -InterruptEvent 83c -NGENProcess 7b4 -Pipe 838 -Comment "NGen Worker Process"
  2⤵
  PID:3408
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 840 -InterruptEvent 814 -NGENProcess 844 -Pipe 834 -Comment "NGen Worker Process"
  2⤵
  PID:2444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 814 -InterruptEvent 848 -NGENProcess 7b4 -Pipe 818 -Comment "NGen Worker Process"
  2⤵
  PID:1948
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 848 -InterruptEvent 850 -NGENProcess 7b0 -Pipe 84c -Comment "NGen Worker Process"
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 850 -InterruptEvent 7b0 -NGENProcess 750 -Pipe 858 -Comment "NGen Worker Process"
  2⤵
  PID:3424
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 808 -InterruptEvent 814 -NGENProcess 85c -Pipe 850 -Comment "NGen Worker Process"
  2⤵
  PID:3476
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 814 -InterruptEvent 860 -NGENProcess 750 -Pipe 844 -Comment "NGen Worker Process"
  2⤵
  PID:2236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 860 -InterruptEvent 868 -NGENProcess 848 -Pipe 864 -Comment "NGen Worker Process"
  2⤵
  PID:876
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 868 -InterruptEvent 870 -NGENProcess 7b4 -Pipe 86c -Comment "NGen Worker Process"
  2⤵
  PID:2668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 870 -InterruptEvent 878 -NGENProcess 7b0 -Pipe 874 -Comment "NGen Worker Process"
  2⤵
  PID:3448
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 85c -InterruptEvent 6e4 -NGENProcess 734 -Pipe 880 -Comment "NGen Worker Process"
  2⤵
  PID:2516
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 85c -InterruptEvent 7f0 -NGENProcess 868 -Pipe 87c -Comment "NGen Worker Process"
  2⤵
  PID:2696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f0 -InterruptEvent 750 -NGENProcess 6e4 -Pipe 878 -Comment "NGen Worker Process"
  2⤵
  PID:3128
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 750 -InterruptEvent 884 -NGENProcess 7b0 -Pipe 83c -Comment "NGen Worker Process"
  2⤵
  PID:2328
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 884 -InterruptEvent 888 -NGENProcess 734 -Pipe 870 -Comment "NGen Worker Process"
  2⤵
  PID:3668
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 888 -InterruptEvent 890 -NGENProcess 6e4 -Pipe 88c -Comment "NGen Worker Process"
  2⤵
  PID:3616
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 890 -InterruptEvent 898 -NGENProcess 7b4 -Pipe 894 -Comment "NGen Worker Process"
  2⤵
  PID:2004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 898 -InterruptEvent 8a0 -NGENProcess 85c -Pipe 89c -Comment "NGen Worker Process"
  2⤵
  PID:3752
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8a0 -InterruptEvent 8a8 -NGENProcess 7b0 -Pipe 8a4 -Comment "NGen Worker Process"
  2⤵
  PID:3540
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8ac -InterruptEvent 898 -NGENProcess 8b0 -Pipe 8a0 -Comment "NGen Worker Process"
  2⤵
  PID:3356
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 898 -InterruptEvent 8b4 -NGENProcess 7b0 -Pipe 868 -Comment "NGen Worker Process"
  2⤵
  PID:3600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8b4 -InterruptEvent 8bc -NGENProcess 85c -Pipe 8b8 -Comment "NGen Worker Process"
  2⤵
  PID:2024
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8bc -InterruptEvent 8c0 -NGENProcess 6e4 -Pipe 7b4 -Comment "NGen Worker Process"
  2⤵
  PID:3556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8bc -InterruptEvent 770 -NGENProcess 78c -Pipe 8c0 -Comment "NGen Worker Process"
  2⤵
  PID:3720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 6e4 -InterruptEvent 8c8 -NGENProcess 8a8 -Pipe 8bc -Comment "NGen Worker Process"
  2⤵
  PID:796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8c4 -InterruptEvent 7b0 -NGENProcess 85c -Pipe 6e4 -Comment "NGen Worker Process"
  2⤵
  PID:3628
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 804 -NGENProcess 8a8 -Pipe 77c -Comment "NGen Worker Process"
  2⤵
  PID:2824
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 744 -NGENProcess 85c -Pipe 7b0 -Comment "NGen Worker Process"
  2⤵
  PID:3428
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 744 -InterruptEvent 8b4 -NGENProcess 804 -Pipe 810 -Comment "NGen Worker Process"
  2⤵
  PID:4032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8c4 -InterruptEvent 78c -NGENProcess 7a8 -Pipe 744 -Comment "NGen Worker Process"
  2⤵
  PID:2720
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 78c -InterruptEvent 784 -NGENProcess 804 -Pipe 8a8 -Comment "NGen Worker Process"
  2⤵
  PID:2028
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 784 -InterruptEvent 8cc -NGENProcess 85c -Pipe 8b0 -Comment "NGen Worker Process"
  2⤵
  PID:3772
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8cc -InterruptEvent 8d4 -NGENProcess 8ac -Pipe 8d0 -Comment "NGen Worker Process"
  2⤵
  PID:3852
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8d4 -InterruptEvent 8dc -NGENProcess 8b4 -Pipe 8d8 -Comment "NGen Worker Process"
  2⤵
  PID:4044
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8dc -InterruptEvent 8e0 -NGENProcess 7a8 -Pipe 79c -Comment "NGen Worker Process"
  2⤵
  PID:3216
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8e0 -InterruptEvent 8e8 -NGENProcess 8ac -Pipe 8e4 -Comment "NGen Worker Process"
  2⤵
  PID:1684
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8e8 -InterruptEvent 8ec -NGENProcess 804 -Pipe 85c -Comment "NGen Worker Process"
  2⤵
  PID:2740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8ec -InterruptEvent 8f4 -NGENProcess 7a8 -Pipe 8f0 -Comment "NGen Worker Process"
  2⤵
  PID:1956
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 784 -InterruptEvent 8fc -NGENProcess 8f4 -Pipe 8e0 -Comment "NGen Worker Process"
  2⤵
  PID:936
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8fc -InterruptEvent 8b4 -NGENProcess 8e8 -Pipe 8ac -Comment "NGen Worker Process"
  2⤵
  PID:3768
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8b4 -InterruptEvent 904 -NGENProcess 8d4 -Pipe 900 -Comment "NGen Worker Process"
  2⤵
  PID:3968
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 908 -InterruptEvent 8fc -NGENProcess 90c -Pipe 8b4 -Comment "NGen Worker Process"
  2⤵
  PID:3404
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 804 -InterruptEvent 8fc -NGENProcess 908 -Pipe 8d4 -Comment "NGen Worker Process"
  2⤵
  PID:596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 914 -InterruptEvent 828 -NGENProcess 840 -Pipe 73c -Comment "NGen Worker Process"
  2⤵
  PID:1472
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 904 -InterruptEvent 824 -NGENProcess 7a8 -Pipe 914 -Comment "NGen Worker Process"
  2⤵
  PID:1036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 824 -InterruptEvent 908 -NGENProcess 804 -Pipe 814 -Comment "NGen Worker Process"
  2⤵
  PID:556
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 908 -InterruptEvent 8f4 -NGENProcess 7a8 -Pipe 8fc -Comment "NGen Worker Process"
  2⤵
  PID:3808
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 8f4 -InterruptEvent 918 -NGENProcess 904 -Pipe 8f8 -Comment "NGen Worker Process"
  2⤵
  PID:3996
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 91c -InterruptEvent 918 -NGENProcess 8f4 -Pipe 828 -Comment "NGen Worker Process"
  2⤵
  PID:4004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 918 -InterruptEvent 90c -NGENProcess 904 -Pipe 804 -Comment "NGen Worker Process"
  2⤵
  PID:600
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 90c -InterruptEvent 924 -NGENProcess 908 -Pipe 8e8 -Comment "NGen Worker Process"
  2⤵
  PID:2564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 924 -InterruptEvent 92c -NGENProcess 8f4 -Pipe 928 -Comment "NGen Worker Process"
  2⤵
  PID:3932
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 930 -InterruptEvent 92c -NGENProcess 924 -Pipe 7a8 -Comment "NGen Worker Process"
  2⤵
  PID:2232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 930 -InterruptEvent 7ec -NGENProcess 918 -Pipe 8f4 -Comment "NGen Worker Process"
  2⤵
  PID:3848
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7ec -InterruptEvent 904 -NGENProcess 92c -Pipe 824 -Comment "NGen Worker Process"
  2⤵
  PID:4004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 904 -InterruptEvent 940 -NGENProcess 908 -Pipe 93c -Comment "NGen Worker Process"
  2⤵
  PID:1672
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 940 -InterruptEvent 944 -NGENProcess 7ec -Pipe 930 -Comment "NGen Worker Process"
  2⤵
  PID:3920
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 90c -InterruptEvent 924 -NGENProcess 94c -Pipe 940 -Comment "NGen Worker Process"
  2⤵
  PID:1860
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 918 -InterruptEvent 924 -NGENProcess 90c -Pipe 7ec -Comment "NGen Worker Process"
  2⤵
  PID:184
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 848 -InterruptEvent 94c -NGENProcess 860 -Pipe 954 -Comment "NGen Worker Process"
  2⤵
  PID:3480
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 95c -InterruptEvent 924 -NGENProcess 94c -Pipe 958 -Comment "NGen Worker Process"
  2⤵
  PID:908
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 7f0 -InterruptEvent 860 -NGENProcess 92c -Pipe 960 -Comment "NGen Worker Process"
  2⤵
  PID:3892
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 924 -InterruptEvent 90c -NGENProcess 908 -Pipe 964 -Comment "NGen Worker Process"
  2⤵
  PID:2568

