Overview

overview

7

Static

static

3

de053c6d12...aN.exe

windows7-x64

7

de053c6d12...aN.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    13/11/2024, 12:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    de053c6d123e073463dd9c01b4427ecb9291f03eb06469bc0671395f362b2efaN.exe
  • Size 1.2MB
  • Sample241113-ptpxeasblf
  • SHA256 de053c6d123e073463dd9c01b4427ecb9291f03eb06469bc0671395f362b2efa
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 23 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 9 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\de053c6d123e073463dd9c01b4427ecb9291f03eb06469bc0671395f362b2efaN.exe
    "C:\Users\Admin\AppData\Local\Temp\de053c6d123e073463dd9c01b4427ecb9291f03eb06469bc0671395f362b2efaN.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    PID:2316
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    PID:2848
  • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2796
  • C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    PID:2596
  • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:1572
  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1e4 -InterruptEvent 1d0 -NGENProcess 1d4 -Pipe 1e0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2640
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1dc -InterruptEvent 248 -NGENProcess 250 -Pipe 254 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3040
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 240 -NGENProcess 1ec -Pipe 238 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2316
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 258 -NGENProcess 1e4 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1612
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 258 -InterruptEvent 25c -NGENProcess 23c -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2640
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 260 -InterruptEvent 240 -NGENProcess 264 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1696
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 240 -InterruptEvent 250 -NGENProcess 23c -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:572
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 250 -InterruptEvent 268 -NGENProcess 25c -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:332
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 268 -InterruptEvent 26c -NGENProcess 264 -Pipe 248 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2784
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 270 -NGENProcess 23c -Pipe 1ec -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1608
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 270 -InterruptEvent 274 -NGENProcess 25c -Pipe 260 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2908
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 278 -NGENProcess 264 -Pipe 240 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2372
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 278 -InterruptEvent 27c -NGENProcess 23c -Pipe 250 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2780
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 27c -InterruptEvent 280 -NGENProcess 25c -Pipe 268 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1776
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 284 -NGENProcess 278 -Pipe 280 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1848
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 284 -InterruptEvent 26c -NGENProcess 25c -Pipe 270 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2908
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 26c -InterruptEvent 28c -NGENProcess 27c -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2784
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 28c -InterruptEvent 290 -NGENProcess 278 -Pipe 288 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2380
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 290 -InterruptEvent 294 -NGENProcess 25c -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2704
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 298 -NGENProcess 27c -Pipe 274 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1052
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 29c -NGENProcess 278 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1124
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 29c -InterruptEvent 2a0 -NGENProcess 25c -Pipe 26c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1732
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 2a4 -NGENProcess 27c -Pipe 28c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2756
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 1f4 -NGENProcess 264 -Pipe 29c -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1564
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1f4 -InterruptEvent 244 -NGENProcess 1e4 -Pipe 1d4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2720
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 244 -InterruptEvent 238 -NGENProcess 1d0 -Pipe 258 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:600
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 274 -NGENProcess 264 -Pipe 218 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1268
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 274 -InterruptEvent 248 -NGENProcess 254 -Pipe 284 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1256
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 264 -NGENProcess 254 -Pipe 244 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:1084
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 264 -InterruptEvent 2a8 -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:952
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 1c0 -NGENProcess 248 -Pipe 1dc -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2748
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 1c0 -InterruptEvent 2a0 -NGENProcess 254 -Pipe 1d0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1452
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 254 -NGENProcess 2a8 -Pipe 278 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2920
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 254 -InterruptEvent 2a4 -NGENProcess 248 -Pipe 264 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:1944
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a4 -InterruptEvent 248 -NGENProcess 2a0 -Pipe 290 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2608
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 248 -InterruptEvent 25c -NGENProcess 2a8 -Pipe 1c0 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:544
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2a0 -NGENProcess 2a8 -Pipe 1e4 -Comment "NGen Worker Process"
      2⤵
      • Executes dropped EXE
      PID:2524
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a0 -InterruptEvent 294 -NGENProcess 238 -Pipe 23c -Comment "NGen Worker Process"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      PID:2100
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 238 -NGENProcess 298 -Pipe 2a4 -Comment "NGen Worker Process"
      2⤵
        PID:2268
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 238 -InterruptEvent 2b0 -NGENProcess 2a8 -Pipe 27c -Comment "NGen Worker Process"
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:2112
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2a8 -NGENProcess 294 -Pipe 2ac -Comment "NGen Worker Process"
        2⤵
          PID:1268
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2a8 -InterruptEvent 2b8 -NGENProcess 298 -Pipe 2a0 -Comment "NGen Worker Process"
          2⤵
          • Loads dropped DLL
          • Drops file in Windows directory
          PID:2024
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 298 -NGENProcess 2b0 -Pipe 2b4 -Comment "NGen Worker Process"
          2⤵
            PID:952
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 298 -InterruptEvent 2c0 -NGENProcess 294 -Pipe 238 -Comment "NGen Worker Process"
            2⤵
            • Loads dropped DLL
            • Drops file in Windows directory
            PID:2432
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 294 -NGENProcess 2b8 -Pipe 2bc -Comment "NGen Worker Process"
            2⤵
              PID:800
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 294 -InterruptEvent 2c8 -NGENProcess 2b0 -Pipe 2a8 -Comment "NGen Worker Process"
              2⤵
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:692
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2b0 -NGENProcess 2c0 -Pipe 2c4 -Comment "NGen Worker Process"
              2⤵
                PID:836
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b0 -InterruptEvent 2d0 -NGENProcess 2b8 -Pipe 298 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                PID:2272
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2b8 -NGENProcess 2c8 -Pipe 2cc -Comment "NGen Worker Process"
                2⤵
                • System Location Discovery: System Language Discovery
                PID:988
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2b8 -InterruptEvent 2d8 -NGENProcess 2c0 -Pipe 294 -Comment "NGen Worker Process"
                2⤵
                • Loads dropped DLL
                • Drops file in Windows directory
                PID:2788
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2c0 -NGENProcess 2d0 -Pipe 2d4 -Comment "NGen Worker Process"
                2⤵
                  PID:408
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c0 -InterruptEvent 2e0 -NGENProcess 2c8 -Pipe 2b0 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:2396
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 2c8 -NGENProcess 2d8 -Pipe 2dc -Comment "NGen Worker Process"
                  2⤵
                  • System Location Discovery: System Language Discovery
                  PID:1632
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2c8 -InterruptEvent 2e8 -NGENProcess 2d0 -Pipe 2b8 -Comment "NGen Worker Process"
                  2⤵
                  • Loads dropped DLL
                  • Drops file in Windows directory
                  PID:1672
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 2d0 -NGENProcess 2e0 -Pipe 2e4 -Comment "NGen Worker Process"
                  2⤵
                    PID:2948
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d0 -InterruptEvent 2f0 -NGENProcess 2d8 -Pipe 2c0 -Comment "NGen Worker Process"
                    2⤵
                    • Loads dropped DLL
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:1280
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f0 -InterruptEvent 2d8 -NGENProcess 2e8 -Pipe 2ec -Comment "NGen Worker Process"
                    2⤵
                      PID:1028
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2d8 -InterruptEvent 2f8 -NGENProcess 2e0 -Pipe 2c8 -Comment "NGen Worker Process"
                      2⤵
                      • Loads dropped DLL
                      • Drops file in Windows directory
                      PID:2112
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2f8 -InterruptEvent 2e0 -NGENProcess 2f0 -Pipe 2f4 -Comment "NGen Worker Process"
                      2⤵
                      • Modifies data under HKEY_USERS
                      PID:2372
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e0 -InterruptEvent 300 -NGENProcess 2e8 -Pipe 2d0 -Comment "NGen Worker Process"
                      2⤵
                        PID:1312
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 300 -InterruptEvent 304 -NGENProcess 2fc -Pipe 25c -Comment "NGen Worker Process"
                        2⤵
                        • System Location Discovery: System Language Discovery
                        PID:2200
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 308 -NGENProcess 2f0 -Pipe 2d8 -Comment "NGen Worker Process"
                        2⤵
                          PID:1168
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 308 -InterruptEvent 30c -NGENProcess 2e8 -Pipe 1f4 -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          PID:1932
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 30c -InterruptEvent 2e8 -NGENProcess 304 -Pipe 2fc -Comment "NGen Worker Process"
                          2⤵
                          • Loads dropped DLL
                          PID:2024
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 2e8 -InterruptEvent 304 -NGENProcess 2f8 -Pipe 2f0 -Comment "NGen Worker Process"
                          2⤵
                          • System Location Discovery: System Language Discovery
                          PID:2456
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 304 -InterruptEvent 318 -NGENProcess 310 -Pipe 300 -Comment "NGen Worker Process"
                          2⤵
                            PID:2948
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 318 -InterruptEvent 31c -NGENProcess 314 -Pipe 308 -Comment "NGen Worker Process"
                            2⤵
                            • System Location Discovery: System Language Discovery
                            • Modifies data under HKEY_USERS
                            PID:3008
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 31c -InterruptEvent 320 -NGENProcess 2f8 -Pipe 30c -Comment "NGen Worker Process"
                            2⤵
                              PID:2780
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 320 -InterruptEvent 324 -NGENProcess 310 -Pipe 2e0 -Comment "NGen Worker Process"
                              2⤵
                                PID:2812
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 324 -InterruptEvent 328 -NGENProcess 314 -Pipe 2e8 -Comment "NGen Worker Process"
                                2⤵
                                  PID:836
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 328 -InterruptEvent 32c -NGENProcess 2f8 -Pipe 304 -Comment "NGen Worker Process"
                                  2⤵
                                    PID:1644
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 32c -InterruptEvent 330 -NGENProcess 310 -Pipe 318 -Comment "NGen Worker Process"
                                    2⤵
                                      PID:1652
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 330 -InterruptEvent 334 -NGENProcess 314 -Pipe 31c -Comment "NGen Worker Process"
                                      2⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:2012
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 334 -InterruptEvent 338 -NGENProcess 2f8 -Pipe 320 -Comment "NGen Worker Process"
                                      2⤵
                                        PID:1332
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 338 -InterruptEvent 33c -NGENProcess 310 -Pipe 324 -Comment "NGen Worker Process"
                                        2⤵
                                          PID:1264
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 33c -InterruptEvent 340 -NGENProcess 314 -Pipe 328 -Comment "NGen Worker Process"
