Analysis
-
max time kernel
72s -
max time network
137s -
platform
windows10_x64 -
resource
win10 -
submitted
08-07-2020 10:11
Static task
static1
Behavioral task
behavioral1
Sample
Bank Swift.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Bank Swift.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
Bank Swift.exe
-
Size
358KB
-
MD5
f55aff3fd76077b94b58fd946b837a3b
-
SHA1
719e40e3cb661e26d269a34546456bea3a2eda10
-
SHA256
680cb634fa1fcc47a2760a86939423413d46aeb170b703732db614c2e96260d1
-
SHA512
e392df15533ce7008ad5239c44e15761fc3841bb694c4f9b9b931dc69c6049b6c53135feff9853c8591dbdcd48fe30d8c59db5b4fecfea8753077c82c5c6cdc8
Score
7/10
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
Bank Swift.exeBank Swift.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe Bank Swift.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe Bank Swift.exe -
Suspicious use of WriteProcessMemory 1726 IoCs
Processes:
Bank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exedescription pid process target process PID 3608 wrote to memory of 3736 3608 Bank Swift.exe RegAsm.exe PID 3608 wrote to memory of 3736 3608 Bank Swift.exe RegAsm.exe PID 3608 wrote to memory of 3736 3608 Bank Swift.exe RegAsm.exe PID 3608 wrote to memory of 2212 3608 Bank Swift.exe RegAsm.exe PID 3608 wrote to memory of 2212 3608 Bank Swift.exe RegAsm.exe PID 3608 wrote to memory of 2212 3608 Bank Swift.exe RegAsm.exe PID 3608 wrote to memory of 2212 3608 Bank Swift.exe RegAsm.exe PID 3608 wrote to memory of 3852 3608 Bank Swift.exe Bank Swift.exe PID 3608 wrote to memory of 3852 3608 Bank Swift.exe Bank Swift.exe PID 3608 wrote to memory of 3852 3608 Bank Swift.exe Bank Swift.exe PID 3852 wrote to memory of 3188 3852 Bank Swift.exe RegAsm.exe PID 3852 wrote to memory of 3188 3852 Bank Swift.exe RegAsm.exe PID 3852 wrote to memory of 3188 3852 Bank Swift.exe RegAsm.exe PID 3852 wrote to memory of 3188 3852 Bank Swift.exe RegAsm.exe PID 3852 wrote to memory of 2980 3852 Bank Swift.exe Bank Swift.exe PID 3852 wrote to memory of 2980 3852 Bank Swift.exe Bank Swift.exe PID 3852 wrote to memory of 2980 3852 Bank Swift.exe Bank Swift.exe PID 2980 wrote to memory of 2904 2980 Bank Swift.exe RegAsm.exe PID 2980 wrote to memory of 2904 2980 Bank Swift.exe RegAsm.exe PID 2980 wrote to memory of 2904 2980 Bank Swift.exe RegAsm.exe PID 2980 wrote to memory of 2976 2980 Bank Swift.exe RegAsm.exe PID 2980 wrote to memory of 2976 2980 Bank Swift.exe RegAsm.exe PID 2980 wrote to memory of 2976 2980 Bank Swift.exe RegAsm.exe PID 2980 wrote to memory of 2976 2980 Bank Swift.exe RegAsm.exe PID 2980 wrote to memory of 748 2980 Bank Swift.exe Bank Swift.exe PID 2980 wrote to memory of 748 2980 Bank Swift.exe Bank Swift.exe PID 2980 wrote to memory of 748 2980 Bank Swift.exe Bank Swift.exe PID 748 wrote to memory of 3696 748 Bank Swift.exe RegAsm.exe PID 748 wrote to memory of 3696 748 Bank Swift.exe RegAsm.exe PID 748 wrote to memory of 3696 748 Bank Swift.exe RegAsm.exe PID 748 wrote to memory of 3696 748 Bank Swift.exe RegAsm.exe PID 748 wrote to memory of 616 748 Bank Swift.exe Bank Swift.exe PID 748 wrote to memory of 616 748 Bank Swift.exe Bank Swift.exe PID 748 wrote to memory of 616 748 Bank Swift.exe Bank Swift.exe PID 616 wrote to memory of 1104 616 Bank Swift.exe RegAsm.exe PID 616 wrote to memory of 1104 616 Bank Swift.exe RegAsm.exe PID 616 wrote to memory of 1104 616 Bank Swift.exe RegAsm.exe PID 616 wrote to memory of 1104 616 Bank Swift.exe RegAsm.exe PID 616 wrote to memory of 1640 616 Bank Swift.exe Bank Swift.exe PID 616 wrote to memory of 1640 616 Bank Swift.exe Bank Swift.exe PID 616 wrote to memory of 1640 616 Bank Swift.exe Bank Swift.exe PID 1640 wrote to memory of 1896 1640 Bank Swift.exe RegAsm.exe PID 1640 wrote to memory of 1896 1640 Bank Swift.exe RegAsm.exe PID 1640 wrote to memory of 1896 1640 Bank Swift.exe RegAsm.exe PID 1640 wrote to memory of 1876 1640 Bank Swift.exe RegAsm.exe PID 1640 wrote to memory of 1876 1640 Bank Swift.exe RegAsm.exe PID 1640 wrote to memory of 1876 1640 Bank Swift.exe RegAsm.exe PID 1640 wrote to memory of 1876 1640 Bank Swift.exe RegAsm.exe PID 1640 wrote to memory of 3816 1640 Bank Swift.exe Bank Swift.exe PID 1640 wrote to memory of 3816 1640 Bank Swift.exe Bank Swift.exe PID 1640 wrote to memory of 3816 1640 Bank Swift.exe Bank Swift.exe PID 3816 wrote to memory of 3008 3816 Bank Swift.exe RegAsm.exe PID 3816 wrote to memory of 3008 3816 Bank Swift.exe RegAsm.exe PID 3816 wrote to memory of 3008 3816 Bank Swift.exe RegAsm.exe PID 3816 wrote to memory of 3012 3816 Bank Swift.exe RegAsm.exe PID 3816 wrote to memory of 3012 3816 Bank Swift.exe RegAsm.exe PID 3816 wrote to memory of 3012 3816 Bank Swift.exe RegAsm.exe PID 3816 wrote to memory of 2852 3816 Bank Swift.exe RegAsm.exe PID 3816 wrote to memory of 2852 3816 Bank Swift.exe RegAsm.exe PID 3816 wrote to memory of 2852 3816 Bank Swift.exe RegAsm.exe PID 3816 wrote to memory of 2852 3816 Bank Swift.exe RegAsm.exe PID 3816 wrote to memory of 1004 3816 Bank Swift.exe Bank Swift.exe PID 3816 wrote to memory of 1004 3816 Bank Swift.exe Bank Swift.exe PID 3816 wrote to memory of 1004 3816 Bank Swift.exe Bank Swift.exe -
Suspicious behavior: MapViewOfSection 295 IoCs
Processes:
Bank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exepid process 3608 Bank Swift.exe 3608 Bank Swift.exe 3852 Bank Swift.exe 2980 Bank Swift.exe 2980 Bank Swift.exe 748 Bank Swift.exe 616 Bank Swift.exe 1640 Bank Swift.exe 1640 Bank Swift.exe 3816 Bank Swift.exe 3816 Bank Swift.exe 3816 Bank Swift.exe 1004 Bank Swift.exe 1004 Bank Swift.exe 2564 Bank Swift.exe 364 Bank Swift.exe 1272 Bank Swift.exe 1272 Bank Swift.exe 1096 Bank Swift.exe 1668 Bank Swift.exe 3852 Bank Swift.exe 652 Bank Swift.exe 3696 Bank Swift.exe 1644 Bank Swift.exe 3712 Bank Swift.exe 3712 Bank Swift.exe 2152 Bank Swift.exe 3352 Bank Swift.exe 744 Bank Swift.exe 3852 Bank Swift.exe 796 Bank Swift.exe 1876 Bank Swift.exe 1876 Bank Swift.exe 1876 Bank Swift.exe 1332 Bank Swift.exe 3628 Bank Swift.exe 588 Bank Swift.exe 588 Bank Swift.exe 588 Bank Swift.exe 1960 Bank Swift.exe 3896 Bank Swift.exe 3868 Bank Swift.exe 3868 Bank Swift.exe 3868 Bank Swift.exe 2220 Bank Swift.exe 1168 Bank Swift.exe 540 Bank Swift.exe 1252 Bank Swift.exe 796 Bank Swift.exe 796 Bank Swift.exe 1524 Bank Swift.exe 336 Bank Swift.exe 1508 Bank Swift.exe 3000 Bank Swift.exe 3000 Bank Swift.exe 3000 Bank Swift.exe 2564 Bank Swift.exe 4068 Bank Swift.exe 1640 Bank Swift.exe 1752 Bank Swift.exe 3908 Bank Swift.exe 2172 Bank Swift.exe 2968 Bank Swift.exe 2764 Bank Swift.exe -
