680cb634fa1fcc47a2760a86939423413d46aeb170b703732db614c2e96260d1

Analysis

max time kernel
72s
max time network
137s
platform
windows10_x64
resource
win10
submitted
08-07-2020 10:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bank Swift.exe
Size

358KB
MD5

f55aff3fd76077b94b58fd946b837a3b
SHA1

719e40e3cb661e26d269a34546456bea3a2eda10
SHA256

680cb634fa1fcc47a2760a86939423413d46aeb170b703732db614c2e96260d1
SHA512

e392df15533ce7008ad5239c44e15761fc3841bb694c4f9b9b931dc69c6049b6c53135feff9853c8591dbdcd48fe30d8c59db5b4fecfea8753077c82c5c6cdc8

Score

7^/10

Malware Config

Signatures

Drops startup file 2 IoCs

Processes:

Bank Swift.exeBank Swift.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe	Bank Swift.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe	Bank Swift.exe

Suspicious use of WriteProcessMemory 1726 IoCs

Processes:

Bank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exe

description	pid	process	target process
PID 3608 wrote to memory of 3736	3608	Bank Swift.exe	RegAsm.exe
PID 3608 wrote to memory of 3736	3608	Bank Swift.exe	RegAsm.exe
PID 3608 wrote to memory of 3736	3608	Bank Swift.exe	RegAsm.exe
PID 3608 wrote to memory of 2212	3608	Bank Swift.exe	RegAsm.exe
PID 3608 wrote to memory of 2212	3608	Bank Swift.exe	RegAsm.exe
PID 3608 wrote to memory of 2212	3608	Bank Swift.exe	RegAsm.exe
PID 3608 wrote to memory of 2212	3608	Bank Swift.exe	RegAsm.exe
PID 3608 wrote to memory of 3852	3608	Bank Swift.exe	Bank Swift.exe
PID 3608 wrote to memory of 3852	3608	Bank Swift.exe	Bank Swift.exe
PID 3608 wrote to memory of 3852	3608	Bank Swift.exe	Bank Swift.exe
PID 3852 wrote to memory of 3188	3852	Bank Swift.exe	RegAsm.exe
PID 3852 wrote to memory of 3188	3852	Bank Swift.exe	RegAsm.exe
PID 3852 wrote to memory of 3188	3852	Bank Swift.exe	RegAsm.exe
PID 3852 wrote to memory of 3188	3852	Bank Swift.exe	RegAsm.exe
PID 3852 wrote to memory of 2980	3852	Bank Swift.exe	Bank Swift.exe
PID 3852 wrote to memory of 2980	3852	Bank Swift.exe	Bank Swift.exe
PID 3852 wrote to memory of 2980	3852	Bank Swift.exe	Bank Swift.exe
PID 2980 wrote to memory of 2904	2980	Bank Swift.exe	RegAsm.exe
PID 2980 wrote to memory of 2904	2980	Bank Swift.exe	RegAsm.exe
PID 2980 wrote to memory of 2904	2980	Bank Swift.exe	RegAsm.exe
PID 2980 wrote to memory of 2976	2980	Bank Swift.exe	RegAsm.exe
PID 2980 wrote to memory of 2976	2980	Bank Swift.exe	RegAsm.exe
PID 2980 wrote to memory of 2976	2980	Bank Swift.exe	RegAsm.exe
PID 2980 wrote to memory of 2976	2980	Bank Swift.exe	RegAsm.exe
PID 2980 wrote to memory of 748	2980	Bank Swift.exe	Bank Swift.exe
PID 2980 wrote to memory of 748	2980	Bank Swift.exe	Bank Swift.exe
PID 2980 wrote to memory of 748	2980	Bank Swift.exe	Bank Swift.exe
PID 748 wrote to memory of 3696	748	Bank Swift.exe	RegAsm.exe
PID 748 wrote to memory of 3696	748	Bank Swift.exe	RegAsm.exe
PID 748 wrote to memory of 3696	748	Bank Swift.exe	RegAsm.exe
PID 748 wrote to memory of 3696	748	Bank Swift.exe	RegAsm.exe
PID 748 wrote to memory of 616	748	Bank Swift.exe	Bank Swift.exe
PID 748 wrote to memory of 616	748	Bank Swift.exe	Bank Swift.exe
PID 748 wrote to memory of 616	748	Bank Swift.exe	Bank Swift.exe
PID 616 wrote to memory of 1104	616	Bank Swift.exe	RegAsm.exe
PID 616 wrote to memory of 1104	616	Bank Swift.exe	RegAsm.exe
PID 616 wrote to memory of 1104	616	Bank Swift.exe	RegAsm.exe
PID 616 wrote to memory of 1104	616	Bank Swift.exe	RegAsm.exe
PID 616 wrote to memory of 1640	616	Bank Swift.exe	Bank Swift.exe
PID 616 wrote to memory of 1640	616	Bank Swift.exe	Bank Swift.exe
PID 616 wrote to memory of 1640	616	Bank Swift.exe	Bank Swift.exe
PID 1640 wrote to memory of 1896	1640	Bank Swift.exe	RegAsm.exe
PID 1640 wrote to memory of 1896	1640	Bank Swift.exe	RegAsm.exe
PID 1640 wrote to memory of 1896	1640	Bank Swift.exe	RegAsm.exe
PID 1640 wrote to memory of 1876	1640	Bank Swift.exe	RegAsm.exe
PID 1640 wrote to memory of 1876	1640	Bank Swift.exe	RegAsm.exe
PID 1640 wrote to memory of 1876	1640	Bank Swift.exe	RegAsm.exe
PID 1640 wrote to memory of 1876	1640	Bank Swift.exe	RegAsm.exe
PID 1640 wrote to memory of 3816	1640	Bank Swift.exe	Bank Swift.exe
PID 1640 wrote to memory of 3816	1640	Bank Swift.exe	Bank Swift.exe
PID 1640 wrote to memory of 3816	1640	Bank Swift.exe	Bank Swift.exe
PID 3816 wrote to memory of 3008	3816	Bank Swift.exe	RegAsm.exe
PID 3816 wrote to memory of 3008	3816	Bank Swift.exe	RegAsm.exe
PID 3816 wrote to memory of 3008	3816	Bank Swift.exe	RegAsm.exe
PID 3816 wrote to memory of 3012	3816	Bank Swift.exe	RegAsm.exe
PID 3816 wrote to memory of 3012	3816	Bank Swift.exe	RegAsm.exe
PID 3816 wrote to memory of 3012	3816	Bank Swift.exe	RegAsm.exe
PID 3816 wrote to memory of 2852	3816	Bank Swift.exe	RegAsm.exe
PID 3816 wrote to memory of 2852	3816	Bank Swift.exe	RegAsm.exe
PID 3816 wrote to memory of 2852	3816	Bank Swift.exe	RegAsm.exe
PID 3816 wrote to memory of 2852	3816	Bank Swift.exe	RegAsm.exe
PID 3816 wrote to memory of 1004	3816	Bank Swift.exe	Bank Swift.exe
PID 3816 wrote to memory of 1004	3816	Bank Swift.exe	Bank Swift.exe
PID 3816 wrote to memory of 1004	3816	Bank Swift.exe	Bank Swift.exe

Suspicious behavior: MapViewOfSection 295 IoCs

Processes:

Bank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exeBank Swift.exe

pid	process
3608	Bank Swift.exe
3608	Bank Swift.exe
3852	Bank Swift.exe
2980	Bank Swift.exe
2980	Bank Swift.exe
748	Bank Swift.exe
616	Bank Swift.exe
1640	Bank Swift.exe
1640	Bank Swift.exe
3816	Bank Swift.exe
3816	Bank Swift.exe
3816	Bank Swift.exe
1004	Bank Swift.exe
1004	Bank Swift.exe
2564	Bank Swift.exe
364	Bank Swift.exe
1272	Bank Swift.exe
1272	Bank Swift.exe
1096	Bank Swift.exe
1668	Bank Swift.exe
3852	Bank Swift.exe
652	Bank Swift.exe
3696	Bank Swift.exe
1644	Bank Swift.exe
3712	Bank Swift.exe
3712	Bank Swift.exe
2152	Bank Swift.exe
3352	Bank Swift.exe
744	Bank Swift.exe
3852	Bank Swift.exe
796	Bank Swift.exe
1876	Bank Swift.exe
1876	Bank Swift.exe
1876	Bank Swift.exe
1332	Bank Swift.exe
3628	Bank Swift.exe
588	Bank Swift.exe
588	Bank Swift.exe
588	Bank Swift.exe
1960	Bank Swift.exe
3896	Bank Swift.exe
3868	Bank Swift.exe
3868	Bank Swift.exe
3868	Bank Swift.exe
2220	Bank Swift.exe
1168	Bank Swift.exe
540	Bank Swift.exe
1252	Bank Swift.exe
796	Bank Swift.exe
796	Bank Swift.exe
1524	Bank Swift.exe
336	Bank Swift.exe
1508	Bank Swift.exe
3000	Bank Swift.exe
3000	Bank Swift.exe
3000	Bank Swift.exe
2564	Bank Swift.exe
4068	Bank Swift.exe
1640	Bank Swift.exe
1752	Bank Swift.exe
3908	Bank Swift.exe
2172	Bank Swift.exe
2968	Bank Swift.exe
2764	Bank Swift.exe

Suspicious use of SetThreadContext 211 IoCs

Processes:

description	pid	process	target process
PID 3608 set thread context of 2212	3608	Bank Swift.exe	RegAsm.exe
PID 3852 set thread context of 3188	3852	Bank Swift.exe	RegAsm.exe
PID 2980 set thread context of 2976	2980	Bank Swift.exe	RegAsm.exe
PID 748 set thread context of 3696	748	Bank Swift.exe	RegAsm.exe
PID 616 set thread context of 1104	616	Bank Swift.exe	RegAsm.exe
PID 1640 set thread context of 1876	1640	Bank Swift.exe	RegAsm.exe
PID 3816 set thread context of 2852	3816	Bank Swift.exe	RegAsm.exe
PID 1004 set thread context of 2656	1004	Bank Swift.exe	RegAsm.exe
PID 2564 set thread context of 1960	2564	Bank Swift.exe	RegAsm.exe
PID 364 set thread context of 740	364	Bank Swift.exe	RegAsm.exe
PID 1272 set thread context of 3708	1272	Bank Swift.exe	RegAsm.exe
PID 1096 set thread context of 2148	1096	Bank Swift.exe	RegAsm.exe
PID 1668 set thread context of 3352	1668	Bank Swift.exe	RegAsm.exe
PID 3852 set thread context of 2328	3852	Bank Swift.exe	RegAsm.exe
PID 652 set thread context of 2864	652	Bank Swift.exe	RegAsm.exe
PID 3696 set thread context of 1752	3696	Bank Swift.exe	RegAsm.exe
PID 1644 set thread context of 1956	1644	Bank Swift.exe	RegAsm.exe
PID 3712 set thread context of 2420	3712	Bank Swift.exe	RegAsm.exe
PID 2152 set thread context of 2576	2152	Bank Swift.exe	RegAsm.exe
PID 3352 set thread context of 1832	3352	Bank Swift.exe	RegAsm.exe
PID 744 set thread context of 2572	744	Bank Swift.exe	RegAsm.exe
PID 3852 set thread context of 2860	3852	Bank Swift.exe	RegAsm.exe
PID 796 set thread context of 3908	796	Bank Swift.exe	RegAsm.exe
PID 1876 set thread context of 472	1876	Bank Swift.exe	RegAsm.exe
PID 1332 set thread context of 1652	1332	Bank Swift.exe	RegAsm.exe
PID 3628 set thread context of 3880	3628	Bank Swift.exe	RegAsm.exe
PID 588 set thread context of 3716	588	Bank Swift.exe	RegAsm.exe
PID 1960 set thread context of 744	1960	Bank Swift.exe	RegAsm.exe
PID 3896 set thread context of 2980	3896	Bank Swift.exe	RegAsm.exe
PID 3868 set thread context of 3640	3868	Bank Swift.exe	RegAsm.exe
PID 2220 set thread context of 2420	2220	Bank Swift.exe	RegAsm.exe
PID 1168 set thread context of 3000	1168	Bank Swift.exe	RegAsm.exe
PID 540 set thread context of 1692	540	Bank Swift.exe	RegAsm.exe
PID 1252 set thread context of 2920	1252	Bank Swift.exe	RegAsm.exe
PID 796 set thread context of 688	796	Bank Swift.exe	RegAsm.exe
PID 1524 set thread context of 1752	1524	Bank Swift.exe	RegAsm.exe
PID 336 set thread context of 3384	336	Bank Swift.exe	RegAsm.exe
PID 1508 set thread context of 1828	1508	Bank Swift.exe	RegAsm.exe
PID 3000 set thread context of 2968	3000	Bank Swift.exe	RegAsm.exe
PID 2564 set thread context of 2920	2564	Bank Swift.exe	RegAsm.exe
PID 4068 set thread context of 1336	4068	Bank Swift.exe	RegAsm.exe
PID 1640 set thread context of 1708	1640	Bank Swift.exe	RegAsm.exe
PID 1752 set thread context of 1464	1752	Bank Swift.exe	RegAsm.exe
PID 3908 set thread context of 2576	3908	Bank Swift.exe	RegAsm.exe
PID 2172 set thread context of 1648	2172	Bank Swift.exe	RegAsm.exe
PID 2968 set thread context of 1892	2968	Bank Swift.exe	RegAsm.exe
PID 2764 set thread context of 3764	2764	Bank Swift.exe	RegAsm.exe
PID 3724 set thread context of 2116	3724	Bank Swift.exe	RegAsm.exe
PID 3712 set thread context of 508	3712	Bank Swift.exe	RegAsm.exe
PID 2220 set thread context of 1912	2220	Bank Swift.exe	RegAsm.exe
PID 3856 set thread context of 3864	3856	Bank Swift.exe	RegAsm.exe
PID 1000 set thread context of 2324	1000	Bank Swift.exe	RegAsm.exe
PID 2168 set thread context of 812	2168	Bank Swift.exe	RegAsm.exe
PID 3764 set thread context of 2652	3764	Bank Swift.exe	RegAsm.exe
PID 744 set thread context of 1828	744	Bank Swift.exe	RegAsm.exe
PID 4068 set thread context of 964	4068	Bank Swift.exe	RegAsm.exe
PID 3920 set thread context of 2228	3920	Bank Swift.exe	RegAsm.exe
PID 2664 set thread context of 3948	2664	Bank Swift.exe	RegAsm.exe
PID 2960 set thread context of 1264	2960	Bank Swift.exe	RegAsm.exe
PID 364 set thread context of 1504	364	Bank Swift.exe	RegAsm.exe
PID 1992 set thread context of 496	1992	Bank Swift.exe	RegAsm.exe
PID 2576 set thread context of 408	2576	Bank Swift.exe	RegAsm.exe
PID 776 set thread context of 1912	776	Bank Swift.exe	RegAsm.exe
PID 1000 set thread context of 2172	1000	Bank Swift.exe	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 422 IoCs

Processes:

Bank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exeBank Swift.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	3608	Bank Swift.exe
Token: SeDebugPrivilege	2212	RegAsm.exe
Token: SeDebugPrivilege	3852	Bank Swift.exe
Token: SeDebugPrivilege	3188	RegAsm.exe
Token: SeDebugPrivilege	2980	Bank Swift.exe
Token: SeDebugPrivilege	2976	RegAsm.exe
Token: SeDebugPrivilege	748	Bank Swift.exe
Token: SeDebugPrivilege	3696	RegAsm.exe
Token: SeDebugPrivilege	616	Bank Swift.exe
Token: SeDebugPrivilege	1104	RegAsm.exe
Token: SeDebugPrivilege	1640	Bank Swift.exe
Token: SeDebugPrivilege	1876	RegAsm.exe
Token: SeDebugPrivilege	3816	Bank Swift.exe
Token: SeDebugPrivilege	2852	RegAsm.exe
Token: SeDebugPrivilege	1004	Bank Swift.exe
Token: SeDebugPrivilege	2656	RegAsm.exe
Token: SeDebugPrivilege	2564	Bank Swift.exe
Token: SeDebugPrivilege	1960	RegAsm.exe
Token: SeDebugPrivilege	364	Bank Swift.exe
Token: SeDebugPrivilege	740	RegAsm.exe
Token: SeDebugPrivilege	1272	Bank Swift.exe
Token: SeDebugPrivilege	3708	RegAsm.exe
Token: SeDebugPrivilege	1096	Bank Swift.exe
Token: SeDebugPrivilege	2148	RegAsm.exe
Token: SeDebugPrivilege	1668	Bank Swift.exe
Token: SeDebugPrivilege	3352	RegAsm.exe
Token: SeDebugPrivilege	3852	Bank Swift.exe
Token: SeDebugPrivilege	2328	RegAsm.exe
Token: SeDebugPrivilege	652	Bank Swift.exe
Token: SeDebugPrivilege	2864	RegAsm.exe
Token: SeDebugPrivilege	3696	Bank Swift.exe
Token: SeDebugPrivilege	1752	RegAsm.exe
Token: SeDebugPrivilege	1644	Bank Swift.exe
Token: SeDebugPrivilege	1956	RegAsm.exe
Token: SeDebugPrivilege	3712	Bank Swift.exe
Token: SeDebugPrivilege	2420	RegAsm.exe
Token: SeDebugPrivilege	2152	Bank Swift.exe
Token: SeDebugPrivilege	2576	RegAsm.exe
Token: SeDebugPrivilege	3352	Bank Swift.exe
Token: SeDebugPrivilege	1832	RegAsm.exe
Token: SeDebugPrivilege	744	Bank Swift.exe
Token: SeDebugPrivilege	2572	RegAsm.exe
Token: SeDebugPrivilege	3852	Bank Swift.exe
Token: SeDebugPrivilege	2860	RegAsm.exe
Token: SeDebugPrivilege	796	Bank Swift.exe
Token: SeDebugPrivilege	3908	RegAsm.exe
Token: SeDebugPrivilege	1876	Bank Swift.exe
Token: SeDebugPrivilege	472	RegAsm.exe
Token: SeDebugPrivilege	1332	Bank Swift.exe
Token: SeDebugPrivilege	1652	RegAsm.exe
Token: SeDebugPrivilege	3628	Bank Swift.exe
Token: SeDebugPrivilege	3880	RegAsm.exe
Token: SeDebugPrivilege	588	Bank Swift.exe
Token: SeDebugPrivilege	3716	RegAsm.exe
Token: SeDebugPrivilege	1960	Bank Swift.exe
Token: SeDebugPrivilege	744	RegAsm.exe
Token: SeDebugPrivilege	3896	Bank Swift.exe
Token: SeDebugPrivilege	2980	RegAsm.exe
Token: SeDebugPrivilege	3868	Bank Swift.exe
Token: SeDebugPrivilege	3640	RegAsm.exe
Token: SeDebugPrivilege	2220	Bank Swift.exe
Token: SeDebugPrivilege	2420	RegAsm.exe
Token: SeDebugPrivilege	1168	Bank Swift.exe
Token: SeDebugPrivilege	3000	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 51274 IoCs

Processes:

Bank Swift.exe

pid	process
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe
3608	Bank Swift.exe

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:3608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:3736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3188

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:2904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:2976

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
5⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:616

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
6⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
7⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
8⤵
PID:3008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
8⤵
PID:3012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
9⤵
PID:2664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
9⤵
- Suspicious use of AdjustPrivilegeToken
PID:2656

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
10⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
- Suspicious use of AdjustPrivilegeToken
PID:740

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
PID:692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
- Suspicious use of AdjustPrivilegeToken
PID:3708

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
13⤵
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
14⤵
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
15⤵
- Suspicious use of AdjustPrivilegeToken
PID:2328

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
16⤵
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
17⤵
- Suspicious use of AdjustPrivilegeToken
PID:1752

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
18⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
18⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3712

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
19⤵
PID:1104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
19⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
19⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
20⤵
- Suspicious use of AdjustPrivilegeToken
PID:2576

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
20⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
21⤵
- Suspicious use of AdjustPrivilegeToken
PID:1832

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
21⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
22⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
22⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
23⤵
- Suspicious use of AdjustPrivilegeToken
PID:2860

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
23⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
24⤵
- Suspicious use of AdjustPrivilegeToken
PID:3908

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
24⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
PID:496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
PID:408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
- Suspicious use of AdjustPrivilegeToken
PID:472

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
25⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
26⤵
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
26⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
27⤵
- Suspicious use of AdjustPrivilegeToken
PID:3880

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
27⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
28⤵
PID:3336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
28⤵
PID:2428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
28⤵
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
28⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
29⤵
- Suspicious use of AdjustPrivilegeToken
PID:744

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
29⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
30⤵
- Suspicious use of AdjustPrivilegeToken
PID:2980

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
30⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
31⤵
PID:3820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
31⤵
PID:1524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
31⤵
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
31⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
32⤵
- Suspicious use of AdjustPrivilegeToken
PID:2420

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
32⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
33⤵
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
33⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
34⤵
PID:1692

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
34⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
35⤵
PID:2920

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
35⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
36⤵
PID:364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
36⤵
PID:688

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
36⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
37⤵
PID:1752

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
37⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
38⤵
PID:3384

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
38⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
39⤵
PID:1828

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
39⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
40⤵
PID:2864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
40⤵
PID:3824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
40⤵
PID:2968

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
40⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:2920

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
41⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:4068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
42⤵
PID:1336

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
42⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
43⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
43⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:1752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
44⤵
PID:1464

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
44⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:3908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
45⤵
PID:2576

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
45⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
46⤵
PID:1648

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
46⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
47⤵
PID:1892

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
47⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:2764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
48⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
48⤵
- Suspicious use of SetThreadContext
PID:3724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
49⤵
PID:2116

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
49⤵
- Suspicious use of SetThreadContext
PID:3712

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
50⤵
PID:508

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
50⤵
- Suspicious use of SetThreadContext
PID:2220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
51⤵
PID:1912

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
51⤵
- Suspicious use of SetThreadContext
PID:3856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:3864

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
52⤵
- Suspicious use of SetThreadContext
PID:1000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
53⤵
PID:2664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
53⤵
PID:2324

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
53⤵
- Suspicious use of SetThreadContext
PID:2168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
54⤵
PID:812

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
54⤵
- Suspicious use of SetThreadContext
PID:3764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
55⤵
PID:1964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
55⤵
PID:1960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
55⤵
PID:3104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
55⤵
PID:2652

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
55⤵
- Suspicious use of SetThreadContext
PID:744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
56⤵
PID:1828

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
56⤵
- Suspicious use of SetThreadContext
PID:4068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
57⤵
PID:3712

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
57⤵
PID:964

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
57⤵
- Suspicious use of SetThreadContext
PID:3920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
58⤵
PID:2228

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
58⤵
- Suspicious use of SetThreadContext
PID:2664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
59⤵
PID:3948

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
59⤵
- Suspicious use of SetThreadContext
PID:2960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
60⤵
PID:1264

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
60⤵
- Suspicious use of SetThreadContext
PID:364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
61⤵
PID:1504

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
61⤵
- Suspicious use of SetThreadContext
PID:1992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
62⤵
PID:2536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
62⤵
PID:496

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
62⤵
- Suspicious use of SetThreadContext
PID:2576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
63⤵
PID:408

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
63⤵
- Suspicious use of SetThreadContext
PID:776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
64⤵
PID:1912

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
64⤵
- Suspicious use of SetThreadContext
PID:1000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
65⤵
PID:2172

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
65⤵
PID:3736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
66⤵
PID:1692

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
66⤵
PID:3340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
67⤵
PID:3708

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
67⤵
PID:1272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
68⤵
PID:1096

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
68⤵
PID:692

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
68⤵
PID:652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
69⤵
PID:1780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
69⤵
PID:2800