C:\Windows\ehome\ehRecvr.exe
C:\Windows\ehome\ehRecvr.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:636

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:988

C:\Windows\ehome\ehsched.exe
C:\Windows\ehome\ehsched.exe
1⤵
- Executes dropped EXE
PID:1420

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1772

C:\Windows\system32\IEEtwCollector.exe
C:\Windows\system32\IEEtwCollector.exe /V
1⤵
- Executes dropped EXE
PID:3048

C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:2100

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:924

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:1636

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:1320

C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2576

C:\Windows\eHome\EhTray.exe
"C:\Windows\eHome\EhTray.exe" /nav:-2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2548

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:2104

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:920

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:2884

C:\Windows\ehome\ehRec.exe
C:\Windows\ehome\ehRec.exe -Embedding
1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1616

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:1004

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2372

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2776

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3208

C:\Program Files\Windows Media Player\wmpnetwk.exe
"C:\Program Files\Windows Media Player\wmpnetwk.exe"
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3608
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:3108
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
  2⤵
  - Modifies data under HKEY_USERS
  PID:3196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE

Filesize
1.5MB

MD5
5122d3d1462a31f810d67930be2c7404

SHA1
fe80f60c341b35bd0020f6dcd8f4fe1880e98e58

SHA256
d478f53e5cf77a516b18815ecabc0d7cde5984a62fb2a7b770eeef86c4df1187

SHA512
1a395752bcd4e046f292c9b14f890ade9c06d15a7bf333f9090728563408f4b6809577fc7dcc3153f3f94556e0e3f783810b647d68f69477daa6b03f027bba48

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE

Filesize
30.1MB

MD5
a7edebee47c3831e0f90d899bf27c659

SHA1
b025861091d2b0779e4e1c0f3d534dce38e045d2

SHA256
fb63e3b17c70389be5b98eb5bd8c55b96da0e64ccec46b19f0746ff59b15dd5c

SHA512
92b7537de3062431075ab292c201eee6d3bcf311dacfd07bef5b4985778be48a18df7da772fe97164e614e7df41da0330d191468a7a24d722c9b55d2e1d5b499

Download Submit
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

Filesize
1.6MB

MD5
981df0ab0681cac29c991402f7da2393

SHA1
fb0034d7fa3812f32a1463161b0527598ef54ac3

SHA256
210589ed9d6c9b526b5316546eefdad837d4d53bae486c7acff43cbdc3b37ea6

SHA512
a2acc08eaefcbfe47a535c32a586c4fa87fb2381debb0c3e5b2868e2054ce364431da66d521246e5c1391796d51bdaa91832572a147616dcbfa59440e9aeb1ea

Download Submit
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe

Filesize
2.1MB

MD5
5d109575a954050e6e0b14320cd33ab0

SHA1
e3f914ca90676a4a1adf5563c357ac0dc362bf15

SHA256
731fb9af510ef218cb35760396ae00160fe37ba098790891337d97d37aa35cf6

SHA512
7894ba6c6a7ca207a682d99772bc5e00724f2d0e82ae839220763f18906df73d789154d3e78a8e46b2935a9bcdeffdcc1f90818cab8ca35de4f93a51a5dc2996

Download Submit
C:\Program Files\Google\Chrome\Application\SetupMetrics\20240909172513.pma

Filesize
488B

MD5
6d971ce11af4a6a93a4311841da1a178

SHA1
cbfdbc9b184f340cbad764abc4d8a31b9c250176

SHA256
338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783

SHA512
c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f

Download Submit
C:\Program Files\Windows Media Player\wmpnetwk.exe

Filesize
2.0MB

MD5
159dab63463aaff87d38fdcfded29bce

SHA1
4ab5627f0d7cc3661aa8a9988b2b687157e3d48d

SHA256
702bba0cabaaa36bba3fb84c0ddf03a3c982e319c1378a632a88c2d15ac3b2c4

SHA512
411aa04af8ffe16bc5469e2d1704b9f7cc847ae02a70a512df65c215416de1c200a7625e9348a4f9904a9558032f48b98ba4f7412eecf218feaa96786f997d2b

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log

Filesize
1024KB

MD5
9f28fc18faaf3cb3aa9f631924b7551a

SHA1
ecfe1dd2ecac5a875787df79bf84771c55187c9f

SHA256
f05dd2e80994855440cd6c4ca92ea4c263e562752935b8c8fe253ec8e12082bb

SHA512
9ae25b37139a9315d70b0d5f7192feb1a97ee99bf3da08086c87307c7bc2581e52d53550b5f6bf46dbfd622418fac3fd56e0ab7b0f6d20867968616fe74e0791

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSStmp.log

Filesize
1024KB

MD5
0760f3b21b05a045cdaf8f59ef8290ea

SHA1
67a520dbbaea59b60fac6edd6d32ce72018a92a0

SHA256
712dbc6e8c59d4bd4cb2023a5257719a09789a95d11a305b988e6752393b657d

SHA512
90ea10d548ff16f9caa0e51fe23f46c3b17bf20bbddf4d7e4934df509f9cc1dc77c425d89fb69abbcd7da9dac139353eb9a3b4fa8bb5717fb8fabb8b7b916bea

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

Filesize
40B

MD5
00eb296faf2733af5ed9b5ce73801cad

SHA1
b97df0ae5985360326eead31c447a688f04a935b

SHA256
cf9817990ec1e8351df5cca28c8c9f26d89ba174842f870e024ad2816f21ca76

SHA512
384509f335918ef66f0c7e491fee5e23740e309101373799e0406cb5995a71a270125fe4a8f7aede1071474caad7d65373c7f7855aaefc594dda114c49b0c6a3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\CURRENT~RFf780efe.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json

Filesize
851B

MD5
07ffbe5f24ca348723ff8c6c488abfb8

SHA1
6dc2851e39b2ee38f88cf5c35a90171dbea5b690

SHA256
6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

SHA512
7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.json

Filesize
854B

MD5
4ec1df2da46182103d2ffc3b92d20ca5

SHA1
fb9d1ba3710cf31a87165317c6edc110e98994ce

SHA256
6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

SHA512
939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

Filesize
16B

MD5
aefd77f47fb84fae5ea194496b44c67a

SHA1
dcfbb6a5b8d05662c4858664f81693bb7f803b82

SHA256
4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

SHA512
b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000002.dbtmp

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
98ef66f4c1be4b4b89ef08938f5b6041

SHA1
428e3ed20020154470937010ab59ba78c15dfcce

SHA256
9aa958788180f3a9f915efd164d194bfcdf2bf28b9ced71e6c3c5f6e3979fe7d

SHA512
f6d1ed7da2b7632b67354d940a7aee04c3a00e697360248a932896cf11ab3441b4fff626d2d51eeaee58b4f7f82a32702c6c4c70fc734466025bea92e89fca65

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
e7f1e5db899bab041db0154898e77df2

SHA1
0c200fbd16e025f606d18d2938f50c9b1a911370

SHA256
8ca03607f9a82f71efb7a560b981d83e4f943c4717344aebcb198d26dfca5942

SHA512
816f025cb62b7209b692a56cb596abbaba9e511158b2a8f65011b55b043f24bacd0d283ceb49292c36ef3622d3abf9e26739e83c4a43e33da9742ac740da1551

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
5078bd704a44f6687c3cf8e955da5b43

SHA1
ec3079e80b6b538082e34d18a2011665ceea0cf7

SHA256
0b07d0d7d75301d0415c2d0d35beeeec76a3e3d350af624d231d913112a05e24

SHA512
fdb379a04c70d2a840d27d07e127bb6e689c2522eafb0102a604b1b43ec3d7f3f2707c8b03ea83f8a6e2831ea6ce7fd9c4df3f05d09268d55a73eb18137ba4db

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
d7b4f6bb42ac58adac6471c5a993731c

SHA1
4c18db888d76582ef30f85af9a86c7d58f570356

SHA256
9e53c41291a081a5f2d1619aa49671fed5515385cae0f548cc2a3640bf421086

SHA512
5221a283636459c3056e331141bfafa063d06ddf998576cbb2e3669a199beb52815bf1acd412db1e1f9ffd6b64297a9ecd4f33c86ea3b74252d04e915cd2ed80

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
10KB

MD5
f493e5f0171a309e2585b4b091ae9e96

SHA1
c102fd0e42351bea85f552d498e08db39a813092

SHA256
123b2322a99d278dea6ffbb230583ad21a07aec416dfd2f971e6957f38c5c222

SHA512
4f5566f32770b5487b349f0af1be6f8efde084a679d0a0ea027e86ef74094ae1bd673c83696658a055ce1a9c22ce4c9d3e200abde03e9cfd1739a99ecc60ff52

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
8KB

MD5
3688552098304515fbfebc4e211e9a3d

SHA1
c36dea8da5c1ff313828ce394420e1c565cc7580

SHA256
1126a915e0526e6d134bb94bfdde271264c0a727029326dee9c45961c61aa14f

SHA512
bcd4fe74cd9a0e55b6ce1396d8f57247a2c5695aa29e49d49cd284214df924c0fd1754db388864506703123d6d208ad44b98fe1b094537fbec726b44e55fced1

