Overview

overview

10

Static

static

5

PO -967780...��.exe

windows7-x64

10

PO -967780...��.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    12/11/2024, 02:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    PO -96778097 HHIC 137 IMO 9730086-HYU24111103-프로젝트 순서.exe
  • Size 1.7MB
  • Sample241112-chvbjasdll
  • SHA256 8082ea9624bb02dd681c092c1fbddf363c145b8a633441dde6170e7eb151d8ef
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
remcosremotehostcollectiondiscoveryratspywarestealer

Malware Config

Extracted

Family

  • remcos

Botnet

  • RemoteHost

C2

  • 162.251.122.86:6644

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    false

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-CGA6IQ

  • screenshot_crypt

    false

  • screenshot_flag

    false

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Signatures

  • Remcos

    Remcos is a closed-source remote control and surveillance software.

    ratremcos
  • Remcos family
    remcos
  • Drops startup file 1 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
    collection
  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory 24 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO -96778097 HHIC 137 IMO 9730086-HYU24111103-프로젝트 순서.exe
    "C:\Users\Admin\AppData\Local\Temp\PO -96778097 HHIC 137 IMO 9730086-HYU24111103-프로젝트 순서.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2584
    • C:\Users\Admin\AppData\Local\troopwise\conged.exe
      "C:\Users\Admin\AppData\Local\Temp\PO -96778097 HHIC 137 IMO 9730086-HYU24111103-프로젝트 순서.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1880
      • C:\Windows\SysWOW64\svchost.exe
        "C:\Users\Admin\AppData\Local\Temp\PO -96778097 HHIC 137 IMO 9730086-HYU24111103-프로젝트 순서.exe"
        3⤵
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Drops file in Program Files directory
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2824
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\poyqmdkunqybivotqcox"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:1488
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\aqdimwvvbyqokjdxhnjycla"
          4⤵
          • Accesses Microsoft Outlook accounts
          PID:1696
        • C:\Windows\SysWOW64\svchost.exe
          C:\Windows\SysWOW64\svchost.exe /stext "C:\Users\Admin\AppData\Local\Temp\ckibnogppgitvprbqywafyuvdk"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:708
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2248
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    PID:2848
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:2140
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1724
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2384
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1020
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2052
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 258 -NGENProcess 248 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1516
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 24c -NGENProcess 254 -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1288
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 24c -InterruptEvent 1ec -NGENProcess 258 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1420
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 1d0 -NGENProcess 264 -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2616
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 248 -NGENProcess 258 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2832
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 268 -NGENProcess 1ec -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2796
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 270 -NGENProcess 264 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2512
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 278 -NGENProcess 254 -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1704
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 280 -NGENProcess 25c -Pipe 27c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2580
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 288 -NGENProcess 258 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1288
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 290 -NGENProcess 1ec -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1572
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 298 -NGENProcess 264 -Pipe 294 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:636
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2a0 -NGENProcess 254 -Pipe 29c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1544
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 278 -NGENProcess 268 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:340
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 280 -InterruptEvent 2a4 -NGENProcess 2a0 -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2520
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 240 -NGENProcess 2a8 -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2612
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 25c -InterruptEvent 240 -NGENProcess 2a4 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:544
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 268 -NGENProcess 2a8 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2788
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 268 -NGENProcess 240 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2296
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 248 -NGENProcess 2a8 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2588
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1ec -InterruptEvent 258 -NGENProcess 260 -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2844
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 288 -InterruptEvent 1f4 -NGENProcess 278 -Pipe 21c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1212
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 238 -NGENProcess 298 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2296
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 244 -NGENProcess 23c -Pipe 24c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2328
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 1e4 -NGENProcess 278 -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:936
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 220 -NGENProcess 298 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:3068
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 1c0 -NGENProcess 1e4 -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:884
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 238 -NGENProcess 298 -Pipe 25c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:2932
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 298 -NGENProcess 220 -Pipe 2a0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1720
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2a8 -NGENProcess 1e4 -Pipe 1f4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2324
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 1e4 -NGENProcess 238 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 258 -NGENProcess 220 -Pipe 1c0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:936
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 220 -NGENProcess 2a8 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1880
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 220 -InterruptEvent 260 -NGENProcess 238 -Pipe 298 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:1924
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 238 -NGENProcess 258 -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
        PID:1716
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 248 -NGENProcess 2a8 -Pipe 1e4 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:2368
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 2a8 -NGENProcess 260 -Pipe 240 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2920
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 264 -NGENProcess 258 -Pipe 220 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:960
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 258 -NGENProcess 248 -Pipe 2a4 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:2288
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 2b4 -NGENProcess 260 -Pipe 238 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:544
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 264 -NGENProcess 2bc -Pipe 258 -Comment "NGen Worker Process"
        2⤵
        • System Location Discovery: System Language Discovery
        PID:1924
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 23c -NGENProcess 260 -Pipe 2a8 -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:2768
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 23c -InterruptEvent 260 -NGENProcess 2b8 -Pipe 2b4 -Comment "NGen Worker Process"
        2⤵
          PID:2296
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 2c4 -NGENProcess 2bc -Pipe 278 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          PID:920
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c4 -InterruptEvent 2bc -NGENProcess 23c -Pipe 2c0 -Comment "NGen Worker Process"
          2⤵
          • System Location Discovery: System Language Discovery
          PID:960
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 2cc -NGENProcess 2b8 -Pipe 264 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:1880
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2cc -InterruptEvent 2bc -NGENProcess 2c8 -Pipe 2b0 -Comment "NGen Worker Process"
          2⤵
            PID:2496
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2bc -InterruptEvent 1cc -NGENProcess 2d0 -Pipe 260 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2208
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1cc -InterruptEvent 2d0 -NGENProcess 2cc -Pipe 2b8 -Comment "NGen Worker Process"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:688
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2dc -NGENProcess 2c8 -Pipe 2c4 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:1612
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2d0 -NGENProcess 2d8 -Pipe 248 -Comment "NGen Worker Process"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2436
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2d4 -NGENProcess 2e0 -Pipe 2bc -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            PID:2640
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d4 -InterruptEvent 2e0 -NGENProcess 2dc -Pipe 2c8 -Comment "NGen Worker Process"
            2⤵
            • System Location Discovery: System Language Discovery
            PID:2424
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2ec -NGENProcess 2d8 -Pipe 1cc -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:844
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2ec -InterruptEvent 2d8 -NGENProcess 2d4 -Pipe 2e8 -Comment "NGen Worker Process"
            2⤵
              PID:2196
