darkcomet | 47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0

Analysis

max time kernel
275s
max time network
335s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27-11-2022 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
Size

743KB
MD5

7a36baa345dda1b89c496aa79a6a5a12
SHA1

273d7396a8645c5d6803481fa64399747c358d69
SHA256

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0
SHA512

f4f61f3c10e5a4452aa864bd45acfc39907376a8109c0a023453201f171229ebbbce995f652161047d0456635649d1af2adeed279903709ae325cbec31edeb74
SSDEEP

12288:PZ9FiM41ncjbrIsEcjDnFLTrXD7jMBnUZ0E4k61L0fVn+2Au:zQM4UbQcnnVT7oto0ENN9b

Score

10^/10

darkcomet 1 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

nothingissecurelol.chickenkiller.com:9003

Mutex

DC_MUTEX-SMQ80ND

Attributes

gencode
GdrP5FJmohEg
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 3 IoCs

Processes:

AeLookupSvi.exeProfSvc.exeAeLookupSvi.exe

pid process

928 AeLookupSvi.exe
1652 ProfSvc.exe
1952 AeLookupSvi.exe
Loads dropped DLL 2 IoCs

Processes:

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exeAeLookupSvi.exe

pid process

584 47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928 AeLookupSvi.exe
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
928	AeLookupSvi.exe
1652	ProfSvc.exe
1952	AeLookupSvi.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AeLookupSvi.exeAeLookupSvi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application Experience = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AeLookupSvi.exe"	AeLookupSvi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Application Experience = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AeLookupSvi.exe"	AeLookupSvi.exe

Suspicious use of SetThreadContext 64 IoCs

Processes:

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exeProfSvc.exe

description	pid	process	target process
PID 584 set thread context of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 1652 set thread context of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 812	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1292	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 944	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1572	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1152	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 868	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1780	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1612	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1256	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1512	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1492	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1716	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 2008	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1832	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1080	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1720	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1748	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1668	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1760	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1936	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 928	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1332	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1960	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1708	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1196	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1132	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1064	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1624	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1384	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 900	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1192	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1580	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 188	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1324	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1600	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1964	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 268	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1796	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 940	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1816	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1884	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1736	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1404	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1472	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1820	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1776	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1988	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1432	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 616	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 544	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1212	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1644	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 552	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1876	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1232	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1528	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 1732	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 2120	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 2212	1652	ProfSvc.exe	vbc.exe
PID 1652 set thread context of 2304	1652	ProfSvc.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exeAeLookupSvi.exe

pid	process
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
928	AeLookupSvi.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exevbc.exeAeLookupSvi.exeProfSvc.exevbc.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
Token: SeIncreaseQuotaPrivilege	1108	vbc.exe
Token: SeSecurityPrivilege	1108	vbc.exe
Token: SeTakeOwnershipPrivilege	1108	vbc.exe
Token: SeLoadDriverPrivilege	1108	vbc.exe
Token: SeSystemProfilePrivilege	1108	vbc.exe
Token: SeSystemtimePrivilege	1108	vbc.exe
Token: SeProfSingleProcessPrivilege	1108	vbc.exe
Token: SeIncBasePriorityPrivilege	1108	vbc.exe
Token: SeCreatePagefilePrivilege	1108	vbc.exe
Token: SeBackupPrivilege	1108	vbc.exe
Token: SeRestorePrivilege	1108	vbc.exe
Token: SeShutdownPrivilege	1108	vbc.exe
Token: SeDebugPrivilege	1108	vbc.exe
Token: SeSystemEnvironmentPrivilege	1108	vbc.exe
Token: SeChangeNotifyPrivilege	1108	vbc.exe
Token: SeRemoteShutdownPrivilege	1108	vbc.exe
Token: SeUndockPrivilege	1108	vbc.exe
Token: SeManageVolumePrivilege	1108	vbc.exe
Token: SeImpersonatePrivilege	1108	vbc.exe
Token: SeCreateGlobalPrivilege	1108	vbc.exe
Token: 33	1108	vbc.exe
Token: 34	1108	vbc.exe
Token: 35	1108	vbc.exe
Token: SeDebugPrivilege	928	AeLookupSvi.exe
Token: SeDebugPrivilege	1652	ProfSvc.exe
Token: SeIncreaseQuotaPrivilege	1032	vbc.exe
Token: SeSecurityPrivilege	1032	vbc.exe
Token: SeTakeOwnershipPrivilege	1032	vbc.exe
Token: SeLoadDriverPrivilege	1032	vbc.exe
Token: SeSystemProfilePrivilege	1032	vbc.exe
Token: SeSystemtimePrivilege	1032	vbc.exe
Token: SeProfSingleProcessPrivilege	1032	vbc.exe
Token: SeIncBasePriorityPrivilege	1032	vbc.exe
Token: SeCreatePagefilePrivilege	1032	vbc.exe
Token: SeBackupPrivilege	1032	vbc.exe
Token: SeRestorePrivilege	1032	vbc.exe
Token: SeShutdownPrivilege	1032	vbc.exe
Token: SeDebugPrivilege	1032	vbc.exe
Token: SeSystemEnvironmentPrivilege	1032	vbc.exe
Token: SeChangeNotifyPrivilege	1032	vbc.exe
Token: SeRemoteShutdownPrivilege	1032	vbc.exe
Token: SeUndockPrivilege	1032	vbc.exe
Token: SeManageVolumePrivilege	1032	vbc.exe
Token: SeImpersonatePrivilege	1032	vbc.exe
Token: SeCreateGlobalPrivilege	1032	vbc.exe
Token: 33	1032	vbc.exe
Token: 34	1032	vbc.exe
Token: 35	1032	vbc.exe
Token: SeIncreaseQuotaPrivilege	340	vbc.exe
Token: SeSecurityPrivilege	340	vbc.exe
Token: SeTakeOwnershipPrivilege	340	vbc.exe
Token: SeLoadDriverPrivilege	340	vbc.exe
Token: SeSystemProfilePrivilege	340	vbc.exe
Token: SeSystemtimePrivilege	340	vbc.exe
Token: SeProfSingleProcessPrivilege	340	vbc.exe
Token: SeIncBasePriorityPrivilege	340	vbc.exe
Token: SeCreatePagefilePrivilege	340	vbc.exe
Token: SeBackupPrivilege	340	vbc.exe
Token: SeRestorePrivilege	340	vbc.exe
Token: SeShutdownPrivilege	340	vbc.exe
Token: SeDebugPrivilege	340	vbc.exe
Token: SeSystemEnvironmentPrivilege	340	vbc.exe
Token: SeChangeNotifyPrivilege	340	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