Download Submit
C:\Users\Admin\AppData\Local\Temp\chrome_installer.log

Filesize
9KB

MD5
4782fcfd8582148278c6ef079deda788

SHA1
7a6c3955f09251ae90e0d8a59dbe4339e24925be

SHA256
1d1fb480e826336f52e3833fcbb3cd71c228662caee2f7bce78fc67635484447

SHA512
5a9bc413a6b90e49b1d300b21fdf0dbc09f9a7a950837f0fac9b89be88c398f983e10b4447526bbbd2c6be795b0a434248cb4ada3fc1424b869fc2b3ed697eb9

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2892_1443909903\CRX_INSTALL\_locales\en_CA\messages.json

Filesize
711B

MD5
558659936250e03cc14b60ebf648aa09

SHA1
32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

SHA256
2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

SHA512
1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir2892_1443909903\e866902f-4000-4632-b519-13281d4e35d0.tmp

Filesize
88KB

MD5
2cc86b681f2cd1d9f095584fd3153a61

SHA1
2a0ac7262fb88908a453bc125c5c3fc72b8d490e

SHA256
d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c

SHA512
14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986

Download Submit
C:\Users\Admin\AppData\Roaming\3af259bdacae13d2.bin

Filesize
12KB

MD5
8cbb3cb8859bbfc2a5b911cfd5810e66

SHA1
169a1751edcebcc842ef5d9812afe2e9333609c5

SHA256
1afec92f3a872ee70bca2b5100565bbfd6dea9a0c5db0f5d8e7a10030608c844

SHA512
8755b46cd366e6c686eef8c136d267d929f859c0b21c5f1234f27523eaeebe090f161ad5e0aa0915bed1b590131f66ccfde14600231713a790ee2a1174ebfcc7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms

Filesize
24B

MD5
b9bd716de6739e51c620f2086f9c31e4

SHA1
9733d94607a3cba277e567af584510edd9febf62

SHA256
7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312

SHA512
cef609e54c7a81a646ad38dba7ac0b82401b220773b9c792cefac80c6564753229f0c011b34ffb56381dd3154a19aee2bf5f602c4d1af01f2cf0fbc1574e4478

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

Filesize
1.5MB

MD5
844c032116e8ad32b952801b391577de

SHA1
c5dcdaa36f61e9d694bdd046852f43f1ea8d414d

SHA256
4905bed44b54038e1397d00e87d31d0d3fc21ddc2e252ac1687fc4e869b706c5

SHA512
48338d0d6f4426160e0e56086c96ad042b1fb1b52ed5dd921c530dfee323b424fc762b22cafb234f412e1390bac9d05e66378664a6c21673845b22206f6836c7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log

Filesize
872KB

MD5
674231ae529095f1b57e6733be0802e0

SHA1
f29e4da9b771db40fbd2fde6fc871a72d19593d1

SHA256
b87b96033f4be3e76cc4d9f24c2e8d52031b7abdc7fe4f433f97cdfc888f90c0

SHA512
7d19a09b29de3bed7ac691175a56b9183b73c8f90d45066812e6ad7f7a30083b07912bdba9ae13c0df31ca36b8165104dcf3ebaa06a96fa9df67466fc46b312c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe

Filesize
1.4MB

MD5
cb7a337a5d4c3193e4307e5fc3753002

SHA1
32cef36f37a65fb3233517a4ee2bf377e0b4d29e

SHA256
19ac911023b087fd14d9c4bc0043c70bb13cfc5418b053982c5740f2041fb7d4

SHA512
e7bf6b5a8a43d4f189c19c1934ff7bf8ffc350c0a185e3b1bfae63f0939968cf5879180aa2231a783b5b51316584affc32ce917e711f54b4d9f35bcb161c3505

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

Filesize
1.5MB

MD5
f9b330578414e7d6a0aec3db82d9ccb1

SHA1
3d49ce06744371ef4c04794025b528b036921feb

SHA256
f5869b1cebc6c23711f066dfaa8d9b781993fac4b51bd5d4d2402ebbadc1df0d

SHA512
6b49c8d994553ac7001fb13d5f52bc2b058ba5ad5046a92a9151f1d18fc05733aa696a461447fb0e6e642aae220716a099c832057af82b7c6f6e95e2cfa8f137

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
add58bfbe634d1506b13722320778adf

SHA1
84845ef3bc5285b8144d1432daf5f36bdc64373e

SHA256
2527ac9ee9c265ea7027ff6d7edeb2c5df3cc47073b8b2c4cea61fd11f3087d7

SHA512
188350be3ead029aba36576c00d84bfb2455312e6b953c682df4796adc8b18c0efec6265043efb5e2834fd251a03517486f6940fa443b9a1be6515a9e8d42c84

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

Filesize
1.4MB

MD5
2f440cd63ac926c9b13b55f8f393ea2a

SHA1
19f0a4f6eaa21378de85bdd41dc03a18b1cae2d6

SHA256
a872c1a024ffb2f7e8cc3fe1249dfb079bb61ca9911061f5936fc95d152f1438

SHA512
ebddcf3af94b96d96245541165c65a1ad61ad7a4232644617066518162afefa9e8dffb3c65c94d1c003246197ad7c66e8152578325a83c89efcbe6d7deadef33

Download Submit
C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log

Filesize
1003KB

MD5
15d935cfd2307fd422a119f95fca39ab

SHA1
3d5cd6f332bd660908ed8566853fe3de0cef017d

SHA256
ddc5e0f46d982f0817f76aa4efedbad48d7b3ad4edae3ce0d8e138c7f2dd8a85

SHA512
28fa041837771d4825c32b1dbd0b4383939e482e0d6bc1b7e651acc272d7a3c1ae0fde2ea7637bfc3c62fe03aa1aaea6437416e2fb47e1f0063e9d0e0ba6518f

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

Filesize
1.5MB

MD5
5a7f73da22f21426041786eef2e0a63c

SHA1
0a3da1109d58d05583ab0092e9c983384bd8c89e

SHA256
4e659ae97036c1ce807eaa506c1c7f369190dc0aae75268b5b4d25c92171e548

SHA512
53004a7a65ff4204484a8c20c810640ac2143990fa477f4d6d6415674ae45059159ba83bff9f1638daeb8b38366a6cb4025b6c4fce30c41742deb01be8eaa3bd

Download Submit
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log

Filesize
8KB

MD5
e49b0b14eb641a83d462280fd2e02588

SHA1
7bbdfb2f2c5f951164de26e6fcec06b758411587

SHA256
2f5e5f909594caaca7355492e6f51dbb34c24c01bfaa0e049cc8512ae3d74ed5

SHA512
4d4e653aacde41673dd0f968e67c33e9ce3abc5dd850583cc0be2d5080645141e2f29f27b56da5ae149beecda4318cc90896d5f16ac1c00e665b744fe7c3c4a3

Download Submit
C:\Windows\SysWOW64\perfhost.exe

Filesize
1.4MB

MD5
385a7f6bff2981f380dbbcaa313be5f3

SHA1
df5054c26322dfdc4301cfc34b4e323c08e9ef82

SHA256
19d3339c4da089fc57edb0d59c30b5f5c15d89eac0787d25715fae0100bb0b0c

SHA512
face3108d18e3da7342489f1e05e2e55c5c44943db9418e7581d61f6ec1341d43891f996b1e5312e01217fda5bfb3a571f1efe536e02dc8986e7122fe50c7063

Download Submit
C:\Windows\System32\Locator.exe

Filesize
1.4MB

MD5
ee5bf8c26d76f3b45a6a323f92b0efa5

SHA1
20f35b9a94b3ba610b0397d43beeb0d169a8b425

SHA256
fb5fcb85c91fd949af9e83999559a1212fca0a23aca27bf9caa6a1a487f866c1

SHA512
854611c9420dea56e46bd3d52512f3c382b0ad1659eb21b88e501c47a601e2f28be5c385ca33b494bfa8987ed2238e46d117db3a4e9c67ba61feb65ecb5a474b

Download Submit
C:\Windows\System32\SearchIndexer.exe

Filesize
1.1MB

MD5
4b86ce3c7ae8cc0ec3cb36e8fcd9895b

SHA1
33ea007fefb12fb8ee206cac805a5e325004e943

SHA256
82fd9b50b10dcc9196494e082312185119e82ab6be7028d70fa0fa4328ead25b

SHA512
431b134f354e6929c8f5eb5bdedddd3251065dd73f98c198f0210108d8a49216183e08101f099f2780ddcbbca535572af45619f78e8617e3096e7f84f75dd46c

Download Submit
C:\Windows\System32\VSSVC.exe

Filesize
2.1MB

MD5
4a49ad6cac46beec645a46763adcb07d

SHA1
cb8e36224bbc087f4f3f3627cba6a5cf69682f15

SHA256
bed9ea3a9060c63ad03a5cea79914c72e3788792aacde203e038b299cecc0f7c

SHA512
8a3b2bad1d57328584aa760101ecab6eae6cade401ca8a598398baaed20f33161c31f147bc2315563db6e5d8721b72a23d169230141cf1c90fcc8fa9b08d4321