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2f4 -NGENProcess 2dc -Pipe 2d0 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:1772
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f4 -InterruptEvent 2dc -NGENProcess 2ec -Pipe 2f0 -Comment "NGen Worker Process"
              2⤵
              • Modifies data under HKEY_USERS
              PID:1388
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 2fc -NGENProcess 2d4 -Pipe 2e0 -Comment "NGen Worker Process"
              2⤵
                PID:1792
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2fc -InterruptEvent 300 -NGENProcess 2f4 -Pipe 23c -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1656
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 2e4 -NGENProcess 2d4 -Pipe 2d8 -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:2236
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e4 -InterruptEvent 308 -NGENProcess 2dc -Pipe 2cc -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:1544
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 2dc -NGENProcess 300 -Pipe 2f4 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:2304
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2dc -InterruptEvent 300 -NGENProcess 304 -Pipe 2d4 -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:1924
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 314 -NGENProcess 30c -Pipe 2fc -Comment "NGen Worker Process"
                2⤵
                  PID:956
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 314 -InterruptEvent 318 -NGENProcess 310 -Pipe 2e4 -Comment "NGen Worker Process"
                  2⤵
                  • Modifies data under HKEY_USERS
                  PID:2920
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 304 -Pipe 308 -Comment "NGen Worker Process"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:920
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 320 -NGENProcess 314 -Pipe 31c -Comment "NGen Worker Process"
                  2⤵
                    PID:2472
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 2f8 -NGENProcess 304 -Pipe 2dc -Comment "NGen Worker Process"
                    2⤵
                      PID:1720
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 328 -NGENProcess 318 -Pipe 2ec -Comment "NGen Worker Process"
                      2⤵
                        PID:2320
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 314 -Pipe 324 -Comment "NGen Worker Process"
                        2⤵
                          PID:1840
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 304 -Pipe 30c -Comment "NGen Worker Process"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1876
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 318 -Pipe 300 -Comment "NGen Worker Process"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:1388
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 314 -Pipe 320 -Comment "NGen Worker Process"
                          2⤵
                            PID:1868
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 304 -Pipe 2f8 -Comment "NGen Worker Process"
                            2⤵
                              PID:652
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 334 -NGENProcess 344 -Pipe 338 -Comment "NGen Worker Process"
                              2⤵
                                PID:848
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 328 -NGENProcess 304 -Pipe 32c -Comment "NGen Worker Process"
                                2⤵
                                  PID:1992
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 348 -NGENProcess 33c -Pipe 310 -Comment "NGen Worker Process"
                                  2⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3016
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 344 -Pipe 330 -Comment "NGen Worker Process"
                                  2⤵
                                  • Modifies data under HKEY_USERS
                                  PID:1904
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 304 -Pipe 318 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:2524
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 33c -Pipe 340 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:1656
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 344 -Pipe 334 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:1648
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 304 -Pipe 328 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:1532
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 350 -NGENProcess 33c -Pipe 364 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:544
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 348 -NGENProcess 360 -Pipe 34c -Comment "NGen Worker Process"
                                            2⤵
                                              PID:288
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 368 -NGENProcess 304 -Pipe 314 -Comment "NGen Worker Process"
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:1296
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 36c -NGENProcess 33c -Pipe 354 -Comment "NGen Worker Process"
                                              2⤵
                                              • Modifies data under HKEY_USERS
                                              PID:1924
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 36c -NGENProcess 368 -Pipe 360 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:1792
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 358 -NGENProcess 33c -Pipe 35c -Comment "NGen Worker Process"
                                                2⤵
                                                • Modifies data under HKEY_USERS
                                                PID:2296
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 378 -NGENProcess 348 -Pipe 344 -Comment "NGen Worker Process"
                                                2⤵
                                                • Modifies data under HKEY_USERS
                                                PID:1196
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 36c -NGENProcess 37c -Pipe 378 -Comment "NGen Worker Process"
                                                2⤵
                                                • Modifies data under HKEY_USERS
                                                PID:2120
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 374 -NGENProcess 348 -Pipe 350 -Comment "NGen Worker Process"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:888
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 384 -NGENProcess 368 -Pipe 304 -Comment "NGen Worker Process"
                                                2⤵
                                                • Modifies data under HKEY_USERS
                                                PID:2640
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 37c -Pipe 380 -Comment "NGen Worker Process"
                                                2⤵
                                                • Modifies data under HKEY_USERS
                                                PID:2736
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 348 -Pipe 358 -Comment "NGen Worker Process"
                                                2⤵
                                                • System Location Discovery: System Language Discovery
                                                • Modifies data under HKEY_USERS
                                                PID:2524
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 368 -Pipe 370 -Comment "NGen Worker Process"
                                                2⤵
                                                • Modifies data under HKEY_USERS
                                                PID:2364
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 37c -Pipe 36c -Comment "NGen Worker Process"
                                                2⤵
                                                • Modifies data under HKEY_USERS
                                                PID:1448
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 348 -Pipe 374 -Comment "NGen Worker Process"
                                                2⤵
                                                • Modifies data under HKEY_USERS
                                                PID:1880
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 39c -NGENProcess 368 -Pipe 384 -Comment "NGen Worker Process"
                                                2⤵
                                                • Loads dropped DLL
                                                • Drops file in Windows directory
                                                • Modifies data under HKEY_USERS
                                                PID:1444
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 368 -NGENProcess 394 -Pipe 37c -Comment "NGen Worker Process"
                                                2⤵
                                                • Modifies data under HKEY_USERS
                                                PID:2080
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 368 -InterruptEvent 3a4 -NGENProcess 348 -Pipe 38c -Comment "NGen Worker Process"
                                                2⤵
                                                • Loads dropped DLL
                                                • Drops file in Windows directory
                                                • Modifies data under HKEY_USERS
                                                PID:2508
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 39c -NGENProcess 3ac -Pipe 368 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:564
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 390 -NGENProcess 348 -Pipe 398 -Comment "NGen Worker Process"
                                                  2⤵
                                                  • Loads dropped DLL
                                                  • Drops file in Windows directory
                                                  • Modifies data under HKEY_USERS
                                                  PID:2340
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 348 -NGENProcess 3a8 -Pipe 3a4 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:1928
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 3b4 -NGENProcess 3ac -Pipe 388 -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:2772
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3b8 -NGENProcess 3b0 -Pipe 3a0 -Comment "NGen Worker Process"
                                                      2⤵
                                                      • Loads dropped DLL
                                                      • Drops file in Windows directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Modifies data under HKEY_USERS
                                                      PID:1444