                                          2⤵
                                            PID:1356
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 340 -InterruptEvent 344 -NGENProcess 2f8 -Pipe 32c -Comment "NGen Worker Process"
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            PID:1252
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 344 -InterruptEvent 348 -NGENProcess 310 -Pipe 330 -Comment "NGen Worker Process"
                                            2⤵
                                              PID:1052
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 348 -InterruptEvent 34c -NGENProcess 314 -Pipe 334 -Comment "NGen Worker Process"
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2600
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 350 -NGENProcess 2f8 -Pipe 338 -Comment "NGen Worker Process"
                                              2⤵
                                              • Modifies data under HKEY_USERS
                                              PID:2380
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 350 -InterruptEvent 354 -NGENProcess 310 -Pipe 33c -Comment "NGen Worker Process"
                                              2⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2928
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 354 -InterruptEvent 358 -NGENProcess 314 -Pipe 340 -Comment "NGen Worker Process"
                                              2⤵
                                                PID:1280
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 35c -NGENProcess 2f8 -Pipe 344 -Comment "NGen Worker Process"
                                                2⤵
                                                  PID:2276
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 35c -InterruptEvent 360 -NGENProcess 310 -Pipe 348 -Comment "NGen Worker Process"
                                                  2⤵
                                                    PID:1452
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 364 -InterruptEvent 358 -NGENProcess 368 -Pipe 35c -Comment "NGen Worker Process"
                                                    2⤵
                                                      PID:1268
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 358 -InterruptEvent 34c -NGENProcess 310 -Pipe 350 -Comment "NGen Worker Process"
                                                      2⤵
                                                        PID:836
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 34c -InterruptEvent 36c -NGENProcess 360 -Pipe 254 -Comment "NGen Worker Process"
                                                        2⤵
                                                          PID:2704
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 36c -InterruptEvent 370 -NGENProcess 368 -Pipe 354 -Comment "NGen Worker Process"
                                                          2⤵
                                                          • Modifies data under HKEY_USERS
                                                          PID:2436
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 374 -NGENProcess 310 -Pipe 314 -Comment "NGen Worker Process"
                                                          2⤵
                                                            PID:348
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 378 -NGENProcess 360 -Pipe 364 -Comment "NGen Worker Process"
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            PID:1616
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 378 -NGENProcess 374 -Pipe 368 -Comment "NGen Worker Process"
                                                            2⤵
                                                            • Modifies data under HKEY_USERS
                                                            PID:916
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 37c -InterruptEvent 374 -NGENProcess 378 -Pipe 358 -Comment "NGen Worker Process"
                                                            2⤵
                                                            • Modifies data under HKEY_USERS
                                                            PID:2172
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 374 -InterruptEvent 384 -NGENProcess 370 -Pipe 2f8 -Comment "NGen Worker Process"
                                                            2⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Modifies data under HKEY_USERS
                                                            PID:2752
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 388 -NGENProcess 34c -Pipe 380 -Comment "NGen Worker Process"
                                                            2⤵
                                                            • Modifies data under HKEY_USERS
                                                            PID:2660
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 388 -InterruptEvent 38c -NGENProcess 378 -Pipe 36c -Comment "NGen Worker Process"
                                                            2⤵
                                                            • Modifies data under HKEY_USERS
                                                            PID:2876
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 390 -NGENProcess 370 -Pipe 360 -Comment "NGen Worker Process"
                                                            2⤵
                                                              PID:1280
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 390 -InterruptEvent 394 -NGENProcess 34c -Pipe 37c -Comment "NGen Worker Process"
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:2200
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 394 -InterruptEvent 398 -NGENProcess 378 -Pipe 374 -Comment "NGen Worker Process"
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:572
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 398 -InterruptEvent 38c -NGENProcess 370 -Pipe 3a0 -Comment "NGen Worker Process"
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:1836
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 38c -InterruptEvent 384 -NGENProcess 39c -Pipe 388 -Comment "NGen Worker Process"
                                                              2⤵
                                                              • Loads dropped DLL
                                                              • Drops file in Windows directory
                                                              • Modifies data under HKEY_USERS
                                                              PID:864
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 384 -InterruptEvent 39c -NGENProcess 398 -Pipe 378 -Comment "NGen Worker Process"
                                                              2⤵
                                                              • System Location Discovery: System Language Discovery
                                                              PID:1132
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 39c -InterruptEvent 3a8 -NGENProcess 370 -Pipe 390 -Comment "NGen Worker Process"
                                                              2⤵
                                                              • Loads dropped DLL
                                                              • Drops file in Windows directory
                                                              • Modifies data under HKEY_USERS
                                                              PID:2988
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3a8 -InterruptEvent 370 -NGENProcess 384 -Pipe 3a4 -Comment "NGen Worker Process"
                                                              2⤵
                                                              • Modifies data under HKEY_USERS
                                                              PID:1280
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 3b0 -NGENProcess 398 -Pipe 38c -Comment "NGen Worker Process"
                                                              2⤵
                                                              • Loads dropped DLL
                                                              • Drops file in Windows directory
                                                              • System Location Discovery: System Language Discovery
                                                              • Modifies data under HKEY_USERS
                                                              PID:2132
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b0 -InterruptEvent 370 -NGENProcess 3b8 -Pipe 3a8 -Comment "NGen Worker Process"
                                                              2⤵
                                                                PID:2324
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 370 -InterruptEvent 310 -NGENProcess 398 -Pipe 39c -Comment "NGen Worker Process"
                                                                2⤵
                                                                • Modifies data under HKEY_USERS
                                                                PID:2792
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 310 -InterruptEvent 3bc -NGENProcess 3b4 -Pipe 34c -Comment "NGen Worker Process"
                                                                2⤵
                                                                • Loads dropped DLL
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Modifies data under HKEY_USERS
                                                                PID:1964
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3bc -InterruptEvent 3b4 -NGENProcess 370 -Pipe 3b8 -Comment "NGen Worker Process"
                                                                2⤵
                                                                • System Location Discovery: System Language Discovery
                                                                PID:2412
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3b4 -InterruptEvent 3c4 -NGENProcess 398 -Pipe 394 -Comment "NGen Worker Process"
                                                                2⤵
                                                                  PID:3036
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3c8 -NGENProcess 3c0 -Pipe 3b0 -Comment "NGen Worker Process"
                                                                  2⤵
                                                                    PID:1252
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c8 -InterruptEvent 3cc -NGENProcess 370 -Pipe 310 -Comment "NGen Worker Process"
                                                                    2⤵
                                                                      PID:1280
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3cc -InterruptEvent 3d0 -NGENProcess 398 -Pipe 3ac -Comment "NGen Worker Process"
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1992
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 3d4 -NGENProcess 3c0 -Pipe 3bc -Comment "NGen Worker Process"
                                                                      2⤵
                                                                        PID:1524
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 3d8 -NGENProcess 370 -Pipe 3b4 -Comment "NGen Worker Process"
                                                                        2⤵
                                                                          PID:2192
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3dc -InterruptEvent 3d8 -NGENProcess 3d4 -Pipe 398 -Comment "NGen Worker Process"
                                                                          2⤵
                                                                            PID:2308
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d8 -InterruptEvent 3c4 -NGENProcess 370 -Pipe 3c8 -Comment "NGen Worker Process"
                                                                            2⤵
                                                                              PID:1644
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3c4 -InterruptEvent 3e4 -NGENProcess 3d0 -Pipe 384 -Comment "NGen Worker Process"
                                                                              2⤵
                                                                                PID:1636
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e4 -InterruptEvent 3e8 -NGENProcess 3d4 -Pipe 3e0 -Comment "NGen Worker Process"
                                                                                2⤵
                                                                                  PID:1452
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3e8 -InterruptEvent 3ec -NGENProcess 370 -Pipe 3cc -Comment "NGen Worker Process"
                                                                                  2⤵
                                                                                    PID:2456
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3ec -InterruptEvent 3f0 -NGENProcess 3d0 -Pipe 3dc -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:1280
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f0 -InterruptEvent 3f4 -NGENProcess 3d4 -Pipe 3d8 -Comment "NGen Worker Process"
                                                                                    2⤵
                                                                                      PID:580
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f4 -InterruptEvent 3f8 -NGENProcess 370 -Pipe 3c4 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2436
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3f8 -InterruptEvent 3fc -NGENProcess 3d0 -Pipe 3e4 -Comment "NGen Worker Process"
                                                                                      2⤵
                                                                                        PID:1508
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3fc -InterruptEvent 404 -NGENProcess 3d4 -Pipe 3e8 -Comment "NGen Worker Process"
                                                                                        2⤵
                                                                                          PID:2096
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 404 -InterruptEvent 408 -NGENProcess 370 -Pipe 3ec -Comment "NGen Worker Process"
                                                                                          2⤵
                                                                                            PID:2900
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 40c -NGENProcess 3d0 -Pipe 3f0 -Comment "NGen Worker Process"