Suspicious use of SetThreadContext 211 IoCs
Processes:
Bank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exedescription pid process target process PID 3608 set thread context of 2212 3608 Bank Swift.exe RegAsm.exe PID 3852 set thread context of 3188 3852 Bank Swift.exe RegAsm.exe PID 2980 set thread context of 2976 2980 Bank Swift.exe RegAsm.exe PID 748 set thread context of 3696 748 Bank Swift.exe RegAsm.exe PID 616 set thread context of 1104 616 Bank Swift.exe RegAsm.exe PID 1640 set thread context of 1876 1640 Bank Swift.exe RegAsm.exe PID 3816 set thread context of 2852 3816 Bank Swift.exe RegAsm.exe PID 1004 set thread context of 2656 1004 Bank Swift.exe RegAsm.exe PID 2564 set thread context of 1960 2564 Bank Swift.exe RegAsm.exe PID 364 set thread context of 740 364 Bank Swift.exe RegAsm.exe PID 1272 set thread context of 3708 1272 Bank Swift.exe RegAsm.exe PID 1096 set thread context of 2148 1096 Bank Swift.exe RegAsm.exe PID 1668 set thread context of 3352 1668 Bank Swift.exe RegAsm.exe PID 3852 set thread context of 2328 3852 Bank Swift.exe RegAsm.exe PID 652 set thread context of 2864 652 Bank Swift.exe RegAsm.exe PID 3696 set thread context of 1752 3696 Bank Swift.exe RegAsm.exe PID 1644 set thread context of 1956 1644 Bank Swift.exe RegAsm.exe PID 3712 set thread context of 2420 3712 Bank Swift.exe RegAsm.exe PID 2152 set thread context of 2576 2152 Bank Swift.exe RegAsm.exe PID 3352 set thread context of 1832 3352 Bank Swift.exe RegAsm.exe PID 744 set thread context of 2572 744 Bank Swift.exe RegAsm.exe PID 3852 set thread context of 2860 3852 Bank Swift.exe RegAsm.exe PID 796 set thread context of 3908 796 Bank Swift.exe RegAsm.exe PID 1876 set thread context of 472 1876 Bank Swift.exe RegAsm.exe PID 1332 set thread context of 1652 1332 Bank Swift.exe RegAsm.exe PID 3628 set thread context of 3880 3628 Bank Swift.exe RegAsm.exe PID 588 set thread context of 3716 588 Bank Swift.exe RegAsm.exe PID 1960 set thread context of 744 1960 Bank Swift.exe RegAsm.exe PID 3896 set thread context of 2980 3896 Bank Swift.exe RegAsm.exe PID 3868 set thread context of 3640 3868 Bank Swift.exe RegAsm.exe PID 2220 set thread context of 2420 2220 Bank Swift.exe RegAsm.exe PID 1168 set thread context of 3000 1168 Bank Swift.exe RegAsm.exe PID 540 set thread context of 1692 540 Bank Swift.exe RegAsm.exe PID 1252 set thread context of 2920 1252 Bank Swift.exe RegAsm.exe PID 796 set thread context of 688 796 Bank Swift.exe RegAsm.exe PID 1524 set thread context of 1752 1524 Bank Swift.exe RegAsm.exe PID 336 set thread context of 3384 336 Bank Swift.exe RegAsm.exe PID 1508 set thread context of 1828 1508 Bank Swift.exe RegAsm.exe PID 3000 set thread context of 2968 3000 Bank Swift.exe RegAsm.exe PID 2564 set thread context of 2920 2564 Bank Swift.exe RegAsm.exe PID 4068 set thread context of 1336 4068 Bank Swift.exe RegAsm.exe PID 1640 set thread context of 1708 1640 Bank Swift.exe RegAsm.exe PID 1752 set thread context of 1464 1752 Bank Swift.exe RegAsm.exe PID 3908 set thread context of 2576 3908 Bank Swift.exe RegAsm.exe PID 2172 set thread context of 1648 2172 Bank Swift.exe RegAsm.exe PID 2968 set thread context of 1892 2968 Bank Swift.exe RegAsm.exe PID 2764 set thread context of 3764 2764 Bank Swift.exe RegAsm.exe PID 3724 set thread context of 2116 3724 Bank Swift.exe RegAsm.exe PID 3712 set thread context of 508 3712 Bank Swift.exe RegAsm.exe PID 2220 set thread context of 1912 2220 Bank Swift.exe RegAsm.exe PID 3856 set thread context of 3864 3856 Bank Swift.exe RegAsm.exe PID 1000 set thread context of 2324 1000 Bank Swift.exe RegAsm.exe PID 2168 set thread context of 812 2168 Bank Swift.exe RegAsm.exe PID 3764 set thread context of 2652 3764 Bank Swift.exe RegAsm.exe PID 744 set thread context of 1828 744 Bank Swift.exe RegAsm.exe PID 4068 set thread context of 964 4068 Bank Swift.exe RegAsm.exe PID 3920 set thread context of 2228 3920 Bank Swift.exe RegAsm.exe PID 2664 set thread context of 3948 2664 Bank Swift.exe RegAsm.exe PID 2960 set thread context of 1264 2960 Bank Swift.exe RegAsm.exe PID 364 set thread context of 1504 364 Bank Swift.exe RegAsm.exe PID 1992 set thread context of 496 1992 Bank Swift.exe RegAsm.exe PID 2576 set thread context of 408 2576 Bank Swift.exe RegAsm.exe PID 776 set thread context of 1912 776 Bank Swift.exe RegAsm.exe PID 1000 set thread context of 2172 1000 Bank Swift.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 422 IoCs
Processes:
Bank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 3608 Bank Swift.exe Token: SeDebugPrivilege 2212 RegAsm.exe Token: SeDebugPrivilege 3852 Bank Swift.exe Token: SeDebugPrivilege 3188 RegAsm.exe Token: SeDebugPrivilege 2980 Bank Swift.exe Token: SeDebugPrivilege 2976 RegAsm.exe Token: SeDebugPrivilege 748 Bank Swift.exe Token: SeDebugPrivilege 3696 RegAsm.exe Token: SeDebugPrivilege 616 Bank Swift.exe Token: SeDebugPrivilege 1104 RegAsm.exe Token: SeDebugPrivilege 1640 Bank Swift.exe Token: SeDebugPrivilege 1876 RegAsm.exe Token: SeDebugPrivilege 3816 Bank Swift.exe Token: SeDebugPrivilege 2852 RegAsm.exe Token: SeDebugPrivilege 1004 Bank Swift.exe Token: SeDebugPrivilege 2656 RegAsm.exe Token: SeDebugPrivilege 2564 Bank Swift.exe Token: SeDebugPrivilege 1960 RegAsm.exe Token: SeDebugPrivilege 364 Bank Swift.exe Token: SeDebugPrivilege 740 RegAsm.exe Token: SeDebugPrivilege 1272 Bank Swift.exe Token: SeDebugPrivilege 3708 RegAsm.exe Token: SeDebugPrivilege 1096 Bank Swift.exe Token: SeDebugPrivilege 2148 RegAsm.exe Token: SeDebugPrivilege 1668 Bank Swift.exe Token: SeDebugPrivilege 3352 RegAsm.exe Token: SeDebugPrivilege 3852 Bank Swift.exe Token: SeDebugPrivilege 2328 RegAsm.exe Token: SeDebugPrivilege 652 Bank Swift.exe Token: SeDebugPrivilege 2864 RegAsm.exe Token: SeDebugPrivilege 3696 Bank Swift.exe Token: SeDebugPrivilege 1752 RegAsm.exe Token: SeDebugPrivilege 1644 Bank Swift.exe Token: SeDebugPrivilege 1956 RegAsm.exe Token: SeDebugPrivilege 3712 Bank Swift.exe Token: SeDebugPrivilege 2420 RegAsm.exe Token: SeDebugPrivilege 2152 Bank Swift.exe Token: SeDebugPrivilege 2576 RegAsm.exe Token: SeDebugPrivilege 3352 Bank Swift.exe Token: SeDebugPrivilege 1832 RegAsm.exe Token: SeDebugPrivilege 