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b8 -InterruptEvent 3b0 -NGENProcess 348 -Pipe 3a8 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:1388
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 3c0 -NGENProcess 3ac -Pipe 33c -Comment "NGen Worker Process"
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2392
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3c4 -NGENProcess 3bc -Pipe 390 -Comment "NGen Worker Process"
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:1648
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 348 -Pipe 3b4 -Comment "NGen Worker Process"
                                                        2⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2940
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 3ac -Pipe 39c -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:1892
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 3bc -Pipe 3b8 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:404
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 348 -Pipe 3b0 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:2364
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3cc -NGENProcess 3dc -Pipe 3d0 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:1656
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3c0 -NGENProcess 348 -Pipe 3c4 -Comment "NGen Worker Process"
                                                              2⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:328
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c0 -InterruptEvent 3e0 -NGENProcess 3bc -Pipe 3d4 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:1788
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 3e4 -NGENProcess 3dc -Pipe 3c8 -Comment "NGen Worker Process"
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2780
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3cc -NGENProcess 348 -Pipe 3ec -Comment "NGen Worker Process"
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:672
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3ac -NGENProcess 3e8 -Pipe 3d8 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:1928
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 3f0 -NGENProcess 3dc -Pipe 394 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:2768
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 348 -Pipe 3c0 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:2612
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 3cc -NGENProcess 3ac -Pipe 3f0 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                    • System Location Discovery: System Language Discovery
                                                                    PID:688
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3e0 -NGENProcess 3f8 -Pipe 3e4 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:2736
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e0 -InterruptEvent 404 -NGENProcess 3f4 -Pipe 3bc -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:2296
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 408 -NGENProcess 3ac -Pipe 348 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:1932
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 40c -NGENProcess 3f8 -Pipe 3e8 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                          • Loads dropped DLL
                                                                          • Drops file in Windows directory
                                                                          PID:2288
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 3f8 -NGENProcess 404 -Pipe 3f4 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:2640
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 414 -NGENProcess 3ac -Pipe 3cc -Comment "NGen Worker Process"
                                                                            2⤵
                                                                            • Loads dropped DLL
                                                                            • Drops file in Windows directory
                                                                            PID:1364
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 3ac -NGENProcess 40c -Pipe 410 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:936
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ac -InterruptEvent 41c -NGENProcess 404 -Pipe 408 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1888
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 420 -NGENProcess 418 -Pipe 3fc -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:884
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 428 -NGENProcess 40c -Pipe 424 -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:2420
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 428 -NGENProcess 420 -Pipe 3dc -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:2940
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 414 -NGENProcess 430 -Pipe 3f8 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • Loads dropped DLL
                                                                                      • Drops file in Windows directory
                                                                                      PID:2080
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 430 -NGENProcess 40c -Pipe 420 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:956
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 434 -NGENProcess 428 -Pipe 3ac -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • Drops file in Windows directory
                                                                                      PID:1508
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 428 -NGENProcess 414 -Pipe 3e0 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2436
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 43c -NGENProcess 40c -Pipe 404 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:1160
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 440 -NGENProcess 438 -Pipe 418 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:1716
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 448 -NGENProcess 414 -Pipe 444 -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          PID:1412
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 414 -NGENProcess 43c -Pipe 41c -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:1904
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 44c -NGENProcess 428 -Pipe 3f8 -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:2564
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 44c -InterruptEvent 428 -NGENProcess 448 -Pipe 430 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:2336
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 434 -NGENProcess 450 -Pipe 440 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:2688
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 434 -InterruptEvent 458 -NGENProcess 40c -Pipe 438 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                  • Drops file in Windows directory
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  PID:1312
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 40c -NGENProcess 428 -Pipe 448 -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:2060
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 428 -NGENProcess 40c -Pipe 460 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    PID:2328
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 40c -NGENProcess 450 -Pipe 45c -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:3068
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 468 -NGENProcess 454 -Pipe 434 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:1508
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 454 -NGENProcess 44c -Pipe 470 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2436
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 414 -NGENProcess 46c -Pipe 458 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:896
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 468 -NGENProcess 478 -Pipe 454 -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                          • Drops file in Windows directory
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          PID:1296
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 468 -InterruptEvent 478 -NGENProcess 40c -Pipe 46c -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:2768
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 47c -NGENProcess 414 -Pipe 450 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:636
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 47c -InterruptEvent 480 -NGENProcess 43c -Pipe 428 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2564
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 484 -NGENProcess 40c -Pipe 474 -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:1016
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 484 -InterruptEvent 488 -NGENProcess 414 -Pipe 464 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  PID:2932
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 414 -NGENProcess 480 -Pipe 43c -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  PID:1716
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 414 -InterruptEvent 490 -NGENProcess 40c -Pipe 478 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  PID:628
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 488 -NGENProcess 498 -Pipe 414 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                  • Drops file in Windows directory
                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                  PID:444
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 498 -NGENProcess 48c -Pipe 40c -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:2152
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 49c -NGENProcess 490 -Pipe 44c -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:2596
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 49c -InterruptEvent 4a0 -NGENProcess 47c -Pipe 468 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2120
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a0 -InterruptEvent 4a4 -NGENProcess 48c -Pipe 494 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:1500
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a4 -InterruptEvent 4a8 -NGENProcess 490 -Pipe 484 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:888
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4ac -NGENProcess 47c -Pipe 488 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            PID:2208
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 4b0 -NGENProcess 48c -Pipe 498 -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:628
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4b4 -NGENProcess 490 -Pipe 49c -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:3020
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 4b8 -NGENProcess 47c -Pipe 4a0 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:1892