Download Submit
C:\Windows\System32\alg.exe

Filesize
1.5MB

MD5
e6e60bac6452a33c940970b2e7915147

SHA1
2ed6572e9f3d51c323bca01a55a43606a74d4948

SHA256
36c6f5f340aa64f4b299db6ab71221ee274e4c7dece294d5390badd9e4dc4853

SHA512
e030f81f93372476a5d99bd4cf30bf765eb0bc5bef4ba6129d04a74761403d2247da8c026ae7ef74e38782a6e490742ab0a44cd690b4f8375853d66db9b0e3ef

Download Submit
C:\Windows\System32\ieetwcollector.exe

Filesize
1.5MB

MD5
ce548c435cf64b2005dbf1b3856464a6

SHA1
33f3e9c8df2aa1d00bfae0c0aa0f0f13e6242725

SHA256
921b757d59d071db66db48aafb5e5a8506de88cfc9dd3495d777932030abed19

SHA512
903dcb37ec132a276d8ca88a023e72c389579dc91ce9e771c10c321a1ec99409abd0b5f0d7084b258e3785b5c24b8dbe8a8231bea308dc7b55e97a43a2c1bca4

Download Submit
C:\Windows\System32\vds.exe

Filesize
1.9MB

MD5
829563fa306095c907abf02c6a01b58a

SHA1
e894c399f6a73bb7ae188082a1864b37b9268130

SHA256
a157a8e864a19bfe9322fc8cd85c0443a666d0f4b89d56cc7c492664fa7f6efb

SHA512
cf3bde8d167f31e8dbf6600eba9080e0fdc56d5185a8826cfb61feff26e2711adca84ef053f61a84764cfc9693af2e0b81eaf3ca756fae75cac5b9d9e0203ecd

Download Submit
C:\Windows\TEMP\Crashpad\settings.dat

Filesize
40B

MD5
29f7a7de7180c694327ceb48d684a10e

SHA1
ab3b65e8c59fceca656b4894b0d0050933260bb1

SHA256
c507bc08f6a76920838a68621b29cd42297c0f1c25103d9456e1725c67884d42

SHA512
d3b008e694537984f2de937c3adc06a8c796d651dfad6224194fa713204628367152429bb14161ca8605e8e5f2e5ae8fe9cf380b9922274eaa4f984d47dfc6c7

Download Submit
C:\Windows\Temp\Cab581F.tmp

Filesize
29KB

MD5
d59a6b36c5a94916241a3ead50222b6f

SHA1
e274e9486d318c383bc4b9812844ba56f0cff3c6

SHA256
a38d01d3f024e626d579cf052ac3bd4260bb00c34bc6085977a5f4135ab09b53

SHA512
17012307955fef045e7c13bf0613bd40df27c29778ba6572640b76c18d379e02dc478e855c9276737363d0ad09b9a94f2adaa85da9c77ebb3c2d427aa68e2489

Download Submit
C:\Windows\Temp\Tar588E.tmp

Filesize
81KB

MD5
b13f51572f55a2d31ed9f266d581e9ea

SHA1
7eef3111b878e159e520f34410ad87adecf0ca92

SHA256
725980edc240c928bec5a5f743fdabeee1692144da7091cf836dc7d0997cef15

SHA512
f437202723b2817f2fef64b53d4eb67f782bdc61884c0c1890b46deca7ca63313ee2ad093428481f94edfcecd9c77da6e72b604998f7d551af959dbd6915809c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll

Filesize
148KB

MD5
ac901cf97363425059a50d1398e3454b

SHA1
2f8bd4ac2237a7b7606cb77a3d3c58051793c5c7

SHA256
f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58

SHA512
6a340b6d5fa8e214f2a58d8b691c749336df087fa75bcc8d8c46f708e4b4ff3d68a61a17d13ee62322b75cbc61d39f5a572588772f3c5d6e5ff32036e5bc5a00

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
34KB

MD5
c26b034a8d6ab845b41ed6e8a8d6001d

SHA1
3a55774cf22d3244d30f9eb5e26c0a6792a3e493

SHA256
620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3

SHA512
483424665c3bc79aeb1de6dfdd633c8526331c7b271b1ea6fe93ab298089e2aceefe7f9c7d0c6e33e604ca7b2ed62e7bb586147fecdf9a0eea60e8c03816f537

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
109KB

MD5
0fd0f978e977a4122b64ae8f8541de54

SHA1
153d3390416fdeba1b150816cbbf968e355dc64f

SHA256
211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60

SHA512
ceddfc031bfe4fcf5093d0bbc5697b5fb0cd69b03bc32612325a82ea273dae5daff7e670b0d45816a33307b8b042d27669f5d5391cb2bdcf3e5a0c847c6dcaa8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\2ac1b12a639468792e59b4700140c538\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
187KB

MD5
1ed35f37f353b3111d1b093f2020bef2

SHA1
c568ad68a6490591a6433ba0d849ef3fcd7bcccd

SHA256
2792240af5f17dc300d6c198011bbfa917b6568bba6b1c326ffa1ac42ea53d07

SHA512
e65b32398c48e3b71b495c3edd66b57e2daec6a54770f0b439d65cf824b60b3847b5c26e4bdd9bed5268b69b20d03b68037540ed549fe432474a5860fc7173d1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\314b7cc175d091b85f36902ea9787308\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
180KB

MD5
d58af90603395cf30c8a30d0e22cba66

SHA1
c5b0f2a283589ecac57cf8e56849b4412704aeee

SHA256
3ea187ee5451d30e217a5be16ffa14a88c1b82dd8e3375fd5d6b4bc46513a0ce

SHA512
35340c628272138cd61a16937e80ef2b6b97c5af88047c439b8ce1d7246d068763984b5b17620765125dc193cc9e8582173a88c478cc7b573f9a55021614d631

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

Filesize
41KB

MD5
3c269caf88ccaf71660d8dc6c56f4873

SHA1
f9481bf17e10fe1914644e1b590b82a0ecc2c5c4

SHA256
de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48

SHA512
bd5be3721bf5bd4001127e0381a0589033cb17aa35852f8f073ba9684af7d8c5a0f3ee29987b345fc15fdf28c5b56686087001ef41221a2cfb16498cf4c016c6

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\51c9cf602c45730a7c8aa24c14c69576\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
143KB

MD5
eddfbe3f78f1f1edc6afed9bc5ea069d

SHA1
366157c191af446a6cd3d8209b3b10bfc4123dd3

SHA256
573bf1b8728c5ea872a38778dab17e0e72ca1563eafc4727d2ce018ea8e3958a

SHA512
7b3fb9a088f28f28ab5d2e04f99fc20e7764e92d2864b8d2557b9828ce074f46d01299075b7b19acc5e79a8f1bdb66fb7f692a4b7c677a0a82d283d4dd558ab0

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

Filesize
210KB

MD5
4f40997b51420653706cb0958086cd2d

SHA1
0069b956d17ce7d782a0e054995317f2f621b502

SHA256
8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553

SHA512
e18953d7a348859855e5f6e279bc9924fc3707b57a733ce9b8f7d21bd631d419f1ebfb29202608192eb346569ca9a55264f5b4c2aedd474c22060734a68a4ee6

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

Filesize
53KB

MD5
e3a7a2b65afd8ab8b154fdc7897595c3

SHA1
b21eefd6e23231470b5cf0bd0d7363879a2ed228

SHA256
e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845

SHA512
6537c7ed398deb23be1256445297cb7c8d7801bf6e163d918d8e258213708b28f7255ecff9fbd3431d8f5e5a746aa95a29d3a777b28fcd688777aed6d8205a33

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
28KB

MD5
aefc3f3c8e7499bad4d05284e8abd16c

SHA1
7ab718bde7fdb2d878d8725dc843cfeba44a71f7

SHA256
4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d

SHA512
1d7dbc9764855a9a1f945c1bc8e86406c0625f1381d71b3ea6924322fbe419d1c70c3f3efd57ee2cb2097bb9385e0bf54965ab789328a80eb4946849648fe20b

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\dc9ce345d71ffaf6b9465292594fbbbd\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
83KB

MD5
43a406de52114d21018a091f1e876546

SHA1
75363d23f4eb29c9e3b39e66f01a8b9d17b6123f

SHA256
b5facd49119a65edc3f83643c17f2695940b31bde2b98abbb7563c71fec254eb

SHA512
330e6f50d0a71838b0a4a764b861c5132e3718bad96c8064d5ab029e90fe2675af7b64d76605782d71a0742b674107e0d502dc30dca903b3fdd0a02c8178f664

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
27KB

MD5
9c60454398ce4bce7a52cbda4a45d364

SHA1
da1e5de264a6f6051b332f8f32fa876d297bf620

SHA256
edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1

SHA512
533b7e9c55102b248f4a7560955734b4156eb4c02539c6f978aeacecff1ff182ba0f04a07d32ed90707a62d73191b0e2d2649f38ae1c3e7a5a4c0fbea9a94300

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
57KB

MD5
6eaaa1f987d6e1d81badf8665c55a341

SHA1
e52db4ad92903ca03a5a54fdb66e2e6fad59efd5

SHA256
4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e

SHA512
dbedfa6c569670c22d34d923e22b7dae7332b932b809082dad87a1f0bb125c912db37964b5881667867ccf23dc5e5be596aad85485746f8151ce1c51ffd097b2