                                                                                            2⤵
                                                                                              PID:932
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 40c -InterruptEvent 410 -NGENProcess 3d4 -Pipe 3f4 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                              • Loads dropped DLL
                                                                                              PID:2812
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 410 -InterruptEvent 3d4 -NGENProcess 408 -Pipe 370 -Comment "NGen Worker Process"
                                                                                              2⤵
                                                                                                PID:2172
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d4 -InterruptEvent 418 -NGENProcess 3d0 -Pipe 3fc -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                • Loads dropped DLL
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:2608
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 418 -InterruptEvent 3d0 -NGENProcess 410 -Pipe 414 -Comment "NGen Worker Process"
                                                                                                2⤵
                                                                                                  PID:2196
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 3d0 -InterruptEvent 420 -NGENProcess 408 -Pipe 40c -Comment "NGen Worker Process"
                                                                                                  2⤵
                                                                                                    PID:2316
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 420 -InterruptEvent 424 -NGENProcess 41c -Pipe 3f8 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                    PID:1456
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 424 -InterruptEvent 428 -NGENProcess 410 -Pipe 3d4 -Comment "NGen Worker Process"
                                                                                                    2⤵
                                                                                                      PID:1312
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 428 -InterruptEvent 42c -NGENProcess 408 -Pipe 404 -Comment "NGen Worker Process"
                                                                                                      2⤵
                                                                                                        PID:2400
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 42c -InterruptEvent 430 -NGENProcess 41c -Pipe 418 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                        • Loads dropped DLL
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:2324
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 41c -NGENProcess 428 -Pipe 410 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                        PID:2752
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 41c -InterruptEvent 438 -NGENProcess 408 -Pipe 420 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                        • Drops file in Windows directory
                                                                                                        PID:1524
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 438 -InterruptEvent 408 -NGENProcess 430 -Pipe 434 -Comment "NGen Worker Process"
                                                                                                        2⤵
                                                                                                          PID:2068
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 440 -NGENProcess 428 -Pipe 42c -Comment "NGen Worker Process"
                                                                                                          2⤵
                                                                                                            PID:1644
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 440 -InterruptEvent 444 -NGENProcess 43c -Pipe 3d0 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:1544
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 444 -InterruptEvent 448 -NGENProcess 430 -Pipe 41c -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                            PID:288
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 448 -InterruptEvent 430 -NGENProcess 440 -Pipe 428 -Comment "NGen Worker Process"
                                                                                                            2⤵
                                                                                                              PID:2524
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 430 -InterruptEvent 450 -NGENProcess 43c -Pipe 438 -Comment "NGen Worker Process"
                                                                                                              2⤵
                                                                                                                PID:2704
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 450 -InterruptEvent 43c -NGENProcess 448 -Pipe 44c -Comment "NGen Worker Process"
                                                                                                                2⤵
                                                                                                                  PID:2980
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 458 -NGENProcess 440 -Pipe 444 -Comment "NGen Worker Process"
                                                                                                                  2⤵
                                                                                                                    PID:1356
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 458 -InterruptEvent 45c -NGENProcess 454 -Pipe 424 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                    • Drops file in Windows directory
                                                                                                                    PID:600
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 454 -NGENProcess 43c -Pipe 448 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2976
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 45c -InterruptEvent 43c -NGENProcess 454 -Pipe 464 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:952
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 43c -InterruptEvent 454 -NGENProcess 440 -Pipe 460 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    PID:2732
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 46c -NGENProcess 408 -Pipe 458 -Comment "NGen Worker Process"
                                                                                                                    2⤵
                                                                                                                      PID:2132
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 46c -InterruptEvent 470 -NGENProcess 468 -Pipe 430 -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      PID:2788
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 470 -InterruptEvent 474 -NGENProcess 440 -Pipe 45c -Comment "NGen Worker Process"
                                                                                                                      2⤵
                                                                                                                        PID:2100
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 478 -NGENProcess 408 -Pipe 450 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                        PID:1680
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 478 -InterruptEvent 408 -NGENProcess 470 -Pipe 468 -Comment "NGen Worker Process"
                                                                                                                        2⤵
                                                                                                                          PID:2976
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 480 -InterruptEvent 408 -NGENProcess 474 -Pipe 440 -Comment "NGen Worker Process"
                                                                                                                          2⤵
                                                                                                                            PID:2812
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 408 -InterruptEvent 454 -NGENProcess 470 -Pipe 46c -Comment "NGen Worker Process"
                                                                                                                            2⤵
                                                                                                                              PID:836
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 454 -InterruptEvent 488 -NGENProcess 43c -Pipe 3c0 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:580
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 48c -NGENProcess 474 -Pipe 484 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:2192
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 48c -InterruptEvent 474 -NGENProcess 454 -Pipe 470 -Comment "NGen Worker Process"
                                                                                                                              2⤵
                                                                                                                                PID:1244
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 474 -InterruptEvent 494 -NGENProcess 43c -Pipe 480 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                                PID:896
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 498 -NGENProcess 490 -Pipe 408 -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:744
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 498 -InterruptEvent 494 -NGENProcess 454 -Pipe 48c -Comment "NGen Worker Process"
                                                                                                                                2⤵
                                                                                                                                  PID:1932
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 488 -NGENProcess 49c -Pipe 478 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:2616
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 488 -InterruptEvent 4a4 -NGENProcess 494 -Pipe 490 -Comment "NGen Worker Process"
                                                                                                                                  2⤵
                                                                                                                                    PID:2432
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a4 -InterruptEvent 4a8 -NGENProcess 454 -Pipe 474 -Comment "NGen Worker Process"
                                                                                                                                    2⤵
                                                                                                                                      PID:2132
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4ac -NGENProcess 49c -Pipe 4a0 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                      PID:1536
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ac -InterruptEvent 4b0 -NGENProcess 494 -Pipe 498 -Comment "NGen Worker Process"
                                                                                                                                      2⤵
                                                                                                                                        PID:1168
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b0 -InterruptEvent 4b4 -NGENProcess 454 -Pipe 47c -Comment "NGen Worker Process"
                                                                                                                                        2⤵
                                                                                                                                          PID:2072
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b4 -InterruptEvent 4b8 -NGENProcess 49c -Pipe 488 -Comment "NGen Worker Process"
                                                                                                                                          2⤵
                                                                                                                                            PID:1992
                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4b8 -InterruptEvent 4bc -NGENProcess 494 -Pipe 4a4 -Comment "NGen Worker Process"
                                                                                                                                            2⤵
                                                                                                                                              PID:1596
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4bc -InterruptEvent 494 -NGENProcess 4b0 -Pipe 4c4 -Comment "NGen Worker Process"
                                                                                                                                              2⤵
                                                                                                                                                PID:932
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 494 -InterruptEvent 4a8 -NGENProcess 4c0 -Pipe 4ac -Comment "NGen Worker Process"
                                                                                                                                                2⤵
                                                                                                                                                  PID:2876
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4a8 -InterruptEvent 4c8 -NGENProcess 4b8 -Pipe 43c -Comment "NGen Worker Process"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2784
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c8 -InterruptEvent 4cc -NGENProcess 4b0 -Pipe 454 -Comment "NGen Worker Process"
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:1636
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4cc -InterruptEvent 4d0 -NGENProcess 4c0 -Pipe 4b4 -Comment "NGen Worker Process"
                                                                                                                                                    2⤵
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:2052