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 4b0 -NGENProcess 4c0 -Pipe 4b4 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:2564
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4a4 -NGENProcess 47c -Pipe 4a8 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:1648
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 204 -NGENProcess 4b8 -Pipe 48c -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:2656
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 4c0 -NGENProcess 4a4 -Pipe 490 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1080
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 4ac -NGENProcess 4c8 -Pipe 4b0 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:2060
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 480 -NGENProcess 4b8 -Pipe 208 -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:1044
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 4cc -NGENProcess 4a4 -Pipe 47c -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:816
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 4d0 -NGENProcess 4c8 -Pipe 4bc -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:2304
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4c8 -NGENProcess 4ac -Pipe 4d8 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:2436
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 204 -NGENProcess 4d4 -Pipe 4c0 -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                  PID:2616
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 204 -InterruptEvent 4dc -NGENProcess 4cc -Pipe 4b8 -Comment "NGen Worker Process"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:288
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4e0 -NGENProcess 4ac -Pipe 4c4 -Comment "NGen Worker Process"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2656
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 4e4 -NGENProcess 4d4 -Pipe 480 -Comment "NGen Worker Process"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1080
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e4 -InterruptEvent 4e8 -NGENProcess 4cc -Pipe 4d0 -Comment "NGen Worker Process"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:1792
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4ec -NGENProcess 4e0 -Pipe 4e8 -Comment "NGen Worker Process"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:628
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ec -InterruptEvent 4c8 -NGENProcess 4cc -Pipe 204 -Comment "NGen Worker Process"
                                                                                                                                                            2⤵
                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                            PID:3020
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 4dc -NGENProcess 4f8 -Pipe 4ec -Comment "NGen Worker Process"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:376
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4a4 -NGENProcess 4cc -Pipe 4f0 -Comment "NGen Worker Process"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:652
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4fc -InterruptEvent 4a4 -NGENProcess 4dc -Pipe 4c8 -Comment "NGen Worker Process"
                                                                                                                                                                2⤵
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:2780
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a4 -InterruptEvent 4d4 -NGENProcess 4cc -Pipe 4ac -Comment "NGen Worker Process"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2588
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 504 -NGENProcess 4f4 -Pipe 4e0 -Comment "NGen Worker Process"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2656
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 504 -InterruptEvent 508 -NGENProcess 4dc -Pipe 500 -Comment "NGen Worker Process"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2080
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 50c -NGENProcess 4cc -Pipe 4e4 -Comment "NGen Worker Process"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1792
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 510 -NGENProcess 4f4 -Pipe 4fc -Comment "NGen Worker Process"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:628
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 514 -NGENProcess 4dc -Pipe 4a4 -Comment "NGen Worker Process"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:884
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 518 -NGENProcess 4cc -Pipe 4d4 -Comment "NGen Worker Process"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:2436
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 51c -InterruptEvent 518 -NGENProcess 514 -Pipe 4f4 -Comment "NGen Worker Process"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1612
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 518 -InterruptEvent 504 -NGENProcess 4cc -Pipe 508 -Comment "NGen Worker Process"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2432
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 504 -InterruptEvent 524 -NGENProcess 510 -Pipe 4f8 -Comment "NGen Worker Process"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:2060
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 524 -InterruptEvent 528 -NGENProcess 514 -Pipe 520 -Comment "NGen Worker Process"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1788
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 514 -NGENProcess 4cc -Pipe 50c -Comment "NGen Worker Process"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                    PID:936
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 514 -InterruptEvent 538 -NGENProcess 510 -Pipe 534 -Comment "NGen Worker Process"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2240
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 53c -NGENProcess 518 -Pipe 530 -Comment "NGen Worker Process"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:1312
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 540 -NGENProcess 4cc -Pipe 504 -Comment "NGen Worker Process"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:2892
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 540 -NGENProcess 53c -Pipe 510 -Comment "NGen Worker Process"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:672
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 52c -NGENProcess 4cc -Pipe 528 -Comment "NGen Worker Process"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:2020
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 52c -InterruptEvent 54c -NGENProcess 538 -Pipe 51c -Comment "NGen Worker Process"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:844
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 550 -NGENProcess 53c -Pipe 548 -Comment "NGen Worker Process"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:444
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 550 -InterruptEvent 554 -NGENProcess 4cc -Pipe 514 -Comment "NGen Worker Process"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:2708
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 558 -NGENProcess 538 -Pipe 544 -Comment "NGen Worker Process"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1720
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 558 -NGENProcess 554 -Pipe 53c -Comment "NGen Worker Process"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2736
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 540 -NGENProcess 538 -Pipe 52c -Comment "NGen Worker Process"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1840
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 564 -NGENProcess 550 -Pipe 518 -Comment "NGen Worker Process"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1716
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 564 -InterruptEvent 568 -NGENProcess 554 -Pipe 560 -Comment "NGen Worker Process"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:2408
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 568 -InterruptEvent 554 -NGENProcess 558 -Pipe 570 -Comment "NGen Worker Process"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:2196
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 54c -NGENProcess 56c -Pipe 55c -Comment "NGen Worker Process"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:956
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 54c -NGENProcess 564 -Pipe 4cc -Comment "NGen Worker Process"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1788
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 578 -NGENProcess 558 -Pipe 538 -Comment "NGen Worker Process"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:564
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 558 -NGENProcess 554 -Pipe 580 -Comment "NGen Worker Process"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1704
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 540 -NGENProcess 57c -Pipe 568 -Comment "NGen Worker Process"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2056
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 588 -NGENProcess 54c -Pipe 584 -Comment "NGen Worker Process"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2280
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 588 -InterruptEvent 58c -NGENProcess 564 -Pipe 550 -Comment "NGen Worker Process"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1628
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 540 -NGENProcess 590 -Pipe 588 -Comment "NGen Worker Process"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:2772
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 578 -NGENProcess 564 -Pipe 56c -Comment "NGen Worker Process"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2060
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 594 -NGENProcess 58c -Pipe 54c -Comment "NGen Worker Process"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:956
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 594 -InterruptEvent 598 -NGENProcess 590 -Pipe 574 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:2236
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 598 -InterruptEvent 59c -NGENProcess 564 -Pipe 57c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1952
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 5a0 -NGENProcess 58c -Pipe 554 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1044
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 5a4 -NGENProcess 590 -Pipe 540 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:2340
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 59c -NGENProcess 5a8 -Pipe 5a0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:2476
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 594 -InterruptEvent 59c -NGENProcess 578 -Pipe 590 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:864
                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 558 -NGENProcess 5a8 -Pipe 58c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2416