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
69⤵
PID:636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
70⤵
PID:3640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
70⤵
PID:2824

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
70⤵
PID:1912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
71⤵
PID:2152

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
71⤵
PID:2968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
72⤵
PID:3824

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
72⤵
PID:1692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
73⤵
PID:4064

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
73⤵
PID:2764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
74⤵
PID:3188

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
74⤵
PID:692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
75⤵
PID:1640

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
75⤵
PID:3864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
76⤵
PID:1288

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
76⤵
PID:3856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
77⤵
PID:1944

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
77⤵
PID:2560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
78⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
78⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
79⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
79⤵
PID:2920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
80⤵
PID:1964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
80⤵
PID:3860

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
80⤵
PID:352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
81⤵
PID:580

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
81⤵
PID:2976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
82⤵
PID:864

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
82⤵
PID:3908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
83⤵
PID:1332

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
83⤵
PID:1020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
84⤵
PID:3628

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
84⤵
PID:3012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
85⤵
PID:2904

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
85⤵
PID:1680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
86⤵
PID:1788

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
86⤵
PID:1172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
87⤵
PID:1464

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
87⤵
PID:1268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
88⤵
PID:1288

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
88⤵
PID:972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
89⤵
PID:3640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
89⤵
PID:3704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
89⤵
PID:2192

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
89⤵
PID:3864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
90⤵
PID:292

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
90⤵
PID:1912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
91⤵
PID:2220

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
91⤵
PID:2084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
92⤵
PID:1360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
92⤵
PID:1004

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
92⤵
PID:1516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
93⤵
PID:2788

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
93⤵
PID:1504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
94⤵
PID:3160

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
94⤵
PID:2572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
95⤵
PID:1960

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
95⤵
PID:336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
96⤵
PID:3828

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
96⤵
PID:3000

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
96⤵
PID:2228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
97⤵
PID:3824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
97⤵
PID:3688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
97⤵
PID:3612

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
97⤵
PID:748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
98⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
98⤵
PID:3252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
99⤵
PID:2156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
99⤵
PID:3820

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
99⤵
PID:496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
100⤵
PID:1896

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
100⤵
PID:3292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
101⤵
PID:1992

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
101⤵
PID:1332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
102⤵
PID:1876

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
102⤵
PID:2140

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
103⤵
PID:3628

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
103⤵
PID:2100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
104⤵
PID:3612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
104⤵
PID:4064

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
104⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
105⤵
PID:3736

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
105⤵
PID:2960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
106⤵
PID:3488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
106⤵
PID:1644

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
106⤵
PID:672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
107⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
107⤵
PID:912

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
107⤵
PID:1708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
108⤵
PID:3860

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
108⤵
PID:588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
109⤵
PID:2824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
109⤵
PID:4008

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
109⤵
PID:1104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
110⤵
PID:1524

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
110⤵
PID:2852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
111⤵
PID:652

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
111⤵
PID:1360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
112⤵
PID:1668

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
112⤵
PID:964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
113⤵
PID:892

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
113⤵
PID:4028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
114⤵
PID:2960

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
114⤵
PID:2536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
115⤵
PID:3852

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
115⤵
PID:2824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
116⤵
PID:3160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
116⤵
PID:1464

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
116⤵
PID:3292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
117⤵
PID:588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
117⤵
PID:2268

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
117⤵
PID:3004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
118⤵
PID:860

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
118⤵
PID:4064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
119⤵
PID:2212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
119⤵
PID:2396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
119⤵
PID:976

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
119⤵
PID:3488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
120⤵
PID:3904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
120⤵
PID:1896

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
120⤵
PID:3636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
121⤵
PID:60

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
121⤵
PID:2136

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
121⤵
PID:2860

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
121⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
122⤵
PID:3428

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
122⤵
PID:3008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
123⤵
PID:1752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
123⤵
PID:1708

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
123⤵
PID:2824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
124⤵
PID:2968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
124⤵
PID:916

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
124⤵
PID:504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
125⤵
PID:1512

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
125⤵
PID:2852

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
125⤵
PID:3004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
126⤵
PID:2564

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
126⤵
PID:964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
127⤵
PID:1756

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
127⤵
PID:640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
128⤵
PID:1516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
128⤵
PID:2976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
128⤵
PID:3484

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
128⤵
PID:4028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
129⤵
PID:2656

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
129⤵
PID:1832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
130⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
130⤵
PID:1964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
131⤵
PID:2148

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
131⤵
PID:1652

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
131⤵
PID:1524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
132⤵
PID:796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
132⤵
PID:2396

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
132⤵
PID:1104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
133⤵
PID:616

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
133⤵
PID:1788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
134⤵
PID:3004

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
134⤵
PID:540

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
135⤵
PID:3188

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
135⤵
PID:3336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
136⤵
PID:640

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
136⤵
PID:488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
137⤵
PID:1244

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
137⤵
PID:4068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
138⤵
PID:3864

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
138⤵
PID:976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
139⤵
PID:3008

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
139⤵
PID:508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
140⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
140⤵
PID:492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
141⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
141⤵
PID:3004

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
141⤵
PID:1668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
142⤵
PID:1516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
142⤵
PID:1788

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
142⤵
PID:2084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
143⤵
PID:980

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
143⤵
PID:1680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
144⤵
PID:2320

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
144⤵
PID:1268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
145⤵
PID:2652

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
145⤵
PID:3380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
146⤵
PID:4068

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
146⤵
PID:472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
147⤵
PID:2664

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
147⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
148⤵
PID:3820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
148⤵
PID:508

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
148⤵
PID:3880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
149⤵
PID:588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
149⤵
PID:912

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
149⤵
PID:1360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
150⤵
PID:4028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
150⤵
PID:1668

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
150⤵
PID:3412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
151⤵
PID:2968

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
151⤵
PID:1244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
152⤵
PID:1084

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
152⤵
PID:60

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
153⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
153⤵
PID:1944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
154⤵
PID:2224

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
154⤵
PID:2824

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
154⤵
PID:2208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
155⤵
PID:972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
155⤵
PID:504

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
155⤵
PID:3004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
156⤵
PID:2576

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
156⤵
PID:416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
157⤵
PID:3336

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
157⤵
PID:1956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
158⤵
PID:3048

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
158⤵
PID:3260

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
158⤵
PID:2920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
159⤵
PID:1280

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
159⤵
PID:1992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
159⤵
PID:580

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
159⤵
PID:688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
160⤵
PID:2976

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
160⤵
PID:636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
161⤵
PID:1516

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
161⤵
PID:3028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
162⤵
PID:1944

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
162⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
163⤵
PID:3920

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
163⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
164⤵
PID:540

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
164⤵
PID:2116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
165⤵
PID:752

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
165⤵
PID:2852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
166⤵
PID:2968

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
166⤵
PID:2084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
167⤵
PID:740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
167⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
167⤵
PID:3904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
168⤵
PID:4072

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
168⤵
PID:3824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
169⤵
PID:636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
169⤵
PID:1912

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
169⤵
PID:3000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
170⤵
PID:2576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
170⤵
PID:3144

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
170⤵
PID:2904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
171⤵
PID:4008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
171⤵
PID:2140

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
171⤵
PID:3260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:3108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:3048

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
172⤵
PID:1280

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
173⤵
PID:2664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
173⤵
PID:3564

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
173⤵
PID:1828

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
174⤵
PID:2668

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
174⤵
PID:3836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
175⤵
PID:2576

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
175⤵
PID:1360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
176⤵
PID:1788

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
176⤵
PID:488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
177⤵
PID:416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
177⤵
PID:1508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
177⤵
PID:1004

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
177⤵
PID:2580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
178⤵
PID:3380

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
178⤵
PID:1168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
179⤵
PID:2764

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
179⤵
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
180⤵
PID:2428

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
180⤵
PID:492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
181⤵
PID:2328

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
181⤵
PID:1692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
182⤵
PID:1508

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
182⤵
PID:776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
183⤵
PID:60

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
183⤵
PID:3900

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
183⤵
PID:3048

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
184⤵
PID:4008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
184⤵
PID:2536