744 Bank Swift.exe Token: SeDebugPrivilege 2572 RegAsm.exe Token: SeDebugPrivilege 3852 Bank Swift.exe Token: SeDebugPrivilege 2860 RegAsm.exe Token: SeDebugPrivilege 796 Bank Swift.exe Token: SeDebugPrivilege 3908 RegAsm.exe Token: SeDebugPrivilege 1876 Bank Swift.exe Token: SeDebugPrivilege 472 RegAsm.exe Token: SeDebugPrivilege 1332 Bank Swift.exe Token: SeDebugPrivilege 1652 RegAsm.exe Token: SeDebugPrivilege 3628 Bank Swift.exe Token: SeDebugPrivilege 3880 RegAsm.exe Token: SeDebugPrivilege 588 Bank Swift.exe Token: SeDebugPrivilege 3716 RegAsm.exe Token: SeDebugPrivilege 1960 Bank Swift.exe Token: SeDebugPrivilege 744 RegAsm.exe Token: SeDebugPrivilege 3896 Bank Swift.exe Token: SeDebugPrivilege 2980 RegAsm.exe Token: SeDebugPrivilege 3868 Bank Swift.exe Token: SeDebugPrivilege 3640 RegAsm.exe Token: SeDebugPrivilege 2220 Bank Swift.exe Token: SeDebugPrivilege 2420 RegAsm.exe Token: SeDebugPrivilege 1168 Bank Swift.exe Token: SeDebugPrivilege 3000 RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 51274 IoCs
Processes:
Bank Swift.exepid process 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe 3608 Bank Swift.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3608 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:3736
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3852 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2980 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵PID:2904
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:748 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"5⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:616 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"6⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1640 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵PID:1896
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"7⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3816 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵PID:3008
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵PID:3012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1004 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵PID:2664
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:364 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
- Suspicious use of AdjustPrivilegeToken
PID:740 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1272 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵PID:692
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
- Suspicious use of AdjustPrivilegeToken
PID:3708 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1096 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1668 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
- Suspicious use of AdjustPrivilegeToken
PID:3352 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3852 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
- Suspicious use of AdjustPrivilegeToken
PID:2328 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:652 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3696 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
- Suspicious use of AdjustPrivilegeToken
PID:1752 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1644 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"18⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3712 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵PID:1104
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"19⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2152 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"20⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3352 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"21⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"22⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3852 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
PID:2860 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"23⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
PID:3908 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"24⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1876 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵PID:496
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵PID:408
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
PID:472 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"25⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1332 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"26⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3628 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
PID:3880 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"27⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:588 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵PID:3336
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵PID:2428
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
PID:3716 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"28⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
PID:744 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"29⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3896 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"30⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3868 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵PID:3820
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵PID:1524
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
- Suspicious use of AdjustPrivilegeToken
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"31⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2220 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"32⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1168 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
- Suspicious use of AdjustPrivilegeToken
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"33⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:540 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"34⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1252 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"35⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:796 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵PID:364
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵PID:688
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"36⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1524 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵PID:1752
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"37⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:336 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵PID:3384
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"38⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1508 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"39⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3000 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵PID:2864
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵PID:3824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"40⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2564 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"41⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:4068 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"42⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1640 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"43⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1752 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"44⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3908 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"45⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2172 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵PID:1648
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"46⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵PID:1892
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"47⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2764 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"48⤵
- Suspicious use of SetThreadContext
PID:3724 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵PID:2116
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"49⤵
- Suspicious use of SetThreadContext
PID:3712 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"50⤵
- Suspicious use of SetThreadContext
PID:2220 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"51⤵
- Suspicious use of SetThreadContext
PID:3856 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"52⤵
- Suspicious use of SetThreadContext
PID:1000 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵PID:2664
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵PID:2324
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"53⤵
- Suspicious use of SetThreadContext
PID:2168 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵PID:812
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"54⤵
- Suspicious use of SetThreadContext
PID:3764 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵PID:1964
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵PID:1960
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵PID:3104
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"55⤵
- Suspicious use of SetThreadContext
PID:744 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵PID:1828
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"56⤵
- Suspicious use of SetThreadContext
PID:4068 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵PID:3712
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵PID:964
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"57⤵
- Suspicious use of SetThreadContext
PID:3920 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵PID:2228
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"58⤵
- Suspicious use of SetThreadContext
PID:2664 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵PID:3948
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"59⤵
- Suspicious use of SetThreadContext
PID:2960 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"60⤵
- Suspicious use of SetThreadContext
PID:364 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵PID:1504
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"61⤵
- Suspicious use of SetThreadContext
PID:1992 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵PID:2536
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵PID:496
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"62⤵
- Suspicious use of SetThreadContext
PID:2576 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵PID:408
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"63⤵
- Suspicious use of SetThreadContext
PID:776 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"64⤵
- Suspicious use of SetThreadContext
PID:1000 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"65⤵PID:3736
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵PID:1692
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"66⤵PID:3340
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵PID:3708
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"67⤵PID:1272
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵PID:1096
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵PID:692
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"68⤵PID:652
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵PID:1780
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵PID:2800
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"69⤵PID:636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵PID:3640
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"70⤵PID:1912
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵PID:2152
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"71⤵PID:2968
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"72⤵PID:1692
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"73⤵PID:2764
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"74⤵PID:692
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵PID:1640
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"75⤵PID:3864
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"76⤵PID:3856
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"77⤵PID:2560
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"78⤵PID:2784
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵PID:1676
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"79⤵PID:2920
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵PID:1964
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"80⤵PID:352
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"81⤵PID:2976
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵PID:864
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"82⤵PID:3908
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵PID:1332
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"83⤵PID:1020