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
130KB

MD5
2735d2ab103beb0f7c1fbd6971838274

SHA1
6063646bc072546798bf8bf347425834f2bfad71

SHA256
f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3

SHA512
fe2ce60c7f61760a29344e254771d48995e983e158da0725818f37441f9690bda46545bf10c84b163f6afb163ffb504913d6ffddf84f72b062c7f233aed896de

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Filesize
59KB

MD5
8c69bbdfbc8cc3fa3fa5edcd79901e94

SHA1
b8028f0f557692221d5c0160ec6ce414b2bdf19b

SHA256
a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d

SHA512
825f5b87b76303b62fc16a96b108fb1774c2aca52ac5e44cd0ac2fe2ee47d5d67947dfe7498e36bc849773f608ec5824711f8c36e375a378582eefb57c9c2557

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

Filesize
42KB

MD5
71d4273e5b77cf01239a5d4f29e064fc

SHA1
e8876dea4e4c4c099e27234742016be3c80d8b62

SHA256
f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575

SHA512
41fe67cda988c53bd087df6296d1a242cddac688718ea5a5884a72b43e9638538e64d7a59e045c0b4d490496d884cf0ec694ddf7fcb41ae3b8cbc65b7686b180

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll

Filesize
855KB

MD5
7812b0a90d92b4812d4063b89a970c58

SHA1
3c4a789b8d28a5bfa6a6191624e33b8f40e4c4ea

SHA256
897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543

SHA512
634a2395bada9227b1957f2b76ed7e19f12bfc4d71a145d182602a1b6e24d83e220ebfabd602b1995c360e1725a38a89ff58417b0295bb0da9ea35c41c21a6ed

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll

Filesize
43KB

MD5
3e72bdd0663c5b2bcd530f74139c83e3

SHA1
66069bcac0207512b9e07320f4fa5934650677d2

SHA256
6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357

SHA512
b0a98db477fccae71b4ebfb8525ed52c10f1e7542f955b307f260e27e0758aa22896683302e34b0237e7e3bba9f5193ddcc7ff255c71fbaa1386988b0ec7d626

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft-Windows-H#\a46df77acafec60e31859608625e6354\Microsoft-Windows-HomeGroupDiagnostic.NetListMgr.Interop.ni.dll

Filesize
105KB

MD5
d9c0055c0c93a681947027f5282d5dcd

SHA1
9bd104f4d6bd68d09ae2a55b1ffc30673850780f

SHA256
dc7eb30a161a2f747238c8621adb963b50227a596d802b5f9110650357f7f7ed

SHA512
5404050caa320cdb48a6ccd34282c12788ee8db4e00397dde936cee00e297e9e438dcaa5fcb4e92525f167637b500db074ac91971d4730d222ac4713a3e7b930

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\11940d5133d63001fa4499c315655e15\Microsoft.Office.Tools.Word.v9.0.ni.dll

Filesize
1.1MB

MD5
7835e60e560a49049ae728698da3d301

SHA1
87b357b1b3c9a2ad2f3b89b10a42af021ab76afe

SHA256
df34cbc18c66aa387324c45196d71ebe7c91a83fbbdc91766f9f47330a0cb2fa

SHA512
b95c33a2746a331e4416f7449c8ab613ba16c716a449e446d825f34dfaf754ea7562bf77cf5a73a78599e0b67a3a697437baa9aa516e40e06981693c8ea5b993

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\6337d25ea4dd40045a047cb662ee4394\Microsoft.Office.Tools.Outlook.v9.0.ni.dll

Filesize
238KB

MD5
0a4ed78b7995d94fa42379f84cd5f8e9

SHA1
90ba188fe0ebd38ad225e7ce3a24dd9b6b68056b

SHA256
0a75d0d332692cc36d539abdd36f3ff5ef2ab786a9404548ca6c98fd566c4d86

SHA512
86ac346de836aa6dd7e017ff4329803c9165758dcfe3aa1881e46ca73e15e6cdb269fcc5b082d717774666f9bc40051a47b5261bfe73901804eb4b0bfacd1184

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\82425dbc07ec64ab599534080b6fbc08\Microsoft.Office.Tools.v9.0.ni.dll

Filesize
248KB

MD5
4bbf44ea6ee52d7af8e58ea9c0caa120

SHA1
f7dcafcf850b4081b61ec7d313d7ec35d6ac66d2

SHA256
c89c478c2d7134cd28b3d28d4216ad6aa41de3edd9d87a227ec19cf1cbf3fb08

SHA512
c82356750a03bd6f92f03c67acdd5e1085fbd70533a8b314ae54676f37762d9ca5fa91574529b147d3e1c983bf042106b75f41206f5ddc37094a5e1c327c0fd3

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dc8ba97b4a8deefeb1efac60e1bdb693\Microsoft.Office.Tools.Excel.v9.0.ni.dll

Filesize
1.8MB

MD5
9958f23efa2a86f8195f11054f94189a

SHA1
78ec93b44569ea7ebce452765568da5c73511931

SHA256
3235e629454949220524dd976bec494f7cc4c9abeaf3ee63fc430cbe4fbcf7b6

SHA512
3061f8de0abf4b2b37fbc5b930663414499fb6127e2892fe0a0f3dfba6da3927e6caa7bcba31d05faee717d271ecf277607070452701a140dc7d3d4b8d0bfeb1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Office.To#\dd4deeafd891c39e6eb4a2daaafa9124\Microsoft.Office.Tools.Common.v9.0.ni.dll

Filesize
1.0MB

MD5
598a06ea8f1611a24f86bc0bef0f547e

SHA1
5a4401a54aa6cd5d8fd883702467879fb5823e37

SHA256
e55484d4fe504e02cc49fde33622d1a00cdae29266775dcb7c850203d5ed2512

SHA512
774e6facd3c56d1c700d9f97ee2e678d06b17e0493e8dc347be22bcba361bd6225caef702e53f0b08cacc9e6a4c4556280b43d96c928642266286f4dec8b5570

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\06216e3a9e4ca262bc1e9a3818ced7fe\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll

Filesize
58KB

MD5
3d6987fc36386537669f2450761cdd9d

SHA1
7a35de593dce75d1cb6a50c68c96f200a93eb0c9

SHA256
34c0302fcf7d2237f914aaa484b24f5a222745f21f5b5806b9c519538665d9cb

SHA512
1d74371f0b6c68ead18b083c08b7e44fcaf930a16e0641ad6cd8d8defb4bde838377741e5b827f7f05d4f0ad4550b509ba6dff787f51fc6830d8f2c88dbf0e11

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\077a55be734d6ef6e2de59fa7325dac5\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll

Filesize
205KB

MD5
0a41e63195a60814fe770be368b4992f

SHA1
d826fd4e4d1c9256abd6c59ce8adb6074958a3e7

SHA256
4a8ccb522a4076bcd5f217437c195b43914ea26da18096695ee689355e2740e1

SHA512
1c916165eb5a2e30d4c6a67f2023ab5df4e393e22d9d8123aa5b9b8522fdb5dfe539bcb772a6e55219b23d865ee1438d066e78f0cb138a4a61cc2a1cecf54728

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\0817dd144bd1703a16af65cf81ef80e6\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll

Filesize
759KB

MD5
37c49cf471f7ad881127f9e38bed1a10

SHA1
473c3a7a28d138ccfff0d971a1ce9360ab990aba

SHA256
9ef88d67461f4d91de1e16fab938d5561db9d04898d8776f9e716fdd52f91369

SHA512
e88e5b3b41b5763ed7de4d3ef40ec77144252c30d8d67f5b387b905026bd856e9d70889ccf9f78b0c0a7b0298ca8afdbaed133675001dc60593c6fbc31e93c47

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\19c2b79f666960d7a242a04c5d76f114\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll

Filesize
227KB

MD5
4ec89a4e8fe1b5b9916ace8dbabc0418

SHA1
dafec0baada7f2fa425978a5816fe852053fb1fc

SHA256
6c4f0f9775fbaf81122cba659cdd5449974810c772d51e152fc20016211988e0

SHA512
648704c9808193a045035858b68f7e98981da8c1c98f07e04afacb1b181beeb0bf7df9f42a563636093aff05f01f0c7faacdde0561e9e8776e914611f9f43b34

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\2951791a1aa22719b6fdcb816f7e6c04\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll

Filesize
43KB

MD5
68c51bcdc03e97a119431061273f045a

SHA1
6ecba97b7be73bf465adf3aa1d6798fedcc1e435

SHA256
4a3aa6bd2a02778759886aaa884d1e8e4a089a1e0578c973fcb4fc885901ebaf

SHA512
d71d6275c6f389f6b7becb54cb489da149f614454ae739e95c33a32ed805820bef14c98724882c4ebb51b4705f41b3cdb5a8ed134411011087774cac6e9d23e8

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\369a81b278211f8d96a305e918172713\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll

Filesize
198KB

MD5
9d9305a1998234e5a8f7047e1d8c0efe

SHA1
ba7e589d4943cd4fc9f26c55e83c77559e7337a8

SHA256
469ff9727392795925c7fe5625afcf508ba07e145c7940e4a12dbd6f14afc268

SHA512
58b8cc718ae1a72a9d596f7779aeb0d5492a19e5d668828fd6cff1aa37181cc62878799b4c97beec9c71c67a0c215162ff544b2417f6017cd892a1ce64f7878c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\36c5a9d83dfb1b6b1c0202fb505c9daf\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll

Filesize
221KB

MD5
78c5a493778f578ef5517fe161162819

SHA1
faf377bdc739623fb5f111d51af97e8c78f11525

SHA256
aa332098d4073a4c4a654d16ec5fd0b6e2b1f284890057e164204d756095dd93

SHA512
6a905ef75d2eb909cd30c3916110f6b41a849ff4ed9f4c19e4d5f85ccf05d9b9dd009b351003386778801909d2628ce4c6cd9b1a54e3a0cd1ab9c5496f35cf50

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\48b20edf8055a1d3074e1039bf29c99c\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll

Filesize
305KB

MD5
ae519352c6ecb426490e76618f934c7d

SHA1
5a54e5c04271ba963d37fee19873c8f0525af9d7

SHA256
95a0878bee257188733cc433c0453b2e3cde59cef64b9e1df7a5510f7e8d8584

SHA512
4d09cb540bb62193304f653ddb89cbdae29c6d1d611fef7c18b3f747d71eaae91ef69fb45a5582a6edaeca2b46280b957239de930268cd4e6b3bc47212ce4d3c

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\4b363c5e4c1eae1701bf45d167f8658f\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll

Filesize
91KB

MD5
adc5887e89bc56694a193d92898d3518

SHA1
267f14c45a86d50ad627c6cb00626049e9c1ee20

SHA256
edc77665afe4901d4370c6a4fe7427b235a8b4bbcd58ac41ee72440cf414bb5b

SHA512
bdea1e13b655e62b74f908f1012a746992245ffcebe21bad624e6e051429e8cccf531fc03fa1fc7319bc5c9c6367c261174394f9623a1968c6381d674b341a37

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\585e8f83eff436c8156f071e8f2bdaa0\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll

Filesize
1.8MB

MD5
04a6857c04546270358d14398fde209e

SHA1
596a3e11ac6c303c679edfd6c30aa71e8eaf8a23

SHA256
8eb8d5e0c2097d6fdae4b58cfde3e1be1dd6e59968891ac6d11efe8adf227285

SHA512
4e8bfd6bf9463a004c17a897026bcc1b4edb0764c7e959f09a744d395e9885b24f8e869b78896218ce930562796a3a8e3a7f0a59ba11c8dfa32b0908c5706b22

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6348aa5d2bd39c221a41286e95c18b97\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll

Filesize
381KB

MD5
0811b25e0449e04f782127bc6f8ac5e3

SHA1
dc1766e20ee338b12fa80e3ce0052ef97ddf9e20

SHA256
20d8234901a58ec8ec24f2ce7048ac9e1e7381e3eae10cfeb1e002001d2c8b6c

SHA512
a3a07aa4263175688019597b0829b090ad3b8ff43c554b8c89e16b48de86fddab4be6217bce24ccce9cad0c98df1240a7068c8b55778d836c34d5326cbd9c8a6

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\638deb723580c8e7fa628ebe51001db3\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll

Filesize
271KB

MD5
ca144c72bf5be1cdb62b7cb1c4f69c29

SHA1
a5a63c8eba90bf95acdfb8c2d4a41ad262321262

SHA256
6352bae31f81d03de06a2dacb985029af090cd4afe2ff019df29e38093f9cf97

SHA512
b6386e146a93d3421bd6ea4e34f0def61695d6f82aea8ab4605374bdb099e6fd7c5ec4bc2fe6c766239f824e461bc91ea1059444dbb5b5618f3a2b660bbb5186

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\6e100177db1ef25970ca4a9eba03c352\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll

Filesize
70KB

MD5
57b601497b76f8cd4f0486d8c8bf918e

SHA1
da797c446d4ca5a328f6322219f14efe90a5be54

SHA256
1380d349abb6d461254118591637c8198859d8aadfdb098b8d532fdc4d776e2d

SHA512
1347793a9dbff305975f4717afa9ee56443bc48586d35a64e8a375535fa9e0f6333e13c2267d5dbb7fe868aa863b23034a2e655dcd68b59dca75f17a4cbc1850

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\74054b5793bfb8c8c0753b4d4aead8e3\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll

Filesize
947KB

MD5
b1aa17d171be82960213057ca35815a9

SHA1
6c68a8a2c524ddbe04395dfa613378bb311aa314

SHA256
c632156c276f9189d0f53addcc1043006d86188e3b74d9c4042ab2110b6cfd4e

SHA512
6f042aec9c74da86d15322d4300d93e4a9e69ad3555b302d42d7629dfa060209898b4569a380e9da1a785ddb53a6e0cc0f7543606f17ee467277990971c2fc1a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\77f00d3b4d847c1dd38a1c69e4ef5cb1\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll

Filesize
87KB

MD5
ed5c3f3402e320a8b4c6a33245a687d1

SHA1
4da11c966616583a817e98f7ee6fce6cde381dae

SHA256
b58d8890d884e60af0124555472e23dee55905e678ec9506a3fbe00fffab0a88

SHA512
d664b1f9f37c50d0e730a25ff7b79618f1ca99a0f1df0b32a4c82c95b2d15b6ef04ce5560db7407c6c3d2dff70514dac77cb0598f6d32b25362ae83fedb2bc2a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\852222588019d6e961a4ce33eb6299c1\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll

Filesize
122KB

MD5
37a2aca7d8a246d179514ecc14068606

SHA1
ac2493c3ba7de0dba7b9cddf7eaadac7ae3271b7

SHA256
f54a0994c5712e9f54e2f988fad12069d8c486addc4e24c6f149db440d5be83b

SHA512
46dc7c6c5a6a92d83a10b5caa713044b3292b2c9b99e91b283b0aa7eab373caf44ea8ae6c6e47939ba7b9737fc94996ee8102223a5c6bebb09f8ffb2b84694f9

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\9e076728e51ab285a8bc0f0b0a226e2c\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll

Filesize
82KB

MD5
2eeeff61d87428ae7a2e651822adfdc4

SHA1
66f3811045a785626e6e1ea7bab7e42262f4c4c1

SHA256
37f2ee9f8794df6d51a678c62b4838463a724fdf1bd65277cd41feaf2e6c9047

SHA512
cadf3a04aa6dc2b6b781c292d73e195be5032b755616f4b49c6bdde8b3ae297519fc255b0a46280b60aaf45d4dedb9b828d33f1400792b87074f01bbab19e41a

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a58534126a42a5dbdef4573bac06c734\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll

Filesize
58KB

MD5
a8b651d9ae89d5e790ab8357edebbffe

SHA1
500cff2ba14e4c86c25c045a51aec8aa6e62d796

SHA256
1c8239c49fb10c715b52e60afd0e6668592806ef447ad0c52599231f995a95d7

SHA512
b4d87ee520353113bb5cf242a855057627fde9f79b74031ba11d5feee1a371612154940037954cd1e411da0c102f616be72617a583512420fd1fc743541a10ce

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\a8141e9e81e2c3bbf457e4980d4c2847\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll

Filesize
483KB

MD5
aae5a97685a809d0a0f661f9319f8a12

SHA1
b5fdd4ec4cc057fccc868de4f4910be89e23e48a

SHA256
c26eea914017a12af65dc7ebcbbf86d5a620de60f57e3660057163613f2b0233

SHA512
d95c0635c587fe40e2c33cabf14e2893be49df06aebf2d40f4c0623f649e9abbd73a95cc5e3740db3b15df07406e36b1534781e63ee485e54671cfb21d3317fb

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\ad7d01564f0056d2476f6ae5d257356b\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll

Filesize
436KB

MD5
748bed51a810c033b91c660b5776ab95

SHA1
ec2616fb01949fb9fe4b0eea707f7095b69aa9e4

SHA256
45ee38adadeb1586532e8dd4baba14740ccb0801c2e21318c35268543e0ddef7

SHA512
dc0cce4c633b8e43d8f6d565fcfc73d79bfea375a79ae5057af6d3cc1b62f929e34c95bcfe2f7d378ec7f421fafdd9ab73cff454df0934e2d2f45a52580e9df0

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\b22777deb45f6aeebf6bc7753dd76eea\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll

Filesize
220KB

MD5
5c35887a0b76108f6fb6daac51256ef5

SHA1
3be6ece2f60d205bcb955a5da0aa182d83cc1899

SHA256
9f8de356dab305f2be5cf1f75934eb6b87072e1745ab5ee73ab4b319bb9a2b5a

SHA512
0d1d2e5dd3ec776fab85e8f3b8cde32718bbbb52463c2702a17336326570a2fd624b0e32fd98182bba8c25fdd57ba861edebc1f00cfa66c04ec1c8a6f10fcee3

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\b937bb7b4e135b95760f5d310361e4ed\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll

Filesize
221KB

MD5
5849f6b4a98234a4a6bd34ce0aed7742

SHA1
114d17ab6d30b909dc41f5093e61ea3cf5d98219

SHA256
7bc9522099d7f6670a8b486dcafa9920fb06a7d44bb8ba5e810a26d4991cfd2d

SHA512
8952de7b39f844e854395ad39c4a7d36684a5c1d71e682b1bdb15cc0a63a4dd0bb8c3f7357a87f1966fdbd18daea81e14ac32e07eebd54c0fc368a19a441890e

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\bd1950e68286b869edc77261e0821c93\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll