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
184⤵
PID:3560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
185⤵
PID:3868

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
185⤵
PID:3920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
186⤵
PID:3816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
186⤵
PID:3824

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
186⤵
PID:1788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
187⤵
PID:860

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
187⤵
PID:2664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
188⤵
PID:60

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
188⤵
PID:3860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
189⤵
PID:1172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
189⤵
PID:2580

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
189⤵
PID:2268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
190⤵
PID:488

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
190⤵
PID:2208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
191⤵
PID:1992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
191⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
191⤵
PID:972

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
191⤵
PID:1508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
192⤵
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
192⤵
PID:2176

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
192⤵
PID:1424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
193⤵
PID:1676

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
193⤵
PID:2560

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
193⤵
PID:2536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
194⤵
PID:3760

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
194⤵
PID:3252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
195⤵
PID:3608

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
195⤵
PID:2132

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
196⤵
PID:1992

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
196⤵
PID:3484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
197⤵
PID:972

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
197⤵
PID:3824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
198⤵
PID:1408

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
198⤵
PID:3012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:2652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:616

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
199⤵
PID:4028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
200⤵
PID:2904

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
200⤵
PID:892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
201⤵
PID:3784

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
201⤵
PID:3564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
202⤵
PID:2096

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
202⤵
PID:1280

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
203⤵
PID:2008

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
203⤵
PID:1408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
204⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
204⤵
PID:2396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
205⤵
PID:2980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
205⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
205⤵
PID:1004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
206⤵
PID:3428

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
206⤵
PID:2220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
207⤵
PID:2968

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
207⤵
PID:3160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
208⤵
PID:3340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
208⤵
PID:588

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
208⤵
PID:2368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
209⤵
PID:2388

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
209⤵
PID:3604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
210⤵
PID:3716

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
210⤵
PID:1408

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
211⤵
PID:2168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
211⤵
PID:3860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
211⤵
PID:3260

C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Swift.exe"
211⤵
PID:3396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
212⤵
PID:1464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe

Download Submit
memory/60-453-0x0000000000000000-mapping.dmp

Download
memory/60-560-0x000000000044B5BE-mapping.dmp

Download
memory/292-266-0x000000000044B5BE-mapping.dmp

Download
memory/336-108-0x0000000000000000-mapping.dmp

Download
memory/336-282-0x0000000000000000-mapping.dmp

Download
memory/352-237-0x0000000000000000-mapping.dmp

Download
memory/364-177-0x0000000000000000-mapping.dmp

Download
memory/364-27-0x0000000000000000-mapping.dmp

Download
memory/408-185-0x000000000044B5BE-mapping.dmp

Download
memory/416-465-0x0000000000000000-mapping.dmp

Download
memory/472-435-0x0000000000000000-mapping.dmp

Download
memory/472-71-0x000000000044B5BE-mapping.dmp

Download
memory/488-525-0x0000000000000000-mapping.dmp

Download
memory/488-566-0x000000000044B5BE-mapping.dmp

Download
memory/488-405-0x0000000000000000-mapping.dmp

Download
memory/492-537-0x0000000000000000-mapping.dmp

Download
memory/492-417-0x0000000000000000-mapping.dmp

Download
memory/496-182-0x000000000044B5BE-mapping.dmp

Download
memory/496-294-0x0000000000000000-mapping.dmp

Download
memory/504-369-0x0000000000000000-mapping.dmp

Download
memory/504-461-0x000000000044B5BE-mapping.dmp

Download
memory/508-146-0x000000000044B5BE-mapping.dmp

Download
memory/508-414-0x0000000000000000-mapping.dmp

Download
memory/508-440-0x000000000044B5BE-mapping.dmp

Download
memory/540-488-0x000000000044B5BE-mapping.dmp

Download
memory/540-96-0x0000000000000000-mapping.dmp

Download
memory/540-399-0x0000000000000000-mapping.dmp

Download
memory/580-239-0x000000000044B5BE-mapping.dmp

Download
memory/580-473-0x000000000044B5BE-mapping.dmp

Download
memory/588-321-0x0000000000000000-mapping.dmp

Download
memory/588-78-0x0000000000000000-mapping.dmp

Download
memory/588-620-0x000000000044B5BE-mapping.dmp

Download
memory/616-395-0x000000000044B5BE-mapping.dmp

Download
memory/616-12-0x0000000000000000-mapping.dmp

Download
memory/616-593-0x000000000044B5BE-mapping.dmp

Download
memory/636-477-0x0000000000000000-mapping.dmp

Download
memory/636-204-0x0000000000000000-mapping.dmp

Download
memory/640-378-0x0000000000000000-mapping.dmp

Download
memory/640-404-0x000000000044B5BE-mapping.dmp

Download
memory/652-329-0x000000000044B5BE-mapping.dmp

Download
memory/652-42-0x0000000000000000-mapping.dmp

Download
memory/652-201-0x0000000000000000-mapping.dmp

Download
memory/672-315-0x0000000000000000-mapping.dmp

Download
memory/688-104-0x000000000044B5BE-mapping.dmp

Download
memory/688-474-0x0000000000000000-mapping.dmp

Download
memory/692-200-0x000000000044B5BE-mapping.dmp

Download
memory/692-219-0x0000000000000000-mapping.dmp

Download
memory/740-29-0x000000000044B5BE-mapping.dmp

Download
memory/744-162-0x0000000000000000-mapping.dmp

Download
memory/744-83-0x000000000044B5BE-mapping.dmp

Download
memory/744-60-0x0000000000000000-mapping.dmp

Download
memory/748-9-0x0000000000000000-mapping.dmp

Download
memory/748-288-0x0000000000000000-mapping.dmp

Download
memory/752-491-0x000000000044B5BE-mapping.dmp

Download
memory/776-543-0x0000000000000000-mapping.dmp

Download
memory/776-186-0x0000000000000000-mapping.dmp

Download
memory/796-102-0x0000000000000000-mapping.dmp

Download
memory/796-66-0x0000000000000000-mapping.dmp

Download
memory/812-158-0x000000000044B5BE-mapping.dmp

Download
memory/860-557-0x000000000044B5BE-mapping.dmp

Download
memory/860-350-0x000000000044B5BE-mapping.dmp

Download
memory/864-242-0x000000000044B5BE-mapping.dmp

Download
memory/892-335-0x000000000044B5BE-mapping.dmp

Download
memory/892-597-0x0000000000000000-mapping.dmp

Download
memory/912-443-0x000000000044B5BE-mapping.dmp

Download
memory/912-317-0x000000000044B5BE-mapping.dmp

Download
memory/916-368-0x000000000044B5BE-mapping.dmp

Download
memory/964-375-0x0000000000000000-mapping.dmp

Download
memory/964-333-0x0000000000000000-mapping.dmp

Download
memory/964-167-0x000000000044B5BE-mapping.dmp

Download
memory/972-569-0x000000000044B5BE-mapping.dmp

Download
memory/972-587-0x000000000044B5BE-mapping.dmp

Download
memory/972-261-0x0000000000000000-mapping.dmp

Download
memory/976-411-0x0000000000000000-mapping.dmp

Download
memory/976-353-0x000000000044B5BE-mapping.dmp

Download
memory/980-425-0x000000000044B5BE-mapping.dmp

Download
memory/1000-153-0x0000000000000000-mapping.dmp

Download
memory/1000-189-0x0000000000000000-mapping.dmp

Download
memory/1004-612-0x0000000000000000-mapping.dmp

Download
memory/1004-272-0x000000000044B5BE-mapping.dmp

Download
memory/1004-527-0x000000000044B5BE-mapping.dmp

Download
memory/1004-21-0x0000000000000000-mapping.dmp

Download
memory/1020-246-0x0000000000000000-mapping.dmp

Download
memory/1084-452-0x000000000044B5BE-mapping.dmp

Download
memory/1096-33-0x0000000000000000-mapping.dmp

Download
memory/1104-14-0x000000000044B5BE-mapping.dmp

Download
memory/1104-393-0x0000000000000000-mapping.dmp

Download
memory/1104-324-0x0000000000000000-mapping.dmp

Download
memory/1168-531-0x0000000000000000-mapping.dmp

Download
memory/1168-93-0x0000000000000000-mapping.dmp

Download
memory/1172-255-0x0000000000000000-mapping.dmp

Download
memory/1244-450-0x0000000000000000-mapping.dmp

Download
memory/1244-407-0x000000000044B5BE-mapping.dmp

Download
memory/1252-99-0x0000000000000000-mapping.dmp

Download
memory/1252-611-0x000000000044B5BE-mapping.dmp

Download
memory/1264-176-0x000000000044B5BE-mapping.dmp

Download
memory/1268-429-0x0000000000000000-mapping.dmp

Download
memory/1268-258-0x0000000000000000-mapping.dmp

Download
memory/1272-198-0x0000000000000000-mapping.dmp

Download
memory/1272-30-0x0000000000000000-mapping.dmp

Download
memory/1280-513-0x0000000000000000-mapping.dmp

Download
memory/1280-603-0x0000000000000000-mapping.dmp

Download
memory/1288-224-0x000000000044B5BE-mapping.dmp

Download
memory/1288-260-0x000000000044B5BE-mapping.dmp

Download
memory/1332-72-0x0000000000000000-mapping.dmp

Download
memory/1332-300-0x0000000000000000-mapping.dmp

Download
memory/1332-245-0x000000000044B5BE-mapping.dmp

Download
memory/1336-122-0x000000000044B5BE-mapping.dmp

Download
memory/1360-522-0x0000000000000000-mapping.dmp

Download
memory/1360-444-0x0000000000000000-mapping.dmp

Download
memory/1360-330-0x0000000000000000-mapping.dmp

Download
memory/1408-627-0x0000000000000000-mapping.dmp

Download
memory/1408-606-0x0000000000000000-mapping.dmp

Download
memory/1408-590-0x000000000044B5BE-mapping.dmp

Download
memory/1424-573-0x0000000000000000-mapping.dmp

Download
memory/1464-257-0x000000000044B5BE-mapping.dmp

Download
memory/1464-344-0x000000000044B5BE-mapping.dmp

Download
memory/1464-632-0x000000000044B5BE-mapping.dmp

Download
memory/1464-128-0x000000000044B5BE-mapping.dmp

Download
memory/1504-179-0x000000000044B5BE-mapping.dmp

Download
memory/1504-276-0x0000000000000000-mapping.dmp

Download
memory/1508-570-0x0000000000000000-mapping.dmp

Download
memory/1508-542-0x000000000044B5BE-mapping.dmp

Download
memory/1508-111-0x0000000000000000-mapping.dmp

Download
memory/1516-479-0x000000000044B5BE-mapping.dmp

Download
memory/1516-273-0x0000000000000000-mapping.dmp

Download
memory/1524-390-0x0000000000000000-mapping.dmp

Download
memory/1524-105-0x0000000000000000-mapping.dmp

Download
memory/1524-326-0x000000000044B5BE-mapping.dmp

Download
memory/1640-123-0x0000000000000000-mapping.dmp

Download
memory/1640-221-0x000000000044B5BE-mapping.dmp

Download
memory/1640-15-0x0000000000000000-mapping.dmp

Download
memory/1644-48-0x0000000000000000-mapping.dmp

Download
memory/1644-314-0x000000000044B5BE-mapping.dmp

Download
memory/1648-134-0x000000000044B5BE-mapping.dmp

Download
memory/1652-74-0x000000000044B5BE-mapping.dmp

Download
memory/1652-534-0x0000000000000000-mapping.dmp

Download
memory/1652-389-0x000000000044B5BE-mapping.dmp

Download
memory/1668-332-0x000000000044B5BE-mapping.dmp

Download
memory/1668-446-0x000000000044B5BE-mapping.dmp

Download
memory/1668-420-0x0000000000000000-mapping.dmp

Download
memory/1668-36-0x0000000000000000-mapping.dmp