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"84⤵PID:3012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"85⤵PID:1680
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"86⤵PID:1172
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"87⤵PID:1268
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵PID:1288
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"88⤵PID:972
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵PID:3640
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵PID:3704
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵PID:2192
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"89⤵PID:3864
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵PID:292
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"90⤵PID:1912
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵PID:2220
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"91⤵PID:2084
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵PID:1360
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"92⤵PID:1516
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵PID:2788
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"93⤵PID:1504
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵PID:3160
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"94⤵PID:2572
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵PID:1960
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"95⤵PID:336
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵PID:3828
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵PID:3000
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"96⤵PID:2228
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵PID:3824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵PID:3688
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵PID:3612
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"97⤵PID:748
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵PID:3720
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"98⤵PID:3252
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵PID:2156
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵PID:3820
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"99⤵PID:496
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"100⤵PID:3292
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"101⤵PID:1332
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵PID:1876
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"102⤵PID:2140
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵PID:3628
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"103⤵PID:2100
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵PID:3612
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵PID:4064
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"104⤵PID:2784
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵PID:3736
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"105⤵PID:2960
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵PID:3488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵PID:1644
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"106⤵PID:672
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵PID:1896
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"107⤵PID:1708
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵PID:3860
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"108⤵PID:588
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵PID:2824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵PID:4008
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"109⤵PID:1104
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵PID:1524
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"110⤵PID:2852
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵PID:652
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"111⤵PID:1360
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"112⤵PID:964
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵PID:892
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"113⤵PID:4028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵PID:2960
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"114⤵PID:2536
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵PID:3852
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"115⤵PID:2824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵PID:3160
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵PID:1464
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"116⤵PID:3292
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵PID:588
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵PID:2268
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"117⤵PID:3004
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"118⤵PID:4064
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵PID:2212
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵PID:2396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵PID:976
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"119⤵PID:3488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵PID:3904
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"120⤵PID:3636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵PID:60
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵PID:2136
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵PID:2860
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"121⤵PID:2420
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"122⤵PID:3008
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵PID:1752
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵PID:1708
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"123⤵PID:2824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵PID:2968
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵PID:916
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"124⤵PID:504
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵PID:1512
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵PID:2852
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"125⤵PID:3004
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"126⤵PID:2564
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"126⤵PID:964
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵PID:1756
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"127⤵PID:640
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵PID:1516
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵PID:2976
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵PID:3484
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"128⤵PID:4028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵PID:2656
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"129⤵PID:1832
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"130⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"130⤵PID:1964
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵PID:2148
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵PID:1652
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"131⤵PID:1524
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵PID:796
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵PID:2396
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"132⤵PID:1104
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"133⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"133⤵PID:1788
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"134⤵PID:540
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵PID:3188
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"135⤵PID:3336
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵PID:640
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"136⤵PID:488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"137⤵PID:4068
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"138⤵PID:3864
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"138⤵PID:976
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵PID:3008
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"139⤵PID:508
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"140⤵PID:492
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"141⤵PID:1896
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"141⤵PID:3004
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"141⤵PID:1668
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"142⤵PID:1516
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"142⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"142⤵PID:2084
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"143⤵PID:980
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"143⤵PID:1680
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵PID:2320
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"144⤵PID:1268
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵PID:2652
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"145⤵PID:3380
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"146⤵PID:4068
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"146⤵PID:472
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"147⤵PID:2664
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"147⤵PID:1896
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵PID:3820
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵PID:508
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"148⤵PID:3880
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"149⤵PID:588
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"149⤵PID:912
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"149⤵PID:1360
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"150⤵PID:4028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"150⤵PID:1668
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"150⤵PID:3412
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"151⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"151⤵PID:1244
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"152⤵PID:1084
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"152⤵PID:60
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"153⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"153⤵PID:1944
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵PID:2224
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵PID:2824
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"154⤵PID:2208
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"155⤵PID:972
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"155⤵PID:504
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"155⤵PID:3004
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"156⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"156⤵PID:416
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵PID:3336
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"157⤵PID:1956
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵PID:3048
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"158⤵PID:2920
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵PID:1280
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵PID:1992
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵PID:580
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"159⤵PID:688
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵PID:2976
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"160⤵PID:636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"161⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"161⤵PID:3028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"162⤵PID:1944
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"162⤵PID:2784
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"163⤵PID:3920
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"163⤵PID:1896
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"164⤵PID:540
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"164⤵PID:2116
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"165⤵PID:752
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"165⤵PID:2852
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"166⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"166⤵PID:2084
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"167⤵PID:740
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"167⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"167⤵PID:3904
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"168⤵PID:4072
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"168⤵PID:3824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"169⤵PID:636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"169⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"169⤵PID:3000
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"170⤵PID:2576
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"170⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"170⤵PID:2904
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"171⤵PID:4008
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"171⤵PID:2140