Filesize
85KB

MD5
5180107f98e16bdca63e67e7e3169d22

SHA1
dd2e82756dcda2f5a82125c4d743b4349955068d

SHA256
d0658cbf473ef3666c758d28a1c4bcdcb25b2e515ad5251127d0906e65938f01

SHA512
27d785971c28181cf9115ab14de066931c4d81f8d357ea8b9eabfe0f70bd5848023b69948ac6a586989e892bcde40999f8895a0bd2e7a28bac7f2fa64bb22363

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\daa561280ac1119d9c2694442212aaea\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll

Filesize
487KB

MD5
aefa28d036740086ae52d157f245200a

SHA1
d502f55fa76c3cdb69c8ab97321cd9b9a4b68e55

SHA256
75127c1e3a30e544413d7eb24fd726bacf8c3a3951ddba1fc990ad00a7f1cc49

SHA512
3943c099644525fc2b3a50f843cc1612a003d4f92a9187b2fcecaaf90b33071bced0db4608a91bb59c6bf5d1f6f4eb158881bf78cced0597b7bc3045d9b66ee3

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\dbe51d156773fefd09c7a52feeb8ff79\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll

Filesize
298KB

MD5
5fd34a21f44ccbeda1bf502aa162a96a

SHA1
1f3b1286c01dea47be5e65cb72956a2355e1ae5e

SHA256
5d88539a1b7be77e11fe33572606c1093c54a80eea8bd3662f2ef5078a35ce01

SHA512
58c3904cd1a06fbd3a432b3b927e189a744282cc105eda6f0d7f406971ccbc942c7403c2dcbb2d042981cf53419ca5e2cf4d9f57175e45cc5c484b0c121bb125

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.VisualStu#\fe8d06712eb58d0150803744020b072a\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll

Filesize
43KB

MD5
dd1dfa421035fdfb6fd96d301a8c3d96

SHA1
d535030ad8d53d57f45bc14c7c7b69efd929efb3

SHA256
f71293fe6cf29af54d61bd2070df0a5ff17a661baf1b0b6c1d3393fd23ccd30c

SHA512
8e0f2bee9801a4eba974132811d7274e52e6e17ccd60e8b3f74959994f007bdb0c60eb9facb6321c0fdfbcc44e9a77d8c5c776d998ccce256fa864338a6f63b1

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiActivScp\ee22f412f6314443add3ca412afd6569\ehiActivScp.ni.dll

Filesize
124KB

MD5
929653b5b019b4555b25d55e6bf9987b

SHA1
993844805819ee445ff8136ee38c1aee70de3180

SHA256
2766353ca5c6a87169474692562282005905f1ca82eaa08e08223fc084dbb9a2

SHA512
effc809cca6170575efa7b4b23af9c49712ee9a7aaffd8f3a954c2d293be5be2cf3c388df4af2043f82b9b2ea041acdbb9d7ddd99a2fc744cce95cf4d820d013

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiVidCtl\11d57f5c033326954c0bc4f0b2680812\ehiVidCtl.ni.dll

Filesize
2.1MB

MD5
10b5a285eafccdd35390bb49861657e7

SHA1
62c05a4380e68418463529298058f3d2de19660d

SHA256
5f3bb3296ab50050e6b4ea7e95caa937720689db735c70309e5603a778be3a9a

SHA512
19ff9ac75f80814ed5124adc25fc2a6d1d7b825c770e1edb8f5b6990e44f9d2d0c1c0ed75b984e729709d603350055e5a543993a80033367810c417864df1452

Download Submit
C:\Windows\assembly\NativeImages_v2.0.50727_64\stdole\70f1aed4a280583cbd09e0f5d9bbc1f5\stdole.ni.dll

Filesize
88KB

MD5
1f394b5ca6924de6d9dbfb0e90ea50ef

SHA1
4e2caa5e98531c6fbf5728f4ae4d90a1ad150920

SHA256
9db0e4933b95ad289129c91cd9e14a0c530f42b55e8c92dc8c881bc3dd40b998

SHA512
e27ea0f7b59d41a85547d607ae3c05f32ce19fa5d008c8eaf11d0c253a73af3cfa6df25e3ee7f3920cd775e1a3a2db934e5891b4aafd4270d65a727b439f7476

Download Submit
C:\Windows\ehome\ehrecvr.exe

Filesize
1.2MB

MD5
e4130e348f67ea009f75ea3696d22b58

SHA1
bde1565031caeac5d921c25636f928bf12119f7e

SHA256
b7b694793ec3c5cde0ce7a515c533af6dd77306359423881a869212e5b4f4106

SHA512
97cdc11f5d948a5a21627aeb527f98d8e9d0c1207264125c36c8d2182c0219cae3f40d73e7a0adc7e040071688354a97d559054789240f8a9f7d9987003e6729

Download Submit
\Windows\System32\msdtc.exe

Filesize
1.5MB

MD5
37bd7a2512bc8a2c2524cb43561927a0

SHA1
e9b47481b84b36b18c2f4e2abba96e49024c5027

SHA256
14366e94945a174dadbc45265188030160d6a89451a9b571a9255a61325d45be

SHA512
4d648e1e1c9fbeed487b1766a75b8004aee703a9f2f7428da8fa1c96c0657e8c79fd76e802da39b0c7e8a36da052ed0431fdd840b41adbd19b77d40c06d71cc2

Download Submit
\Windows\System32\msiexec.exe

Filesize
1.5MB

MD5
4573875b7a3675a7859fe1b14aaafe17

SHA1
b4b5d10b929b31309d37cbb0f7773432b5452d38

SHA256
40ab55fd9295fcb906e2dbe117145ec821cd98ff8b5b864f959bd5aa95d4138b

SHA512
93466333d3972e1215ffd750fe64e9c34f55fe0e0c4cad005591fda7703d4c01334c6f07012fe7c7937aa5b3422a3b63857a9a42b882aba695aba1549a9ba209

Download Submit
\Windows\System32\snmptrap.exe

Filesize
1.4MB

MD5
d400e4f0699d1aa469a9213a2666549e

SHA1
1d26cb5860382304ba5a6298067427ca586436e8

SHA256
80227e17add6caf68b8fc1438fc1074904b746ce74274e942865bb58ded28058

SHA512
72ff10a19a1e374baf5ea1d34e26454b360818266af54cd1c5739b673c0f81a702473335df0404ff360bb6c775c62138af5edfb89b9e9504a9f3dc8bb744b2d6

Download Submit
\Windows\System32\wbem\WmiApSrv.exe

Filesize
1.6MB

MD5
b7a4e097c5413f911f0b475ad8e050f1

SHA1
387532ff34b1e5db74ac822f52671586eb9c2fc1

SHA256
a7918618825dd7af5e2db5a45ae15e3dddbe2b3ca4ac65d3a0ef97d536769684

SHA512
70a4a8322f41e937b08b14d11fc79fce5b940082a73cf47fd45f125994e15cdeb8275bb9ce76dd3640dad57ec7d4d972d070c62c3e098d30544746e412d67324

Download Submit
\Windows\System32\wbengine.exe

Filesize
2.0MB

MD5
6e0fc4b2136b010868780fe8e89b4bb7

SHA1
9f0c353bb3e0a6c7859cb1c5bb1b2f507a1dd9fb

SHA256
91cc5027072bb84d5b0742d965c639161b929b6ee0d9c040631042e77f2d503b

SHA512
c9809e30f7851b34ecb50daa5f3432c71cf7cfa325c49254b0ff72eb8d07fe2ec50bcfc178151cc3bc7cbabdbc7360eaa66b289c46e9b4d9adc73021bfc31da6

Download Submit
\Windows\ehome\ehsched.exe

Filesize
1.5MB

MD5
49cb3c17f088c39850f549a2af71c7e0

SHA1
21dffb6c6200130c602a5f9cddaa5c7c74ebfecf

SHA256
0f0560e7739e004fe5a54ec671d76e404ff981c0ef85971e17455c33f6d39ff1

SHA512
c955401638ec41a5b58db92d685a4373fc50cdc5ba1056620b35ca470457936c8c4680a1456ff53c759d8626e47d1c9d9fda2e1c5c55f928355b2058092332fb

Download Submit
memory/332-22-0x0000000001D50000-0x0000000001DB0000-memory.dmp

Filesize
384KB

Download
memory/332-8-0x0000000140000000-0x0000000140561000-memory.dmp

Filesize
5.4MB

Download
memory/332-19-0x0000000002620000-0x0000000002B81000-memory.dmp

Filesize
5.4MB

Download
memory/332-0-0x0000000001D50000-0x0000000001DB0000-memory.dmp

Filesize
384KB

Download
memory/332-26-0x0000000140000000-0x0000000140561000-memory.dmp

Filesize
5.4MB

Download
memory/332-6-0x0000000001D50000-0x0000000001DB0000-memory.dmp

Filesize
384KB

Download
memory/636-149-0x0000000000A60000-0x0000000000AC0000-memory.dmp

Filesize
384KB

Download
memory/636-155-0x0000000001980000-0x0000000001990000-memory.dmp

Filesize
64KB

Download
memory/636-156-0x0000000001990000-0x00000000019A0000-memory.dmp

Filesize
64KB

Download
memory/636-1341-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/636-151-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/636-241-0x0000000140000000-0x000000014013C000-memory.dmp