Download
memory/1676-233-0x000000000044B5BE-mapping.dmp

Download
memory/1680-426-0x0000000000000000-mapping.dmp

Download
memory/1680-252-0x0000000000000000-mapping.dmp

Download
memory/1692-213-0x0000000000000000-mapping.dmp

Download
memory/1692-98-0x000000000044B5BE-mapping.dmp

Download
memory/1692-194-0x000000000044B5BE-mapping.dmp

Download
memory/1692-540-0x0000000000000000-mapping.dmp

Download
memory/1708-365-0x000000000044B5BE-mapping.dmp

Download
memory/1708-125-0x000000000044B5BE-mapping.dmp

Download
memory/1708-318-0x0000000000000000-mapping.dmp

Download
memory/1752-107-0x000000000044B5BE-mapping.dmp

Download
memory/1752-47-0x000000000044B5BE-mapping.dmp

Download
memory/1752-126-0x0000000000000000-mapping.dmp

Download
memory/1756-377-0x000000000044B5BE-mapping.dmp

Download
memory/1788-555-0x0000000000000000-mapping.dmp

Download
memory/1788-422-0x000000000044B5BE-mapping.dmp

Download
memory/1788-254-0x000000000044B5BE-mapping.dmp

Download
memory/1788-396-0x0000000000000000-mapping.dmp

Download
memory/1788-524-0x000000000044B5BE-mapping.dmp

Download
memory/1828-516-0x0000000000000000-mapping.dmp

Download
memory/1828-113-0x000000000044B5BE-mapping.dmp

Download
memory/1828-164-0x000000000044B5BE-mapping.dmp

Download
memory/1832-384-0x0000000000000000-mapping.dmp

Download
memory/1832-59-0x000000000044B5BE-mapping.dmp

Download
memory/1876-17-0x000000000044B5BE-mapping.dmp

Download
memory/1876-302-0x000000000044B5BE-mapping.dmp

Download
memory/1876-69-0x0000000000000000-mapping.dmp

Download
memory/1892-137-0x000000000044B5BE-mapping.dmp

Download
memory/1896-438-0x0000000000000000-mapping.dmp

Download
memory/1896-486-0x0000000000000000-mapping.dmp

Download
memory/1896-356-0x000000000044B5BE-mapping.dmp

Download
memory/1896-296-0x000000000044B5BE-mapping.dmp

Download
memory/1912-207-0x0000000000000000-mapping.dmp

Download
memory/1912-503-0x000000000044B5BE-mapping.dmp

Download
memory/1912-267-0x0000000000000000-mapping.dmp

Download
memory/1912-149-0x000000000044B5BE-mapping.dmp

Download
memory/1912-188-0x000000000044B5BE-mapping.dmp

Download
memory/1944-482-0x000000000044B5BE-mapping.dmp

Download
memory/1944-227-0x000000000044B5BE-mapping.dmp

Download
memory/1944-456-0x0000000000000000-mapping.dmp

Download
memory/1956-468-0x0000000000000000-mapping.dmp

Download
memory/1956-50-0x000000000044B5BE-mapping.dmp

Download
memory/1960-26-0x000000000044B5BE-mapping.dmp

Download
memory/1960-81-0x0000000000000000-mapping.dmp

Download
memory/1960-281-0x000000000044B5BE-mapping.dmp

Download
memory/1964-387-0x0000000000000000-mapping.dmp

Download
memory/1992-584-0x000000000044B5BE-mapping.dmp

Download
memory/1992-299-0x000000000044B5BE-mapping.dmp

Download
memory/1992-180-0x0000000000000000-mapping.dmp

Download
memory/2008-605-0x000000000044B5BE-mapping.dmp

Download
memory/2084-423-0x0000000000000000-mapping.dmp

Download
memory/2084-495-0x0000000000000000-mapping.dmp

Download
memory/2084-270-0x0000000000000000-mapping.dmp

Download
memory/2096-602-0x000000000044B5BE-mapping.dmp

Download
memory/2100-306-0x0000000000000000-mapping.dmp

Download
memory/2116-489-0x0000000000000000-mapping.dmp

Download
memory/2116-143-0x000000000044B5BE-mapping.dmp

Download
memory/2132-582-0x0000000000000000-mapping.dmp

Download
memory/2140-509-0x000000000044B5BE-mapping.dmp

Download
memory/2140-303-0x0000000000000000-mapping.dmp

Download
memory/2148-35-0x000000000044B5BE-mapping.dmp

Download
memory/2152-209-0x000000000044B5BE-mapping.dmp

Download
memory/2152-54-0x0000000000000000-mapping.dmp

Download
memory/2168-156-0x0000000000000000-mapping.dmp

Download
memory/2172-132-0x0000000000000000-mapping.dmp

Download
memory/2172-191-0x000000000044B5BE-mapping.dmp

Download
memory/2176-572-0x000000000044B5BE-mapping.dmp

Download
memory/2192-263-0x000000000044B5BE-mapping.dmp

Download
memory/2208-567-0x0000000000000000-mapping.dmp

Download
memory/2208-608-0x000000000044B5BE-mapping.dmp

Download
memory/2208-459-0x0000000000000000-mapping.dmp

Download
memory/2208-416-0x000000000044B5BE-mapping.dmp

Download
memory/2212-0-0x0000000000400000-0x0000000000450000-memory.dmp

Filesize
320KB

Download
memory/2212-1-0x000000000044B5BE-mapping.dmp

Download
memory/2220-147-0x0000000000000000-mapping.dmp

Download
memory/2220-269-0x000000000044B5BE-mapping.dmp

Download
memory/2220-90-0x0000000000000000-mapping.dmp

Download
memory/2220-615-0x0000000000000000-mapping.dmp

Download
memory/2228-170-0x000000000044B5BE-mapping.dmp

Download
memory/2228-285-0x0000000000000000-mapping.dmp

Download
memory/2268-564-0x0000000000000000-mapping.dmp

Download
memory/2268-347-0x000000000044B5BE-mapping.dmp

Download
memory/2320-428-0x000000000044B5BE-mapping.dmp

Download
memory/2324-155-0x000000000044B5BE-mapping.dmp

Download
memory/2328-539-0x000000000044B5BE-mapping.dmp

Download
memory/2328-41-0x000000000044B5BE-mapping.dmp

Download
memory/2368-621-0x0000000000000000-mapping.dmp

Download
memory/2388-623-0x000000000044B5BE-mapping.dmp

Download
memory/2396-609-0x0000000000000000-mapping.dmp

Download
memory/2396-392-0x000000000044B5BE-mapping.dmp

Download
memory/2420-92-0x000000000044B5BE-mapping.dmp

Download
memory/2420-53-0x000000000044B5BE-mapping.dmp

Download
memory/2420-360-0x0000000000000000-mapping.dmp

Download
memory/2428-536-0x000000000044B5BE-mapping.dmp

Download
memory/2536-339-0x0000000000000000-mapping.dmp

Download
memory/2536-548-0x000000000044B5BE-mapping.dmp

Download
memory/2536-576-0x0000000000000000-mapping.dmp

Download
memory/2560-575-0x000000000044B5BE-mapping.dmp

Download
memory/2560-228-0x0000000000000000-mapping.dmp

Download
memory/2564-117-0x0000000000000000-mapping.dmp

Download
memory/2564-24-0x0000000000000000-mapping.dmp

Download
memory/2564-374-0x000000000044B5BE-mapping.dmp

Download
memory/2572-62-0x000000000044B5BE-mapping.dmp

Download
memory/2572-279-0x0000000000000000-mapping.dmp

Download
memory/2576-464-0x000000000044B5BE-mapping.dmp

Download
memory/2576-131-0x000000000044B5BE-mapping.dmp

Download
memory/2576-56-0x000000000044B5BE-mapping.dmp

Download
memory/2576-521-0x000000000044B5BE-mapping.dmp

Download
memory/2576-183-0x0000000000000000-mapping.dmp

Download
memory/2580-528-0x0000000000000000-mapping.dmp

Download
memory/2580-563-0x000000000044B5BE-mapping.dmp

Download
memory/2652-161-0x000000000044B5BE-mapping.dmp

Download
memory/2652-431-0x000000000044B5BE-mapping.dmp

Download
memory/2656-383-0x000000000044B5BE-mapping.dmp

Download
memory/2656-23-0x000000000044B5BE-mapping.dmp

Download
memory/2664-558-0x0000000000000000-mapping.dmp

Download
memory/2664-437-0x000000000044B5BE-mapping.dmp

Download
memory/2664-171-0x0000000000000000-mapping.dmp

Download
memory/2668-518-0x000000000044B5BE-mapping.dmp

Download
memory/2764-533-0x000000000044B5BE-mapping.dmp

Download
memory/2764-216-0x0000000000000000-mapping.dmp

Download
memory/2764-138-0x0000000000000000-mapping.dmp

Download
memory/2784-231-0x0000000000000000-mapping.dmp

Download
memory/2784-309-0x0000000000000000-mapping.dmp

Download
memory/2784-483-0x0000000000000000-mapping.dmp

Download
memory/2788-275-0x000000000044B5BE-mapping.dmp

Download
memory/2800-203-0x000000000044B5BE-mapping.dmp

Download
memory/2824-342-0x0000000000000000-mapping.dmp

Download
memory/2824-458-0x000000000044B5BE-mapping.dmp

Download
memory/2824-206-0x000000000044B5BE-mapping.dmp

Download
memory/2824-366-0x0000000000000000-mapping.dmp

Download
memory/2852-371-0x000000000044B5BE-mapping.dmp

Download
memory/2852-20-0x000000000044B5BE-mapping.dmp

Download
memory/2852-327-0x0000000000000000-mapping.dmp

Download
memory/2852-492-0x0000000000000000-mapping.dmp

Download
memory/2860-65-0x000000000044B5BE-mapping.dmp

Download
memory/2860-359-0x000000000044B5BE-mapping.dmp

Download
memory/2864-230-0x000000000044B5BE-mapping.dmp

Download
memory/2864-44-0x000000000044B5BE-mapping.dmp

Download
memory/2904-251-0x000000000044B5BE-mapping.dmp