                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 5a8 -NGENProcess 1c4 -Pipe 5b4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:2796
                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a8 -InterruptEvent 1c4 -NGENProcess 564 -Pipe 5b8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2472
                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c4 -InterruptEvent 5ac -NGENProcess 598 -Pipe 5a4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:2564
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5ac -InterruptEvent 5bc -NGENProcess 558 -Pipe 578 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1676
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c0 -InterruptEvent 5bc -NGENProcess 5ac -Pipe 564 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:2780
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5bc -InterruptEvent 5b0 -NGENProcess 558 -Pipe 594 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:2344
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5b0 -InterruptEvent 5c8 -NGENProcess 1c4 -Pipe 59c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:404
                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5c8 -InterruptEvent 5cc -NGENProcess 5ac -Pipe 5c4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                          PID:2772
                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5cc -InterruptEvent 5d0 -NGENProcess 558 -Pipe 5a8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:816
                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d0 -InterruptEvent 5d4 -NGENProcess 1c4 -Pipe 5c0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:956
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d4 -InterruptEvent 5d8 -NGENProcess 5ac -Pipe 5bc -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:940
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5d8 -InterruptEvent 5dc -NGENProcess 558 -Pipe 5b0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1840
                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5dc -InterruptEvent 5e0 -NGENProcess 1c4 -Pipe 5c8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:856
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5e0 -InterruptEvent 5e4 -NGENProcess 5ac -Pipe 5cc -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:2420
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5e4 -InterruptEvent 5e8 -NGENProcess 558 -Pipe 5d0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1108
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5e8 -InterruptEvent 5ec -NGENProcess 1c4 -Pipe 5d4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:2216
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5ec -InterruptEvent 5f0 -NGENProcess 5ac -Pipe 5d8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:2656
                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f0 -InterruptEvent 5f4 -NGENProcess 558 -Pipe 5dc -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:960
                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f4 -InterruptEvent 5f8 -NGENProcess 1c4 -Pipe 5e0 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1364
                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5f8 -InterruptEvent 5fc -NGENProcess 5ac -Pipe 5e4 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1212
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 60c -InterruptEvent 600 -NGENProcess 5ec -Pipe 608 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:2264
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 624 -InterruptEvent 610 -NGENProcess 5ec -Pipe 60c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1880
                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 610 -InterruptEvent 664 -NGENProcess 618 -Pipe 660 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:2280
                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 664 -InterruptEvent 668 -NGENProcess 654 -Pipe 65c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1392
                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 668 -InterruptEvent 66c -NGENProcess 5ec -Pipe 5e8 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:864
                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 66c -InterruptEvent 670 -NGENProcess 618 -Pipe 614 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:1772
                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 670 -InterruptEvent 674 -NGENProcess 654 -Pipe 624 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:3020
                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 674 -InterruptEvent 678 -NGENProcess 5ec -Pipe 658 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:1708
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 678 -InterruptEvent 67c -NGENProcess 618 -Pipe 664 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:1932
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 67c -InterruptEvent 680 -NGENProcess 654 -Pipe 668 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:2400
                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 680 -InterruptEvent 684 -NGENProcess 5ec -Pipe 66c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1628
                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 684 -InterruptEvent 688 -NGENProcess 618 -Pipe 670 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:636
                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 688 -InterruptEvent 68c -NGENProcess 654 -Pipe 674 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:2808
                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 68c -InterruptEvent 690 -NGENProcess 5ec -Pipe 678 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:2304
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 690 -InterruptEvent 694 -NGENProcess 618 -Pipe 67c -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:2796
                                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 694 -InterruptEvent 698 -NGENProcess 654 -Pipe 680 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1224
                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 698 -InterruptEvent 69c -NGENProcess 5ec -Pipe 684 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:1160
                                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:1784
                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 234 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:2936
                                                                                                                                                                                                                                                                                                        • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                          PID:1084
                                                                                                                                                                                                                                                                                                        • C:\Windows\ehome\ehsched.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\ehome\ehsched.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:1904
                                                                                                                                                                                                                                                                                                        • C:\Windows\eHome\EhTray.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                                                                          • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                                                                                                          PID:1196
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:1028
                                                                                                                                                                                                                                                                                                        • C:\Windows\ehome\ehRec.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:2448
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:2056
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                          PID:2096
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                                                                                                                                                          PID:1664
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\msdtc.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\msdtc.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                          PID:2836
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:2804
                                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:552
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                          PID:2016
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\locator.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\locator.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:1808
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\snmptrap.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\snmptrap.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:2176
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:1540
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:2904
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wbengine.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:2968
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          PID:3012
                                                                                                                                                                                                                                                                                                        • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                                                                                                                                                                          "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          PID:2040
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                          PID:2992
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                            PID:1472
                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\system32\SearchFilterHost.exe" 0 584 588 596 65536 592
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:2480