Filesize
1.2MB

Download
memory/636-143-0x0000000000A60000-0x0000000000AC0000-memory.dmp

Filesize
384KB

Download
memory/680-1455-0x0000000000C30000-0x0000000000C3C000-memory.dmp

Filesize
48KB

Download
memory/680-1456-0x000000001ACF0000-0x000000001AD38000-memory.dmp

Filesize
288KB

Download
memory/680-1457-0x00000000019F0000-0x0000000001A06000-memory.dmp

Filesize
88KB

Download
memory/680-1454-0x0000000000C20000-0x0000000000C2E000-memory.dmp

Filesize
56KB

Download
memory/704-818-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/704-805-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/920-248-0x0000000100000000-0x000000010016A000-memory.dmp

Filesize
1.4MB

Download
memory/920-369-0x0000000100000000-0x000000010016A000-memory.dmp

Filesize
1.4MB

Download
memory/924-219-0x0000000140000000-0x000000014019F000-memory.dmp

Filesize
1.6MB

Download
memory/924-211-0x0000000140000000-0x000000014019F000-memory.dmp

Filesize
1.6MB

Download
memory/1004-575-0x0000000100000000-0x00000001001E9000-memory.dmp

Filesize
1.9MB

Download
memory/1004-262-0x0000000100000000-0x00000001001E9000-memory.dmp

Filesize
1.9MB

Download
memory/1052-1496-0x000000001AD80000-0x000000001AD9E000-memory.dmp

Filesize
120KB

Download
memory/1052-1495-0x000000001AD60000-0x000000001AD7A000-memory.dmp

Filesize
104KB

Download
memory/1052-1494-0x000000001ACC0000-0x000000001ACCE000-memory.dmp

Filesize
56KB

Download
memory/1052-1493-0x0000000001880000-0x0000000001898000-memory.dmp

Filesize
96KB

Download
memory/1320-227-0x0000000000660000-0x00000000007E7000-memory.dmp

Filesize
1.5MB

Download
memory/1320-226-0x0000000100000000-0x0000000100187000-memory.dmp

Filesize
1.5MB

Download
memory/1320-299-0x0000000000660000-0x00000000007E7000-memory.dmp

Filesize
1.5MB

Download
memory/1320-298-0x0000000100000000-0x0000000100187000-memory.dmp

Filesize
1.5MB

Download
memory/1420-1277-0x0000000140000000-0x0000000140187000-memory.dmp

Filesize
1.5MB

Download
memory/1420-163-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Filesize
384KB

Download
memory/1420-242-0x0000000140000000-0x0000000140187000-memory.dmp

Filesize
1.5MB

Download
memory/1420-176-0x0000000140000000-0x0000000140187000-memory.dmp

Filesize
1.5MB

Download
memory/1420-157-0x0000000000B80000-0x0000000000BE0000-memory.dmp

Filesize
384KB

Download
memory/1636-284-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/1636-216-0x0000000140000000-0x000000014018B000-memory.dmp

Filesize
1.5MB

Download
memory/1688-64-0x0000000010000000-0x000000001017C000-memory.dmp

Filesize
1.5MB

Download
memory/1688-54-0x0000000010000000-0x000000001017C000-memory.dmp

Filesize
1.5MB

Download
memory/1772-168-0x0000000000890000-0x00000000008F0000-memory.dmp

Filesize
384KB

Download
memory/1772-255-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1772-178-0x0000000140000000-0x0000000140237000-memory.dmp

Filesize
2.2MB

Download
memory/1780-65-0x0000000010000000-0x0000000010174000-memory.dmp

Filesize
1.5MB

Download
memory/1780-47-0x0000000010000000-0x0000000010174000-memory.dmp

Filesize
1.5MB

Download
memory/2076-74-0x00000000007E0000-0x0000000000846000-memory.dmp

Filesize
408KB

Download
memory/2076-69-0x00000000007E0000-0x0000000000846000-memory.dmp

Filesize
408KB

Download
memory/2076-68-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2076-228-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2100-271-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2100-200-0x000000002E000000-0x000000002FE1E000-memory.dmp

Filesize
30.1MB

Download
memory/2104-339-0x0000000001000000-0x000000000116B000-memory.dmp

Filesize
1.4MB

Download
memory/2104-245-0x0000000001000000-0x000000000116B000-memory.dmp

Filesize
1.4MB

Download
memory/2160-36-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2160-42-0x0000000000400000-0x0000000000460000-memory.dmp

Filesize
384KB

Download
memory/2160-34-0x0000000140000000-0x0000000140172000-memory.dmp

Filesize
1.4MB

Download
memory/2160-197-0x0000000140000000-0x0000000140172000-memory.dmp

Filesize
1.4MB

Download
memory/2224-772-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2224-758-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2276-177-0x0000000140000000-0x0000000140561000-memory.dmp

Filesize
5.4MB

Download
memory/2276-10-0x0000000001CA0000-0x0000000001D00000-memory.dmp

Filesize
384KB

Download
memory/2276-20-0x0000000140000000-0x0000000140561000-memory.dmp

Filesize
5.4MB

Download
memory/2276-16-0x0000000001CA0000-0x0000000001D00000-memory.dmp

Filesize
384KB

Download
memory/2372-272-0x0000000100000000-0x0000000100219000-memory.dmp

Filesize
2.1MB

Download
memory/2372-581-0x0000000100000000-0x0000000100219000-memory.dmp

Filesize
2.1MB

Download
memory/2568-1511-0x000000001ACF0000-0x000000001AD06000-memory.dmp

Filesize
88KB

Download
memory/2568-1510-0x000000001ACE0000-0x000000001ACEE000-memory.dmp

Filesize
56KB

Download
memory/2568-1508-0x0000000001990000-0x00000000019A8000-memory.dmp

Filesize
96KB

Download
memory/2568-1509-0x000000001ACD0000-0x000000001ACDC000-memory.dmp

Filesize
48KB

Download
memory/2576-326-0x000000002E000000-0x000000002E18A000-memory.dmp

Filesize
1.5MB

Download
memory/2576-238-0x000000002E000000-0x000000002E18A000-memory.dmp

Filesize
1.5MB

Download
memory/2776-276-0x0000000100000000-0x0000000100202000-memory.dmp

Filesize
2.0MB

Download
memory/2776-596-0x0000000100000000-0x0000000100202000-memory.dmp

Filesize
2.0MB

Download
memory/2832-761-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2832-666-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2884-515-0x0000000100000000-0x000000010016B000-memory.dmp

Filesize
1.4MB

Download
memory/2884-256-0x0000000100000000-0x000000010016B000-memory.dmp

Filesize
1.4MB

Download
memory/2932-793-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2932-807-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/2972-88-0x0000000000600000-0x0000000000660000-memory.dmp

Filesize
384KB

Download
memory/2972-90-0x0000000140000000-0x0000000140183000-memory.dmp

Filesize
1.5MB

Download
memory/2972-82-0x0000000000600000-0x0000000000660000-memory.dmp

Filesize
384KB

Download
memory/3048-1278-0x0000000140000000-0x0000000140183000-memory.dmp

Filesize
1.5MB

Download
memory/3048-182-0x0000000140000000-0x0000000140183000-memory.dmp

Filesize
1.5MB

Download
memory/3048-261-0x0000000140000000-0x0000000140183000-memory.dmp

Filesize
1.5MB

Download
memory/3136-749-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/3136-652-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/3208-297-0x0000000100000000-0x0000000100199000-memory.dmp

Filesize
1.6MB

Download
memory/3208-597-0x0000000100000000-0x0000000100199000-memory.dmp

Filesize
1.6MB

Download
memory/3296-304-0x0000000100000000-0x000000010020A000-memory.dmp

Filesize
2.0MB

Download
memory/3296-643-0x0000000100000000-0x000000010020A000-memory.dmp

Filesize
2.0MB

Download
memory/3316-1467-0x0000000001890000-0x000000000189E000-memory.dmp

Filesize
56KB

Download
memory/3316-1471-0x000000001AD10000-0x000000001AD26000-memory.dmp

Filesize
88KB

Download
memory/3316-1470-0x000000001ACC0000-0x000000001AD08000-memory.dmp

Filesize
288KB

Download
memory/3316-1469-0x000000001ACB0000-0x000000001ACBC000-memory.dmp

Filesize
48KB

Download
memory/3316-1475-0x000000001ADD0000-0x000000001ADDE000-memory.dmp

Filesize
56KB

Download
memory/3316-1474-0x000000001ADD0000-0x000000001ADDE000-memory.dmp

Filesize
56KB

Download
memory/3428-785-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/3428-770-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/3448-815-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/3448-828-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/3508-626-0x0000000140000000-0x0000000140183000-memory.dmp

Filesize
1.5MB

Download
memory/3508-327-0x0000000140000000-0x0000000140183000-memory.dmp

Filesize
1.5MB

Download
memory/3608-757-0x0000000100000000-0x0000000100123000-memory.dmp

Filesize
1.1MB

Download
memory/3608-340-0x0000000100000000-0x0000000100123000-memory.dmp

Filesize
1.1MB

Download
memory/3660-634-0x0000000140000000-0x0000000140183000-memory.dmp

Filesize
1.5MB

Download
memory/3660-615-0x0000000140000000-0x0000000140183000-memory.dmp

Filesize
1.5MB

Download
memory/3852-782-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/3852-796-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/3916-655-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/3916-644-0x0000000000400000-0x000000000057D000-memory.dmp

Filesize
1.5MB

Download
memory/3916-878-0x0000000003CB0000-0x0000000003D6A000-memory.dmp

Filesize
744KB

Download