                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d0 -InterruptEvent 4d4 -NGENProcess 4b8 -Pipe 4bc -Comment "NGen Worker Process"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:2928
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d4 -InterruptEvent 4d8 -NGENProcess 4b0 -Pipe 494 -Comment "NGen Worker Process"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:1672
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4d8 -InterruptEvent 4dc -NGENProcess 4c0 -Pipe 4a8 -Comment "NGen Worker Process"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:952
                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4dc -InterruptEvent 4e0 -NGENProcess 4b8 -Pipe 4c8 -Comment "NGen Worker Process"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1596
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e0 -InterruptEvent 4e4 -NGENProcess 4b0 -Pipe 4cc -Comment "NGen Worker Process"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2616
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e4 -InterruptEvent 4e8 -NGENProcess 4c0 -Pipe 4d0 -Comment "NGen Worker Process"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1784
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4e8 -InterruptEvent 4ec -NGENProcess 4b8 -Pipe 4d4 -Comment "NGen Worker Process"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2132
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4ec -InterruptEvent 4f0 -NGENProcess 4b0 -Pipe 4d8 -Comment "NGen Worker Process"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:2068
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f0 -InterruptEvent 4f4 -NGENProcess 4c0 -Pipe 4dc -Comment "NGen Worker Process"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2052
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f4 -InterruptEvent 4f8 -NGENProcess 4b8 -Pipe 4e0 -Comment "NGen Worker Process"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:1256
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4f8 -InterruptEvent 4fc -NGENProcess 4b0 -Pipe 4e4 -Comment "NGen Worker Process"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                      PID:1052
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4fc -InterruptEvent 500 -NGENProcess 4c0 -Pipe 4e8 -Comment "NGen Worker Process"
                                                                                                                                                                      2⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:2812
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 504 -NGENProcess 4b8 -Pipe 4ec -Comment "NGen Worker Process"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:1596
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 504 -InterruptEvent 508 -NGENProcess 4b0 -Pipe 4f0 -Comment "NGen Worker Process"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:580
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 508 -InterruptEvent 50c -NGENProcess 4c0 -Pipe 4f4 -Comment "NGen Worker Process"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3040
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 510 -NGENProcess 4b8 -Pipe 4f8 -Comment "NGen Worker Process"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1536
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 510 -InterruptEvent 514 -NGENProcess 4b0 -Pipe 4fc -Comment "NGen Worker Process"
                                                                                                                                                                            2⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1608
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 518 -InterruptEvent 50c -NGENProcess 51c -Pipe 510 -Comment "NGen Worker Process"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1076
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 50c -InterruptEvent 500 -NGENProcess 4b0 -Pipe 504 -Comment "NGen Worker Process"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:2472
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 520 -NGENProcess 514 -Pipe 49c -Comment "NGen Worker Process"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:600
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 520 -InterruptEvent 524 -NGENProcess 51c -Pipe 508 -Comment "NGen Worker Process"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:932
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 528 -InterruptEvent 500 -NGENProcess 52c -Pipe 520 -Comment "NGen Worker Process"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2724
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 500 -InterruptEvent 4c0 -NGENProcess 51c -Pipe 518 -Comment "NGen Worker Process"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:2988
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 4c0 -InterruptEvent 530 -NGENProcess 524 -Pipe 4b8 -Comment "NGen Worker Process"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:1456
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 530 -InterruptEvent 534 -NGENProcess 52c -Pipe 50c -Comment "NGen Worker Process"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2360
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 534 -InterruptEvent 538 -NGENProcess 51c -Pipe 4b0 -Comment "NGen Worker Process"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                      PID:2396
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 538 -InterruptEvent 53c -NGENProcess 524 -Pipe 528 -Comment "NGen Worker Process"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1280
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 53c -InterruptEvent 540 -NGENProcess 52c -Pipe 500 -Comment "NGen Worker Process"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:952
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 540 -InterruptEvent 544 -NGENProcess 51c -Pipe 4c0 -Comment "NGen Worker Process"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:2640
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 544 -InterruptEvent 548 -NGENProcess 524 -Pipe 530 -Comment "NGen Worker Process"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1748
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 548 -InterruptEvent 54c -NGENProcess 52c -Pipe 534 -Comment "NGen Worker Process"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:1648
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 54c -InterruptEvent 550 -NGENProcess 51c -Pipe 538 -Comment "NGen Worker Process"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:2888
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 550 -InterruptEvent 554 -NGENProcess 524 -Pipe 53c -Comment "NGen Worker Process"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:1168
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 554 -InterruptEvent 558 -NGENProcess 52c -Pipe 540 -Comment "NGen Worker Process"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:2408
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 558 -InterruptEvent 55c -NGENProcess 51c -Pipe 544 -Comment "NGen Worker Process"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1992
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 55c -InterruptEvent 560 -NGENProcess 524 -Pipe 548 -Comment "NGen Worker Process"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2720
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 560 -InterruptEvent 564 -NGENProcess 52c -Pipe 54c -Comment "NGen Worker Process"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1264
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 564 -InterruptEvent 568 -NGENProcess 51c -Pipe 550 -Comment "NGen Worker Process"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1772
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 568 -InterruptEvent 56c -NGENProcess 524 -Pipe 554 -Comment "NGen Worker Process"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:800
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 56c -InterruptEvent 570 -NGENProcess 52c -Pipe 558 -Comment "NGen Worker Process"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:352
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 570 -InterruptEvent 574 -NGENProcess 51c -Pipe 55c -Comment "NGen Worker Process"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:2068
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 574 -InterruptEvent 578 -NGENProcess 524 -Pipe 560 -Comment "NGen Worker Process"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1456
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 578 -InterruptEvent 57c -NGENProcess 52c -Pipe 564 -Comment "NGen Worker Process"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:484
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 57c -InterruptEvent 580 -NGENProcess 51c -Pipe 568 -Comment "NGen Worker Process"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:2472
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 580 -InterruptEvent 584 -NGENProcess 524 -Pipe 56c -Comment "NGen Worker Process"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:2176
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                    C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 584 -InterruptEvent 588 -NGENProcess 52c -Pipe 570 -Comment "NGen Worker Process"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2788
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 588 -InterruptEvent 58c -NGENProcess 51c -Pipe 574 -Comment "NGen Worker Process"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:1748
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 58c -InterruptEvent 584 -NGENProcess 524 -Pipe 578 -Comment "NGen Worker Process"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:2160
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                      C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 584 -InterruptEvent 594 -NGENProcess 52c -Pipe 57c -Comment "NGen Worker Process"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:2152
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                        C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 594 -InterruptEvent 588 -NGENProcess 51c -Pipe 598 -Comment "NGen Worker Process"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2072
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                          C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 588 -InterruptEvent 59c -NGENProcess 514 -Pipe 580 -Comment "NGen Worker Process"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1076
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 59c -InterruptEvent 5a0 -NGENProcess 52c -Pipe 524 -Comment "NGen Worker Process"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:628
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a0 -InterruptEvent 5a4 -NGENProcess 51c -Pipe 58c -Comment "NGen Worker Process"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1828
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -StartupEvent 5a4 -InterruptEvent 5a8 -NGENProcess 514 -Pipe 584 -Comment "NGen Worker Process"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:740
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                            C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:2912
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1d0 -InterruptEvent 1bc -NGENProcess 1c0 -Pipe 1cc -Comment "NGen Worker Process"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:1312
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe -StartupEvent 1c8 -InterruptEvent 234 -NGENProcess 23c -Pipe 240 -Comment "NGen Worker Process"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:2936
                                                                                                                                                                                                                          • C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                                                                                            C:\Windows\ehome\ehRecvr.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                            PID:2920
                                                                                                                                                                                                                          • C:\Windows\ehome\ehsched.exe
                                                                                                                                                                                                                            C:\Windows\ehome\ehsched.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:1748
                                                                                                                                                                                                                          • C:\Windows\eHome\EhTray.exe
                                                                                                                                                                                                                            "C:\Windows\eHome\EhTray.exe" /nav:-2
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                            PID:3008
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2252
                                                                                                                                                                                                                          • C:\Windows\system32\IEEtwCollector.exe
                                                                                                                                                                                                                            C:\Windows\system32\IEEtwCollector.exe /V
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:676
                                                                                                                                                                                                                          • C:\Windows\ehome\ehRec.exe
                                                                                                                                                                                                                            C:\Windows\ehome\ehRec.exe -Embedding
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:2024
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE" /auditservice
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                            PID:880
                                                                                                                                                                                                                          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2984
                                                                                                                                                                                                                          • C:\Windows\System32\msdtc.exe