                                                                                                                                                                                                                                                                                                          Network

                                                                                                                                                                                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                Downloads

                                                                                                                                                                                                                                                                                                                OSE.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 ed1cf26819e72015a105f6ce66d2d215fabd146a8f401f620b08398ef10dd116
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                GROOVE.EXE
                                                                                                                                                                                                                                                                                                                • Path C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                                                                                                                                                                                • Size 30.1MB
                                                                                                                                                                                                                                                                                                                • SHA256 5615f945360342b2600c0c734688fa64bfddac95cf43b8f8cffaf9ceac40fc1e
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                maintenanceservice.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                                                                                                                                                                                • Size 1.3MB
                                                                                                                                                                                                                                                                                                                • SHA256 97af1d024623126b15a6c21b3c57ebaa630f2803bda46e94a67a1f2362ff4676
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                elevation_service.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                                                                                                                                                • SHA256 c3a4be63c9a6253257436050ff95afb187576d423687756713b4d78d13c0cbe7
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                MSS.log
                                                                                                                                                                                                                                                                                                                • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                                                                                                                                                                                                • Size 1024KB
                                                                                                                                                                                                                                                                                                                • SHA256 f898ec5b09d82a182dc206d261214d5a5939556f3f29195785dd81c62ca7087d
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                emboweling
                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\emboweling
                                                                                                                                                                                                                                                                                                                • Size 168KB
                                                                                                                                                                                                                                                                                                                • SHA256 df08a2a8994a3ada1866d1bf78e039b645c104c88f432db8a137c6dd9189dd89
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                outbluffed
                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\outbluffed
                                                                                                                                                                                                                                                                                                                • Size 1.5MB
                                                                                                                                                                                                                                                                                                                • SHA256 4318a0ca20a76b77ce8fc53b4b1a9320366abb2127173496f66490ccd1bc2f30
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                poyqmdkunqybivotqcox
                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\poyqmdkunqybivotqcox
                                                                                                                                                                                                                                                                                                                • Size 2B
                                                                                                                                                                                                                                                                                                                • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                conged.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\troopwise\conged.exe
                                                                                                                                                                                                                                                                                                                • Size 1.7MB
                                                                                                                                                                                                                                                                                                                • SHA256 8082ea9624bb02dd681c092c1fbddf363c145b8a633441dde6170e7eb151d8ef
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                                                                                                                                                                                • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                                                                                                                                                                                • Size 24B
                                                                                                                                                                                                                                                                                                                • SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                mscorsvw.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 2e3b39e8f8caf1724e1cb62037f1ecce56233839904ac240aeec9f1bdd29aa75
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ngen_service.log
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                                                                                                                                                                                                • Size 872KB
                                                                                                                                                                                                                                                                                                                • SHA256 fc28b65d553b25e686a2cc63ee37b55fb4f88f3606ef9a1a93ad4a259b318d87
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                mscorsvw.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 e988f4ae59491dd814668affbcaa5fb2a3d449b7600093bde8ac181422ef31a7
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                mscorsvw.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                                                                                                                                                                • SHA256 4ca6c5509b744d0b8fe06f1561be8c219456f71480dbe8c7fef589960321c8bc
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ngen_service.log
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                                                                                                                                                                                                                                                • Size 1003KB
                                                                                                                                                                                                                                                                                                                • SHA256 18e266eb4ba29c47a1b1cda0f1353f877d4029ec507fe6eee77e61324bad02da
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                mscorsvw.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 654c341d651d7225aef96c1f60070dcef4ce661eb755b5b8494ef95c854b827f
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ngen_service.log
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
                                                                                                                                                                                                                                                                                                                • Size 8KB
                                                                                                                                                                                                                                                                                                                • SHA256 e90a98d4e0a94a0c9b83380991c8880d772ae9d02730525d5500446e3943772b
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                perfhost.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                                                                                                                                                                • SHA256 06fe59c9266f59f0fc916a8b74be1300766413b13e715d7ac9c677ba16ae8c5d
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                SearchIndexer.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\System32\SearchIndexer.exe
                                                                                                                                                                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                                                                                                                                                                • SHA256 7167c7527ec9e210c882d076ea7cb4b840332376a26c3507a567e6e27480728d
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                VSSVC.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\System32\VSSVC.exe
                                                                                                                                                                                                                                                                                                                • Size 2.1MB
                                                                                                                                                                                                                                                                                                                • SHA256 b1a4d8d7654e339516279fd5a0376324d319843583bb242ab8d1f6b7b866a2d8
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                alg.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\System32\alg.exe
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 4bba6c415cd7dc0547705e600a4a90c7362e1479d62f204d215e3678c262cbd7
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                msdtc.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\System32\msdtc.exe
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 00530adf6fab86aa7dc57599ada1a95f8ac9093661efa873fab91c7a18bdbd6f
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                vds.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                                                                                                • Size 1.6MB
                                                                                                                                                                                                                                                                                                                • SHA256 c1589034ca0e3ac3d0956366d5b8126b866cc630d1c06d53bbfb15d889a8149c
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\System32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                                                                                                • Size 1.3MB
                                                                                                                                                                                                                                                                                                                • SHA256 5f498e82b514308983571985d247ca8f07ba1c98772c86db7e349f4f0a895af4
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.Office.Tools.Word.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 834KB
                                                                                                                                                                                                                                                                                                                • SHA256 a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 797KB
                                                                                                                                                                                                                                                                                                                • SHA256 4c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 163KB
                                                                                                                                                                                                                                                                                                                • SHA256 99facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 1.3MB
                                                                                                                                                                                                                                                                                                                • SHA256 489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 148KB
                                                                                                                                                                                                                                                                                                                • SHA256 f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 34KB
                                                                                                                                                                                                                                                                                                                • SHA256 620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 109KB
                                                                                                                                                                                                                                                                                                                • SHA256 211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\103f7cff2baa1ab85095918b391ec943\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 180KB
                                                                                                                                                                                                                                                                                                                • SHA256 e0adf80d194baf49fc4b397a22334550142d438331e2ef5b724241661e33f809
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\181356b1bbb85fe2401c4dfad1a45133\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 158KB