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"171⤵PID:3260
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"172⤵PID:3108
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"172⤵PID:3048
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"172⤵PID:1280
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"173⤵PID:2664
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"173⤵PID:3564
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"173⤵PID:1828
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"174⤵PID:2668
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"174⤵PID:3836
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"175⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"175⤵PID:1360
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"176⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"176⤵PID:488
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵PID:416
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵PID:1508
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵PID:1004
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"177⤵PID:2580
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"178⤵PID:3380
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"178⤵PID:1168
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"179⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"179⤵PID:1652
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"180⤵PID:2428
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"180⤵PID:492
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"181⤵PID:2328
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"181⤵PID:1692
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"182⤵PID:1508
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"182⤵PID:776
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵PID:60
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"183⤵PID:3048
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"184⤵PID:4008
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"184⤵PID:2536
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"184⤵PID:3560
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"185⤵PID:3920
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵PID:3816
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"186⤵PID:1788
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"187⤵PID:860
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"187⤵PID:2664
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"188⤵PID:60
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"188⤵PID:3860
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵PID:1172
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵PID:2580
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"189⤵PID:2268
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"190⤵PID:488
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"190⤵PID:2208
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"191⤵PID:1992
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"191⤵PID:2420
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"191⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"191⤵PID:1508
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"192⤵PID:1896
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"192⤵PID:2176
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"192⤵PID:1424
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵PID:1676
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵PID:2560
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"193⤵PID:2536
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵PID:3760
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"194⤵PID:3252
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"195⤵PID:3608
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"195⤵PID:2132
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"196⤵PID:1992
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"196⤵PID:3484
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"197⤵PID:972
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"197⤵PID:3824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"198⤵PID:1408
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"198⤵PID:3012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵PID:2652
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵PID:812
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵PID:616
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"199⤵PID:4028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"200⤵PID:2904
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"200⤵PID:892
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵PID:3784
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"201⤵PID:3564
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵PID:2096
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"202⤵PID:1280
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"203⤵PID:2008
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"203⤵PID:1408
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵PID:2208
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"204⤵PID:2396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"205⤵PID:2980
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"205⤵PID:1252
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"205⤵PID:1004
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"206⤵PID:3428
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"206⤵PID:2220
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"207⤵PID:2968
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"207⤵PID:3160
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵PID:3340
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵PID:588
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"208⤵PID:2368
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"209⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"209⤵PID:3604
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"210⤵PID:3716
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"210⤵PID:1408
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"211⤵PID:2168
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"211⤵PID:3860
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"211⤵PID:3260
-
C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"211⤵PID:3396
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"212⤵PID:1464