                                                                                                                                                                                                                            C:\Windows\System32\msdtc.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in System32 directory
                                                                                                                                                                                                                            PID:1736
                                                                                                                                                                                                                          • C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                            C:\Windows\system32\msiexec.exe /V
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Loads dropped DLL
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:1568
                                                                                                                                                                                                                          • C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
                                                                                                                                                                                                                            "C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2824
                                                                                                                                                                                                                          • C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                                                                                            C:\Windows\SysWow64\perfhost.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2596
                                                                                                                                                                                                                          • C:\Windows\system32\locator.exe
                                                                                                                                                                                                                            C:\Windows\system32\locator.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2636
                                                                                                                                                                                                                          • C:\Windows\System32\snmptrap.exe
                                                                                                                                                                                                                            C:\Windows\System32\snmptrap.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2232
                                                                                                                                                                                                                          • C:\Windows\System32\vds.exe
                                                                                                                                                                                                                            C:\Windows\System32\vds.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2460
                                                                                                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:1800
                                                                                                                                                                                                                          • C:\Windows\system32\wbengine.exe
                                                                                                                                                                                                                            "C:\Windows\system32\wbengine.exe"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:2528
                                                                                                                                                                                                                          • C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                            C:\Windows\system32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2240
                                                                                                                                                                                                                          • C:\Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                                                                                            "C:\Program Files\Windows Media Player\wmpnetwk.exe"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            PID:2712
                                                                                                                                                                                                                          • C:\Windows\system32\SearchIndexer.exe
                                                                                                                                                                                                                            C:\Windows\system32\SearchIndexer.exe /Embedding
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                            PID:908
                                                                                                                                                                                                                            • C:\Windows\system32\SearchProtocolHost.exe
                                                                                                                                                                                                                              "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Drops file in System32 directory
                                                                                                                                                                                                                              • Modifies data under HKEY_USERS
                                                                                                                                                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                              PID:2868
                                                                                                                                                                                                                            • C:\Windows\system32\SearchFilterHost.exe
                                                                                                                                                                                                                              "C:\Windows\system32\SearchFilterHost.exe" 0 588 592 600 65536 596
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1940
                                                                                                                                                                                                                            • C:\Windows\system32\wbem\WMIADAP.EXE
                                                                                                                                                                                                                              wmiadap.exe /F /T /R
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:1052

                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                    ose.exe
                                                                                                                                                                                                                                    • Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ose.exe
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 60dcfc58be16a230c0d09dc10d2005af85c56f6c06dbb37764a71b19e0de6538
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    setup.exe
                                                                                                                                                                                                                                    • Path C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
                                                                                                                                                                                                                                    • Size 1.6MB
                                                                                                                                                                                                                                    • SHA256 fbe94e66ccf4cbaf1ebabf9af3946cfa99b0729fd50afdbc0df4eeb36ff97961
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    DW20.EXE
                                                                                                                                                                                                                                    • Path C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\DW20.EXE
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 a69d9dd35ae87a2af332c4b8034f64c237e9432578baeb9d25b2a7da6275af1a
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    dwtrig20.exe
                                                                                                                                                                                                                                    • Path C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\dwtrig20.exe
                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                    • SHA256 2f8eb95dd49be9393480b6016f2632aa655b32fa3d68ae08d6db0bd77c0b01db
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    OSE.EXE
                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 7a909e5b7ac9c04d98d3336bea53b9b00144209cbca1edda3a5f5ceb27d67f06
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    GROOVE.EXE
                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE
                                                                                                                                                                                                                                    • Size 30.1MB
                                                                                                                                                                                                                                    • SHA256 8445ac34898fc703e7829172fcec83fb65c8dddcf4cf7bd29a949384c9ecda05
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    maintenanceservice.exe
                                                                                                                                                                                                                                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                                                                                                                                                                                                                                    • Size 1.4MB
                                                                                                                                                                                                                                    • SHA256 3afb5cc58bbb3daa90179137b12fbf953031036987e73d58aef9bc4fac57e55c
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    7z.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\7-Zip\7z.exe
                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                    • SHA256 2796b10a5cf84363c397e425d281aeff8e17eb56e5e6406db225f4940d716a98
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    7zFM.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\7-Zip\7zFM.exe
                                                                                                                                                                                                                                    • Size 1.5MB
                                                                                                                                                                                                                                    • SHA256 2a5e3cd379414cc5ed303d39618bf166e3afa896012b781dd7256085dd38fca7
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    7zG.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\7-Zip\7zG.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 7373997b2c196e1e1019de88c41064709e97c92e2f12349f39e161f29dd9dea7
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Uninstall.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\7-Zip\Uninstall.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 b7286722c7a3b970204b61a9b29528588e4b61cbae14167d3d32bdce181e4e32
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    chrmstp.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
                                                                                                                                                                                                                                    • Size 4.8MB
                                                                                                                                                                                                                                    • SHA256 58c105560c02a3a825aa3144e88567743a5f80d0eea9d5d0ae6542d3a7f356bc
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    setup.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe
                                                                                                                                                                                                                                    • Size 4.8MB