                                                                                                                                                                                                                                                                                                                • SHA256 b2f9dce9baca3e56fb3587ffe30ca38eb0f89ed30985b328a853778480c0f87b
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 41KB
                                                                                                                                                                                                                                                                                                                • SHA256 de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\43ac81bed18b52d77a8011ada80939b5\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 296KB
                                                                                                                                                                                                                                                                                                                • SHA256 ad8d210d001d3298ad4e1cbf08449b2cbd2b358d28cfad99db78639627a7cb86
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 356KB
                                                                                                                                                                                                                                                                                                                • SHA256 971188681028501d5ac8143b9127feb95d6982417590af42cf1a43483e38bd42
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5c8b40c69a2293c8f499b38b25c41117\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 157KB
                                                                                                                                                                                                                                                                                                                • SHA256 0406be7235661a62f68bff4c7640b4e241a0c392d548bf242ed08ba0eeaee66b
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f2320d38621eb541713e6cd421c2b8a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 648KB
                                                                                                                                                                                                                                                                                                                • SHA256 637dc357ff9011902186f2fd128ca74ac84fdb6d984f15036803b6a8fe28868a
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 868c297cb00b2d298f594ad7e3fd4e38aeaac78042613626d6f919b2bca25c4f
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 210KB
                                                                                                                                                                                                                                                                                                                • SHA256 8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\90ad713d271debc08f5617e1a6e83075\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 187KB
                                                                                                                                                                                                                                                                                                                • SHA256 49a68c4af9dab3aa774412db70a3bbbc155f75c4c141cce9c17213cd1a0fca1d
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9248a710d7fe2485a557ce5d3cbcf2df\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 607KB
                                                                                                                                                                                                                                                                                                                • SHA256 a09436c1df8fcd8ecd1732d6e4e68f32b092e71e0c5d3308b0f3f20abd03d4e0
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 53KB
                                                                                                                                                                                                                                                                                                                • SHA256 e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 65KB
                                                                                                                                                                                                                                                                                                                • SHA256 b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 28KB
                                                                                                                                                                                                                                                                                                                • SHA256 4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b8e029b1434d965380b363483e376df0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 329KB
                                                                                                                                                                                                                                                                                                                • SHA256 e94a4ad1ef9de2886a231e857c8691328c2e6e344cc9e82440e5c45b8a788256
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bb63c81d306795319eaf7af25f67342a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 141KB
                                                                                                                                                                                                                                                                                                                • SHA256 124a0869df89ec2c9f0b307dd6b6d17e1e1e7ad638e0b4abf4483c15f842d270
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bedc9c8545270d97ca29c192cbc2c5db\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 143KB
                                                                                                                                                                                                                                                                                                                • SHA256 a8b7262cf07ba32786bf85233988dd5cf6db3cc5daff6d462681488d98d9c267
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 278KB
                                                                                                                                                                                                                                                                                                                • SHA256 54701cbe719b08b2393b9f4a604c372f9a280b5d3dd520b563d2aea7d69a1496
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 27KB
                                                                                                                                                                                                                                                                                                                • SHA256 edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 57KB
                                                                                                                                                                                                                                                                                                                • SHA256 4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e02f81a3c88d9b13e6189c69acc0b59b\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 83KB
                                                                                                                                                                                                                                                                                                                • SHA256 e71a9b3a30489ac08305c42a129dd911f70b2b6b1fabab7bb6f6153f0fa47908
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 130KB
                                                                                                                                                                                                                                                                                                                • SHA256 f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 59KB
                                                                                                                                                                                                                                                                                                                • SHA256 a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 42KB
                                                                                                                                                                                                                                                                                                                • SHA256 f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ehiVidCtl.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 855KB
                                                                                                                                                                                                                                                                                                                • SHA256 897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                stdole.ni.dll
                                                                                                                                                                                                                                                                                                                • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
                                                                                                                                                                                                                                                                                                                • Size 43KB
                                                                                                                                                                                                                                                                                                                • SHA256 6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                wmpnetwk.exe
                                                                                                                                                                                                                                                                                                                • Path \Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                • SHA256 9c9aae26831bfa7d976c1f9e8fe93c08e967334b9a2ca7947ea952b99d254cd7
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                aspnet_state.exe
                                                                                                                                                                                                                                                                                                                • Path \Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                                                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                                                                                                                                                                • SHA256 9b5131de7e212bcc199d4ba7602b0b3cbce587e4c359886813dce58471910dbd
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                Locator.exe
                                                                                                                                                                                                                                                                                                                • Path \Windows\System32\Locator.exe
                                                                                                                                                                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                                                                                                                                                                • SHA256 7b8d16bd78776ae66d440c249c3614cb84b23c7ad5a8f58ac8db7c3471a69edf
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ieetwcollector.exe
                                                                                                                                                                                                                                                                                                                • Path \Windows\System32\ieetwcollector.exe
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 e67b8a23c41fd0193b68801d101eb6e45acf514bb9ad580e62027c79441bdaaf
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                msiexec.exe
                                                                                                                                                                                                                                                                                                                • Path \Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 e90fa05cfad1993709dadf5a1614d0425852787b871b7fd097e97388e9035a16
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                snmptrap.exe
                                                                                                                                                                                                                                                                                                                • Path \Windows\System32\snmptrap.exe
                                                                                                                                                                                                                                                                                                                • Size 1.1MB
                                                                                                                                                                                                                                                                                                                • SHA256 8a9ebbb632a41f076c052b4d70e056a572ddc35894904e0a43e023224547c58c
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                wbengine.exe
                                                                                                                                                                                                                                                                                                                • Path \Windows\System32\wbengine.exe
                                                                                                                                                                                                                                                                                                                • Size 2.0MB
                                                                                                                                                                                                                                                                                                                • SHA256 31b487223086b92eac582f1f635673fd273c4881aa31a391f9fc2d9b8ac1b57b
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ehrecvr.exe
                                                                                                                                                                                                                                                                                                                • Path \Windows\ehome\ehrecvr.exe
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 af367143ffee4182f25dcd96652ac151ce428ce3e90117a43af5f10ad6560040
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                ehsched.exe
                                                                                                                                                                                                                                                                                                                • Path \Windows\ehome\ehsched.exe
                                                                                                                                                                                                                                                                                                                • Size 1.2MB
                                                                                                                                                                                                                                                                                                                • SHA256 71b9cca0bd668a7923197f612bac220f06c51f1a688ab0994847ef8a628eb0df
                                                                                                                                                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                                                                Submit Download