Download
memory/2904-596-0x000000000044B5BE-mapping.dmp

Download
memory/2904-507-0x0000000000000000-mapping.dmp

Download
memory/2920-471-0x0000000000000000-mapping.dmp

Download
memory/2920-119-0x000000000044B5BE-mapping.dmp

Download
memory/2920-234-0x0000000000000000-mapping.dmp

Download
memory/2920-101-0x000000000044B5BE-mapping.dmp

Download
memory/2960-174-0x0000000000000000-mapping.dmp

Download
memory/2960-312-0x0000000000000000-mapping.dmp

Download
memory/2960-338-0x000000000044B5BE-mapping.dmp

Download
memory/2968-116-0x000000000044B5BE-mapping.dmp

Download
memory/2968-135-0x0000000000000000-mapping.dmp

Download
memory/2968-617-0x000000000044B5BE-mapping.dmp

Download
memory/2968-494-0x000000000044B5BE-mapping.dmp

Download
memory/2968-210-0x0000000000000000-mapping.dmp

Download
memory/2968-449-0x000000000044B5BE-mapping.dmp

Download
memory/2976-8-0x000000000044B5BE-mapping.dmp

Download
memory/2976-240-0x0000000000000000-mapping.dmp

Download
memory/2976-476-0x000000000044B5BE-mapping.dmp

Download
memory/2980-5-0x0000000000000000-mapping.dmp

Download
memory/2980-86-0x000000000044B5BE-mapping.dmp

Download
memory/3000-114-0x0000000000000000-mapping.dmp

Download
memory/3000-284-0x000000000044B5BE-mapping.dmp

Download
memory/3000-95-0x000000000044B5BE-mapping.dmp

Download
memory/3000-504-0x0000000000000000-mapping.dmp

Download
memory/3004-398-0x000000000044B5BE-mapping.dmp

Download
memory/3004-348-0x0000000000000000-mapping.dmp

Download
memory/3004-372-0x0000000000000000-mapping.dmp

Download
memory/3004-462-0x0000000000000000-mapping.dmp

Download
memory/3004-419-0x000000000044B5BE-mapping.dmp

Download
memory/3008-363-0x0000000000000000-mapping.dmp

Download
memory/3008-413-0x000000000044B5BE-mapping.dmp

Download
memory/3012-591-0x0000000000000000-mapping.dmp

Download
memory/3012-249-0x0000000000000000-mapping.dmp

Download
memory/3028-480-0x0000000000000000-mapping.dmp

Download
memory/3048-512-0x000000000044B5BE-mapping.dmp

Download
memory/3048-546-0x0000000000000000-mapping.dmp

Download
memory/3144-506-0x000000000044B5BE-mapping.dmp

Download
memory/3160-278-0x000000000044B5BE-mapping.dmp

Download
memory/3160-618-0x0000000000000000-mapping.dmp

Download
memory/3188-401-0x000000000044B5BE-mapping.dmp

Download
memory/3188-218-0x000000000044B5BE-mapping.dmp

Download
memory/3188-4-0x000000000044B5BE-mapping.dmp

Download
memory/3252-579-0x0000000000000000-mapping.dmp

Download
memory/3252-291-0x0000000000000000-mapping.dmp

Download
memory/3260-629-0x000000000044B5BE-mapping.dmp

Download
memory/3260-510-0x0000000000000000-mapping.dmp

Download
memory/3260-470-0x000000000044B5BE-mapping.dmp

Download
memory/3292-297-0x0000000000000000-mapping.dmp

Download
memory/3292-345-0x0000000000000000-mapping.dmp

Download
memory/3336-402-0x0000000000000000-mapping.dmp

Download
memory/3336-467-0x000000000044B5BE-mapping.dmp

Download
memory/3340-195-0x0000000000000000-mapping.dmp

Download
memory/3352-38-0x000000000044B5BE-mapping.dmp

Download
memory/3352-57-0x0000000000000000-mapping.dmp

Download
memory/3380-530-0x000000000044B5BE-mapping.dmp

Download
memory/3380-432-0x0000000000000000-mapping.dmp

Download
memory/3384-110-0x000000000044B5BE-mapping.dmp

Download
memory/3396-630-0x0000000000000000-mapping.dmp

Download
memory/3412-447-0x0000000000000000-mapping.dmp

Download
memory/3428-362-0x000000000044B5BE-mapping.dmp

Download
memory/3428-614-0x000000000044B5BE-mapping.dmp

Download
memory/3484-380-0x000000000044B5BE-mapping.dmp

Download
memory/3484-585-0x0000000000000000-mapping.dmp

Download
memory/3488-354-0x0000000000000000-mapping.dmp

Download
memory/3560-549-0x0000000000000000-mapping.dmp

Download
memory/3564-515-0x000000000044B5BE-mapping.dmp

Download
memory/3564-600-0x0000000000000000-mapping.dmp

Download
memory/3604-624-0x0000000000000000-mapping.dmp

Download
memory/3608-581-0x000000000044B5BE-mapping.dmp

Download
memory/3612-287-0x000000000044B5BE-mapping.dmp

Download
memory/3628-248-0x000000000044B5BE-mapping.dmp

Download
memory/3628-305-0x000000000044B5BE-mapping.dmp

Download
memory/3628-75-0x0000000000000000-mapping.dmp

Download
memory/3636-357-0x0000000000000000-mapping.dmp

Download
memory/3640-89-0x000000000044B5BE-mapping.dmp

Download
memory/3696-45-0x0000000000000000-mapping.dmp

Download
memory/3696-11-0x000000000044B5BE-mapping.dmp

Download
memory/3708-32-0x000000000044B5BE-mapping.dmp

Download
memory/3708-197-0x000000000044B5BE-mapping.dmp

Download
memory/3712-144-0x0000000000000000-mapping.dmp

Download
memory/3712-51-0x0000000000000000-mapping.dmp

Download
memory/3716-80-0x000000000044B5BE-mapping.dmp

Download
memory/3716-626-0x000000000044B5BE-mapping.dmp

Download
memory/3720-290-0x000000000044B5BE-mapping.dmp

Download
memory/3724-141-0x0000000000000000-mapping.dmp

Download
memory/3736-311-0x000000000044B5BE-mapping.dmp

Download
memory/3736-192-0x0000000000000000-mapping.dmp

Download
memory/3760-578-0x000000000044B5BE-mapping.dmp

Download
memory/3764-455-0x000000000044B5BE-mapping.dmp

Download
memory/3764-386-0x000000000044B5BE-mapping.dmp

Download
memory/3764-497-0x000000000044B5BE-mapping.dmp

Download
memory/3764-159-0x0000000000000000-mapping.dmp

Download
memory/3764-140-0x000000000044B5BE-mapping.dmp

Download
memory/3784-599-0x000000000044B5BE-mapping.dmp

Download
memory/3816-18-0x0000000000000000-mapping.dmp

Download
memory/3820-293-0x000000000044B5BE-mapping.dmp

Download
memory/3824-554-0x000000000044B5BE-mapping.dmp

Download
memory/3824-501-0x0000000000000000-mapping.dmp

Download
memory/3824-588-0x0000000000000000-mapping.dmp

Download
memory/3824-212-0x000000000044B5BE-mapping.dmp

Download
memory/3836-519-0x0000000000000000-mapping.dmp

Download
memory/3852-63-0x0000000000000000-mapping.dmp

Download
memory/3852-341-0x000000000044B5BE-mapping.dmp

Download
memory/3852-2-0x0000000000000000-mapping.dmp

Download
memory/3852-39-0x0000000000000000-mapping.dmp

Download
memory/3856-225-0x0000000000000000-mapping.dmp

Download
memory/3856-150-0x0000000000000000-mapping.dmp

Download
memory/3860-561-0x0000000000000000-mapping.dmp

Download
memory/3860-320-0x000000000044B5BE-mapping.dmp

Download
memory/3860-236-0x000000000044B5BE-mapping.dmp

Download
memory/3864-410-0x000000000044B5BE-mapping.dmp

Download
memory/3864-152-0x000000000044B5BE-mapping.dmp

Download
memory/3864-264-0x0000000000000000-mapping.dmp

Download
memory/3864-222-0x0000000000000000-mapping.dmp

Download
memory/3868-87-0x0000000000000000-mapping.dmp

Download
memory/3868-551-0x000000000044B5BE-mapping.dmp

Download
memory/3880-77-0x000000000044B5BE-mapping.dmp

Download
memory/3880-441-0x0000000000000000-mapping.dmp

Download
memory/3896-84-0x0000000000000000-mapping.dmp

Download
memory/3900-545-0x000000000044B5BE-mapping.dmp

Download
memory/3904-498-0x0000000000000000-mapping.dmp

Download
memory/3908-129-0x0000000000000000-mapping.dmp

Download
memory/3908-243-0x0000000000000000-mapping.dmp

Download
memory/3908-68-0x000000000044B5BE-mapping.dmp

Download
memory/3920-168-0x0000000000000000-mapping.dmp

Download
memory/3920-485-0x000000000044B5BE-mapping.dmp

Download
memory/3920-552-0x0000000000000000-mapping.dmp

Download
memory/3948-173-0x000000000044B5BE-mapping.dmp

Download
memory/4008-323-0x000000000044B5BE-mapping.dmp

Download
memory/4028-381-0x0000000000000000-mapping.dmp

Download
memory/4028-336-0x0000000000000000-mapping.dmp

Download
memory/4028-594-0x0000000000000000-mapping.dmp

Download
memory/4064-308-0x000000000044B5BE-mapping.dmp

Download
memory/4064-351-0x0000000000000000-mapping.dmp

Download
memory/4064-215-0x000000000044B5BE-mapping.dmp

Download
memory/4068-120-0x0000000000000000-mapping.dmp

Download
memory/4068-434-0x000000000044B5BE-mapping.dmp

Download
memory/4068-165-0x0000000000000000-mapping.dmp

Download
memory/4068-408-0x0000000000000000-mapping.dmp

Download
memory/4072-500-0x000000000044B5BE-mapping.dmp

Download