                                                                                                                                                                                                                                    • SHA256 075648e8998972ef1a1f8a8db1a05414bd6c109f25e4c985bc32feb3aa13571d
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    chrome_pwa_launcher.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe
                                                                                                                                                                                                                                    • Size 2.2MB
                                                                                                                                                                                                                                    • SHA256 d85fd3f612216e78b493d92f6bb4cacd0bb4ff42b62c4054ec10bafbbb8fda4e
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    elevation_service.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                    • SHA256 a9062f2ce7b88586ec88ac6bd8aa671ce400b6bf6cf64e76ea2db560a3ca21b2
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    notification_helper.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe
                                                                                                                                                                                                                                    • Size 1.8MB
                                                                                                                                                                                                                                    • SHA256 7221fef3b039490280f3ec7226ad9d6e8043a405fe709d83889f46a25638ff08
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    chrome_proxy.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
                                                                                                                                                                                                                                    • Size 1.5MB
                                                                                                                                                                                                                                    • SHA256 466de033acac53285aed538db0866c194cdd898f7ff8cbc95a5459e74b0adbf1
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    appletviewer.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 a6fa37bfc74aa9a12b2871b660a862fda47b5ee06e73799b6d0189756f1948d9
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    apt.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 1e08f1daa6b1bb817d1d4f5c86b737b4c2495bb6a3fc2656eb10f46973a210e7
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    extcheck.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 eec5ccb911321dcd8919f2bc9558510299e6a2e5ebfe12d6c83907d24433f373
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    idlj.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 614e62e9b3bb7d854ecd4485285de027c592aa579c70803418af1dd34650ff4e
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    jabswitch.exe
                                                                                                                                                                                                                                    • Path C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 cfd9139bccb69612d6fca4e4cd48418c3ad75eb407faa16caf7e4e5ec28865cc
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    MSS.log
                                                                                                                                                                                                                                    • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\MSS.log
                                                                                                                                                                                                                                    • Size 1024KB
                                                                                                                                                                                                                                    • SHA256 982bdab84caac2fb300d780e116426b069822a5e6c9dea03f898d730a063e350
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b91050d8b077a4e8.customDestinations-ms
                                                                                                                                                                                                                                    • Size 24B
                                                                                                                                                                                                                                    • SHA256 7116ff028244a01f3d17f1d3bc2e1506bc9999c2e40e388458f0cccc4e117312
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    mscorsvw.exe
                                                                                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 377453a0bc4fadd66227adc08211af4abc726cd1653cee910c7f11e144ebcf69
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    ngen_service.log
                                                                                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ngen_service.log
                                                                                                                                                                                                                                    • Size 872KB
                                                                                                                                                                                                                                    • SHA256 24e597df52e7615f1d7dd0f573962e3a92893174e548228f42acf5e7ad4ad2c6
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    aspnet_state.exe
                                                                                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 a0a0dff3c9ac0495740d79008856c1bbe18b525044096310bc40c8a9e6e2e0e1
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    mscorsvw.exe
                                                                                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 2d5c9a533f5507facea1e0a00251430debd5439ed9160b5391289793282b8b04
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    mscorsvw.exe
                                                                                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 01f40aaac99f88423e52cdf9fdccde3364e1b720fa417c663c1aab60c1f6258a
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    ngen_service.log
                                                                                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\ngen_service.log
                                                                                                                                                                                                                                    • Size 1003KB
                                                                                                                                                                                                                                    • SHA256 6f49918d8fb4e3561b50aaac30c38ba60e0ce67ea14183846a459d001f21206c
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    mscorsvw.exe
                                                                                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 09db9076f013a40fa08e92b3eec240cefc89099580025798fa246f8afead454f
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    ngen_service.log
                                                                                                                                                                                                                                    • Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen_service.log
                                                                                                                                                                                                                                    • Size 8KB
                                                                                                                                                                                                                                    • SHA256 8ab5c73026f96c1a13e0d3fd3c9aca7dc87210db7c6dcc81e3ab228823cc3c84
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    perfhost.exe
                                                                                                                                                                                                                                    • Path C:\Windows\SysWOW64\perfhost.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 6d59f6f95aa0f224aaf3dd45180436c510467e888e4ae0738b166b7dba5b5d3b
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Locator.exe
                                                                                                                                                                                                                                    • Path C:\Windows\System32\Locator.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 dcfc122b26b9be3f7473ad6b937b2e8f62085e4c81a8e81285fe391d0e2b2d12
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    SearchIndexer.exe
                                                                                                                                                                                                                                    • Path C:\Windows\System32\SearchIndexer.exe
                                                                                                                                                                                                                                    • Size 1.1MB
                                                                                                                                                                                                                                    • SHA256 98b31a90dfd7692d89e96586e6b0d710374a318867705965475b4a1ac1c7dbd0
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    VSSVC.exe
                                                                                                                                                                                                                                    • Path C:\Windows\System32\VSSVC.exe
                                                                                                                                                                                                                                    • Size 2.1MB
                                                                                                                                                                                                                                    • SHA256 6a477d326026c596ff5de48fe2728aed40c9dd293f74aa5d0558e60c2eb4eee7
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    alg.exe
                                                                                                                                                                                                                                    • Path C:\Windows\System32\alg.exe
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 6ed2411200be349ca95c1df9a6f18e6db343b061592271219139dfe1271e40bc
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    ieetwcollector.exe
                                                                                                                                                                                                                                    • Path C:\Windows\System32\ieetwcollector.exe
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 ab93674a646c43c2027da03ddf2c9601fc6de2ae075f4cd31a54dc1469c4a743
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    msdtc.exe
                                                                                                                                                                                                                                    • Path C:\Windows\System32\msdtc.exe
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 1a01ae50a20d4a0d39c651a42939d0eefa87fd8bf7a61d8981fae24dcbaa1229
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    snmptrap.exe
                                                                                                                                                                                                                                    • Path C:\Windows\System32\snmptrap.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 192450773ceb8af4436cf903e954ee1329655bf6aa8b8c1041bf67be28fd57ea
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    vds.exe
                                                                                                                                                                                                                                    • Path C:\Windows\System32\vds.exe
                                                                                                                                                                                                                                    • Size 1.7MB
                                                                                                                                                                                                                                    • SHA256 84982a107a775cae8f0d3d375d70e049eabc07725712a979dabc0afd25901703
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    wbengine.exe
                                                                                                                                                                                                                                    • Path C:\Windows\System32\wbengine.exe
                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                    • SHA256 f1eee019ba29a8f16130987335dfe6fe6bb0ef1eb43262decc9ad62d457f9158
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.Office.Tools.Word.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\135228e87b2c27d26b516ac0fc0ce667\Microsoft.Office.Tools.Word.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 834KB