                                                                                                                                                                                                                                                                                                                memory/340-765-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/340-785-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/544-841-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/544-819-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/552-270-0x000000002E000000-0x000000002E13B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/552-406-0x000000002E000000-0x000000002E13B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/636-731-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/636-751-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1020-345-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1020-397-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1028-169-0x0000000140000000-0x0000000140237000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1028-293-0x0000000140000000-0x0000000140237000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1084-141-0x0000000000AA0000-0x0000000000B00000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1084-134-0x0000000000AA0000-0x0000000000B00000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1084-140-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1084-269-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1204-244-0x0000000140000000-0x0000000140134000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1204-116-0x0000000140000000-0x0000000140134000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1204-118-0x00000000003A0000-0x0000000000400000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1204-123-0x00000000003A0000-0x0000000000400000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1288-587-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1288-539-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1288-701-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1288-718-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1420-608-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1420-581-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1516-530-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1516-407-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1540-327-0x0000000100000000-0x000000010019A000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1540-533-0x0000000100000000-0x000000010019A000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1544-773-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1544-745-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1544-761-0x0000000003C60000-0x0000000003D1A000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1572-716-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1572-735-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1664-232-0x0000000140000000-0x0000000140150000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1664-217-0x0000000140000000-0x0000000140150000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1704-691-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1704-675-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1724-113-0x0000000010000000-0x000000001012D000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1724-87-0x0000000010000000-0x000000001012D000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1808-426-0x0000000100000000-0x000000010011B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1808-294-0x0000000100000000-0x000000010011B000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1880-31-0x00000000002D0000-0x00000000003D0000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1904-146-0x0000000140000000-0x0000000140138000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1904-153-0x0000000000BA0000-0x0000000000C00000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1904-273-0x0000000140000000-0x0000000140138000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/1904-147-0x0000000000BA0000-0x0000000000C00000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2016-279-0x0000000001000000-0x000000000111C000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2016-413-0x0000000001000000-0x000000000111C000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2040-414-0x0000000100000000-0x000000010020A000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2040-688-0x0000000100000000-0x000000010020A000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2052-393-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2052-410-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2056-191-0x0000000140000000-0x0000000140134000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2056-319-0x0000000140000000-0x0000000140134000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2096-214-0x000000002E000000-0x000000002FE1E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2096-324-0x000000002E000000-0x000000002FE1E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2140-73-0x0000000000490000-0x00000000004F7000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2140-68-0x0000000000490000-0x00000000004F7000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2140-67-0x0000000010000000-0x0000000010125000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2140-110-0x0000000010000000-0x0000000010125000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2176-325-0x0000000100000000-0x000000010011C000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2176-490-0x0000000100000000-0x000000010011C000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2248-57-0x0000000100000000-0x000000010012A000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2248-58-0x0000000000860000-0x00000000008C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2248-51-0x0000000000860000-0x00000000008C0000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2248-168-0x0000000100000000-0x000000010012A000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2296-872-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2296-853-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2384-239-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2384-97-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2384-105-0x0000000000530000-0x0000000000597000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2384-100-0x0000000000530000-0x0000000000597000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2512-678-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2512-664-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2520-802-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2580-704-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2580-689-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2584-11-0x0000000002430000-0x0000000002530000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2612-820-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2616-632-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2616-607-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2788-857-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2788-835-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2796-666-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2796-650-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2804-380-0x0000000100000000-0x0000000100138000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2804-253-0x00000000006E0000-0x0000000000818000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2804-242-0x0000000100000000-0x0000000100138000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2804-392-0x00000000006E0000-0x0000000000818000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-133-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-48-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-33-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-35-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-36-0x0000000000170000-0x00000000001D7000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-99-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-43-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-44-0x0000000000170000-0x00000000001D7000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-83-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-82-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-80-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-79-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2824-46-0x0000000000400000-0x0000000000593000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2832-653-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2832-641-0x0000000000400000-0x000000000052E000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2836-349-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2836-221-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2848-64-0x0000000140000000-0x0000000140123000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2848-216-0x0000000140000000-0x0000000140123000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2904-599-0x0000000100000000-0x0000000100219000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2904-350-0x0000000100000000-0x0000000100219000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2968-362-0x0000000100000000-0x0000000100202000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2968-640-0x0000000100000000-0x0000000100202000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2992-700-0x0000000100000000-0x0000000100123000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/2992-427-0x0000000100000000-0x0000000100123000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3012-648-0x0000000100000000-0x000000010014A000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download

                                                                                                                                                                                                                                                                                                                memory/3012-383-0x0000000100000000-0x000000010014A000-memory.dmp
                                                                                                                                                                                                                                                                                                                Download