                                                                                                                                                                                                                                    • SHA256 a0ae0aec5b203865fac761023741a59d274e2c41889aeb69140eb746d38f6ce0
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\5766ec3721d18a48bec1ca1f60331e2d\Microsoft.Office.Tools.Common.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 797KB
                                                                                                                                                                                                                                    • SHA256 4c53ca542ac5ef9d822ef8cb3b0ecef3fb8b937d94c0a7b735bedb275c74a263
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\60214b09b490be856c4ee2b3398d71bd\Microsoft.Office.Tools.Outlook.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 163KB
                                                                                                                                                                                                                                    • SHA256 99facae4828c566c310a1ccf4059100067ab8bfb3d6e94e44dd9e189fd491142
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\d7be05162f8d0fba8f4447db13f6695b\Microsoft.Office.Tools.Excel.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 489fec79addba2de9141daa61062a05a95e96a196049ce414807bada572cc35c
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.To#\e1f8e4d08d4b7f811b7dbbacd324027b\Microsoft.Office.Tools.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 148KB
                                                                                                                                                                                                                                    • SHA256 f6c7aecb211d9aac911bf80c91e84a47a72ac52cbb523e34e9da6482c0b24c58
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\00cf0faa3d37faa0ea2d240c1ca307ef\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 143KB
                                                                                                                                                                                                                                    • SHA256 b72a1f7da8b3c3dc95c2252319f6f3e71c81ed8bd59a5b31bd2861e14c364459
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\03cad6bd8b37d21b28dcb4f955be2158\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 34KB
                                                                                                                                                                                                                                    • SHA256 620b41f5e02df56c33919218bedc238ca7e76552c43da4f0f39a106835a4edc3
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\0cb958acb9cd4cacb46ebc0396e30aa3\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 109KB
                                                                                                                                                                                                                                    • SHA256 211d2b83bb82042385757f811d90c5ae0a281f3abb3bf1c7901e8559db479e60
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\181356b1bbb85fe2401c4dfad1a45133\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 158KB
                                                                                                                                                                                                                                    • SHA256 b2f9dce9baca3e56fb3587ffe30ca38eb0f89ed30985b328a853778480c0f87b
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\367516b7878af19f5c84c67f2cd277ae\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 41KB
                                                                                                                                                                                                                                    • SHA256 de21619e70f9ef8ccbb274bcd0d9d2ace1bae0442dfefab45976671587cf0a48
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\43ac81bed18b52d77a8011ada80939b5\Microsoft.VisualStudio.Tools.Office.AppInfoDocument.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 296KB
                                                                                                                                                                                                                                    • SHA256 ad8d210d001d3298ad4e1cbf08449b2cbd2b358d28cfad99db78639627a7cb86
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\48a294a6ff9cea6b26c38fc8b4f5e3e8\Microsoft.VisualStudio.Tools.Applications.Hosting.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 356KB
                                                                                                                                                                                                                                    • SHA256 971188681028501d5ac8143b9127feb95d6982417590af42cf1a43483e38bd42
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\54a0aa7a0340282bafeacc3b2c1f171d\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 180KB
                                                                                                                                                                                                                                    • SHA256 c518e6cd4977a544b590c3d0cfc9ccaa70167c10228d35bb049903538049047a
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\56ada4feca1574fe45dec74f7b2560fc\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 187KB
                                                                                                                                                                                                                                    • SHA256 287aa496288d47664e0d5524fdd512e9fb74a124cb4923c5ebb25f50638e3fa4
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5c8b40c69a2293c8f499b38b25c41117\Microsoft.VisualStudio.Tools.Office.Word.AddInProxy.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 157KB
                                                                                                                                                                                                                                    • SHA256 0406be7235661a62f68bff4c7640b4e241a0c392d548bf242ed08ba0eeaee66b
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\5f2320d38621eb541713e6cd421c2b8a\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 648KB
                                                                                                                                                                                                                                    • SHA256 637dc357ff9011902186f2fd128ca74ac84fdb6d984f15036803b6a8fe28868a
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\787526c375f27d452cde50fea4f7986b\Microsoft.VisualStudio.Tools.Applications.Adapter.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 868c297cb00b2d298f594ad7e3fd4e38aeaac78042613626d6f919b2bca25c4f
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\8c6bac317f75b51647ea3a8da141b143\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 210KB
                                                                                                                                                                                                                                    • SHA256 8cd6a0b061b43e0b660b81859c910290a3672b00d7647ba0e86eda6ddcc8c553
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9248a710d7fe2485a557ce5d3cbcf2df\Microsoft.VisualStudio.Tools.Office.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 607KB
                                                                                                                                                                                                                                    • SHA256 a09436c1df8fcd8ecd1732d6e4e68f32b092e71e0c5d3308b0f3f20abd03d4e0
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\9306fc630870a75ddd23441ad77bdc57\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 53KB
                                                                                                                                                                                                                                    • SHA256 e5faf5e8adf46a8246e6b5038409dadca46985a9951343a1936237d2c8d7a845
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\a05ee2388c8a28fb3ac98ec65148e455\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 65KB
                                                                                                                                                                                                                                    • SHA256 b06632dff444204f6e76b16198c31ab706ea52270d5e3ae81626dc1fc1fb1a4d
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\afa5bb1a39443d7dc81dfff54073929b\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 28KB
                                                                                                                                                                                                                                    • SHA256 4436550409cfb3d06b15dd0c3131e87e7002b0749c7c6e9dc3378c99dbec815d
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\b8e029b1434d965380b363483e376df0\Microsoft.VisualStudio.Tools.Applications.ServerDocument.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 329KB
                                                                                                                                                                                                                                    • SHA256 e94a4ad1ef9de2886a231e857c8691328c2e6e344cc9e82440e5c45b8a788256
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bb63c81d306795319eaf7af25f67342a\Microsoft.VisualStudio.Tools.Office.ContainerControl.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 141KB
                                                                                                                                                                                                                                    • SHA256 124a0869df89ec2c9f0b307dd6b6d17e1e1e7ad638e0b4abf4483c15f842d270
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\bf3e8ba642eaf9a5371982f211550c52\Microsoft.VisualStudio.Tools.Applications.Hosting.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 278KB
                                                                                                                                                                                                                                    • SHA256 54701cbe719b08b2393b9f4a604c372f9a280b5d3dd520b563d2aea7d69a1496
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\de06a98a598aa0ff716a25b24d56ad7f\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 27KB
                                                                                                                                                                                                                                    • SHA256 edc90887d38c87282f49adbb12a94040f9ac86058bfae15063aaaff2672b54e1
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\e0220058091b941725ef02be0b84abe7\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 57KB
                                                                                                                                                                                                                                    • SHA256 4b78ffa5f0b6751aea11917db5961d566e2f59beaa054b41473d331fd392329e
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ead98983ef14fed50a621d4e557da2d6\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.ni.dll
                                                                                                                                                                                                                                    • Size 83KB
                                                                                                                                                                                                                                    • SHA256 68475ef7ac25469cdeba01733df87a03aa600bd13341ff839468f5fca4f4283c
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\ee73646032cbb022d16771203727e3b2\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 130KB
                                                                                                                                                                                                                                    • SHA256 f00156860ec7e88f4ccb459ca29b7e0e5c169cdc8a081cb043603187d25d92b3
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\f1a7ac664667f2d6bcd6c388b230c22b\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 59KB
                                                                                                                                                                                                                                    • SHA256 a21471690e7c32c80049e17c13624820e77bca6c9c38b83d9ea8a7248086660d
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualStu#\fc36797f7054935a6033077612905a0f\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.ni.dll
                                                                                                                                                                                                                                    • Size 42KB
                                                                                                                                                                                                                                    • SHA256 f019899f829731f899a99885fd52fde1fe4a4f6fe3ecf7f7a7cfa78517c00575
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    ehiVidCtl.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\ehiVidCtl\88e20c69254157d91b96eadc9444815d\ehiVidCtl.ni.dll
                                                                                                                                                                                                                                    • Size 855KB
                                                                                                                                                                                                                                    • SHA256 897626e6af00e85e627eeaa7f9563b245335242bc6196b36d0072e5b6d45e543
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    stdole.ni.dll
                                                                                                                                                                                                                                    • Path C:\Windows\assembly\NativeImages_v2.0.50727_32\stdole\2c6d60b55bbab22515c512080d4b3bae\stdole.ni.dll
                                                                                                                                                                                                                                    • Size 43KB
                                                                                                                                                                                                                                    • SHA256 6a6ac3094130d1affd34aae5ba2bd8c889e2071eb4217a75d72b5560f884e357
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    ehrecvr.exe
                                                                                                                                                                                                                                    • Path C:\Windows\ehome\ehrecvr.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 ad785698461fc134719b815ccd3e30e86a7ce52c301e9d79f49ac1e5827904fc
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    fxssvc.exe
                                                                                                                                                                                                                                    • Path C:\Windows\system32\fxssvc.exe
                                                                                                                                                                                                                                    • Size 1.2MB
                                                                                                                                                                                                                                    • SHA256 eab0b2f36b0bb0b5016a8ce271ef7264c2d8ff21f9605743737a70929417abc8
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    msiexec.exe
                                                                                                                                                                                                                                    • Path C:\Windows\system32\msiexec.exe
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 8b8ba546b3bac2be3366a0f41c109c4fceae85b8d6901b510ad0f552c4b4685f
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    wmpnetwk.exe
                                                                                                                                                                                                                                    • Path \Program Files\Windows Media Player\wmpnetwk.exe
                                                                                                                                                                                                                                    • Size 2.0MB
                                                                                                                                                                                                                                    • SHA256 0bef0baa1bc371c3ab9ad2655fc0db3e63a3182300877a74a698b7b0480bc581
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    WmiApSrv.exe
                                                                                                                                                                                                                                    • Path \Windows\System32\wbem\WmiApSrv.exe
                                                                                                                                                                                                                                    • Size 1.4MB
                                                                                                                                                                                                                                    • SHA256 b64c7ae7ca519447336746b5af7d72a6db530a5cf7be03e5cf4d68cf9527229f
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    ehsched.exe
                                                                                                                                                                                                                                    • Path \Windows\ehome\ehsched.exe
                                                                                                                                                                                                                                    • Size 1.3MB
                                                                                                                                                                                                                                    • SHA256 85aeddff43d93d563ac3db7ab103c54dfaed450da5dd8129f01149fddbb8a67d
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    memory/332-696-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/572-685-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/676-270-0x0000000140000000-0x00000001401ED000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/676-889-0x0000000140000000-0x00000001401ED000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/676-159-0x0000000140000000-0x00000001401ED000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/880-181-0x000000002E000000-0x000000002FE1E000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/880-267-0x000000002E000000-0x000000002FE1E000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/908-333-0x0000000100000000-0x0000000100123000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/908-656-0x0000000100000000-0x0000000100123000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-74-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-965-0x00000000023B0000-0x00000000023CA000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-80-0x0000000000BA0000-0x0000000000C07000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-968-0x00000000023B0000-0x000000000254E000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-969-0x00000000023B0000-0x000000000249C000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-970-0x00000000023B0000-0x00000000023C0000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-967-0x00000000023B0000-0x0000000002454000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-966-0x00000000023B0000-0x000000000243C000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-971-0x00000000023B0000-0x0000000002438000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-75-0x0000000000BA0000-0x0000000000C07000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-210-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-964-0x00000000023B0000-0x00000000023CE000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-963-0x00000000023B0000-0x00000000023BA000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-975-0x00000000023B0000-0x0000000002416000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-974-0x00000000023B0000-0x00000000023DA000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-973-0x00000000023B0000-0x00000000023B8000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1448-972-0x00000000023B0000-0x00000000023D4000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1568-203-0x0000000100000000-0x00000001001F1000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1568-332-0x0000000000610000-0x0000000000801000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1568-319-0x0000000100000000-0x00000001001F1000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1568-211-0x0000000000610000-0x0000000000801000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1572-57-0x00000000001F0000-0x0000000000250000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1572-104-0x0000000010000000-0x00000000101E6000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1572-63-0x00000000001F0000-0x0000000000250000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1572-56-0x0000000010000000-0x00000000101E6000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1608-718-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1612-639-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1612-653-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1696-669-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1736-306-0x0000000140000000-0x00000001401F5000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1736-186-0x0000000140000000-0x00000001401F5000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1748-871-0x0000000140000000-0x00000001401F1000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1748-244-0x0000000140000000-0x00000001401F1000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1748-129-0x0000000140000000-0x00000001401F1000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1800-607-0x0000000100000000-0x0000000100219000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1800-282-0x0000000100000000-0x0000000100219000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1848-758-0x0000000003D20000-0x0000000003DDA000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2232-268-0x0000000100000000-0x00000001001D5000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2232-590-0x0000000100000000-0x00000001001D5000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2240-636-0x0000000100000000-0x0000000100203000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2240-307-0x0000000100000000-0x0000000100203000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2252-257-0x0000000140000000-0x0000000140237000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2252-146-0x0000000140000000-0x0000000140237000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2316-567-0x0000000010000000-0x00000000101DE000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2316-642-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2316-628-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2316-90-0x0000000010000000-0x00000000101DE000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2316-8-0x0000000000260000-0x00000000002C7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2316-0-0x0000000010000000-0x00000000101DE000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2316-1-0x0000000000260000-0x00000000002C7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2460-279-0x0000000100000000-0x0000000100253000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2460-599-0x0000000100000000-0x0000000100253000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2528-300-0x0000000100000000-0x0000000100202000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2528-629-0x0000000100000000-0x0000000100202000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2596-512-0x0000000001000000-0x00000000011D5000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2596-50-0x0000000000230000-0x0000000000297000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2596-39-0x0000000010000000-0x00000000101DE000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2596-238-0x0000000001000000-0x00000000011D5000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2596-71-0x0000000010000000-0x00000000101DE000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2596-40-0x0000000000230000-0x0000000000297000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2636-566-0x0000000100000000-0x00000001001D4000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2636-253-0x0000000100000000-0x00000001001D4000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2640-591-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2640-618-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2640-666-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2712-652-0x0000000100000000-0x000000010020A000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2712-326-0x0000000100000000-0x000000010020A000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2784-706-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2796-27-0x0000000140000000-0x00000001401DC000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2796-150-0x0000000140000000-0x00000001401DC000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2796-36-0x0000000000200000-0x0000000000260000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2796-28-0x0000000000200000-0x0000000000260000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2824-226-0x000000002E000000-0x000000002E1F4000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2824-448-0x000000002E000000-0x000000002E1F4000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2848-22-0x0000000000790000-0x00000000007F0000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2848-116-0x0000000100000000-0x00000001001E3000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2848-13-0x0000000000790000-0x00000000007F0000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2848-19-0x0000000100000000-0x00000001001E3000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2908-722-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2908-719-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2912-98-0x0000000000A70000-0x0000000000AD0000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2912-91-0x0000000000A70000-0x0000000000AD0000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2912-223-0x0000000140000000-0x00000001401ED000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2912-97-0x0000000140000000-0x00000001401ED000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2920-110-0x00000000002A0000-0x0000000000300000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2920-117-0x00000000002A0000-0x0000000000300000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2920-119-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2920-230-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2920-944-0x0000000140000000-0x000000014013C000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2984-185-0x0000000140000000-0x0000000140209000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2984-197-0x0000000140000000-0x0000000140209000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3040-630-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3040-615-0x0000000000400000-0x00000000005E7000-memory.dmp
                                                                                                                                                                                                                                    Download