1108 vbc.exe

pid	process
1108	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exeAeLookupSvi.exeProfSvc.exe

description	pid	process	target process
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 1108	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 584 wrote to memory of 928	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	AeLookupSvi.exe
PID 584 wrote to memory of 928	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	AeLookupSvi.exe
PID 584 wrote to memory of 928	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	AeLookupSvi.exe
PID 584 wrote to memory of 928	584	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	AeLookupSvi.exe
PID 928 wrote to memory of 1652	928	AeLookupSvi.exe	ProfSvc.exe
PID 928 wrote to memory of 1652	928	AeLookupSvi.exe	ProfSvc.exe
PID 928 wrote to memory of 1652	928	AeLookupSvi.exe	ProfSvc.exe
PID 928 wrote to memory of 1652	928	AeLookupSvi.exe	ProfSvc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1032	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1952	1652	ProfSvc.exe	AeLookupSvi.exe
PID 1652 wrote to memory of 1952	1652	ProfSvc.exe	AeLookupSvi.exe
PID 1652 wrote to memory of 1952	1652	ProfSvc.exe	AeLookupSvi.exe
PID 1652 wrote to memory of 1952	1652	ProfSvc.exe	AeLookupSvi.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 340	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe
PID 1652 wrote to memory of 1800	1652	ProfSvc.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
"C:\Users\Admin\AppData\Local\Temp\47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:584

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1108

C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:928

C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1032

C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1952

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1800

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:812

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1292

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:944

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1572

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1152

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:868

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1780

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1612

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1256

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1492

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1716

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2008

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1832

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1080

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1720

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1748

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1668

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1760

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1936

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:928

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1332

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1960

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1708

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1196

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1132

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1064

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1384

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:900

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1192

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1580

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:188

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1324

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1600

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1964

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:268

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1796

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:940

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1816

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1884

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1736

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1472

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1820

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1776

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1988

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1432

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:616

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:544

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1212

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1644

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:552

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1232

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1528

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1732

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2120

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2212

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2304

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2396

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2488

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2580

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2672

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2764

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2856

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2948

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3040

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2100

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2200

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2300

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2408

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2476

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2576

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2684

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2884

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2980

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2160

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2268

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1532

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2572

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2692

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2800

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2912

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3016

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2092

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2224

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2344

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2452

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2552

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2664

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2796

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2920

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3036

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2136

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2256

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2392

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2632

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2760

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2144

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2284

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2432

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2540

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2708

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2836

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2972

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2080

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2248

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2528

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2716

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2864

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3012

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2168

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2328

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:564

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2644

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2824

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2996

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2148

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2504

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2700

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2892

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1072

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2236

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2628

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2840

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3064

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2240

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2468

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2660

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2924

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2116

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2360

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2596

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2816

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2060

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2324

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2564

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2820

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2076

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2388

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2640

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2964

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2232

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2532

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2848

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2180

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2496

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2792

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2196

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2612

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2956

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2332

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2732

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2108

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2604

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3008

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2464

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2984

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1700

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1112

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2320

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2752

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2276

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2748

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2372

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2812

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:628

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3060

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2720

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1164

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2208

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3004

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:984

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2172

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2440

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2444

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2940

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:300

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2944

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2536

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3132

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3224

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3316

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3408

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3500

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3592

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3684

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3776

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3868

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3960

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3116

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3216

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3324

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3424

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3524

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3724

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3824

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3924

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4020

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3096

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3204

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3312

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3544

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3652

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3760

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3884

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3984

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4092

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3180

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3288

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3416

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3540

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3664

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3788

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3904

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3124

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3252

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3496

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3636

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3768

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3900

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4036

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3152

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1088

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3432

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3572

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3708

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3852

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3996

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3112

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3260

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3588

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4064

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:240

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3356

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3516

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3704

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3880

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4060

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3200

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3380

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3580

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3784

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3952

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3144

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3308

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3732

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3948

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3084

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3344

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3564

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3820

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4012

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3240

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3464

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3692

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3972

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2000

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3456

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3720

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4004

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3264

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3536

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3844

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3092

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3400

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3756

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4084

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3368

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3816

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3088

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3484

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3920

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3272

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3620

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2916

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3604

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3992

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3460

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3944

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3492

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4080

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3648

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3208

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3860

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3632

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
Filesize
10KB

MD5
735c4d78663190b26c3bd7d55fe6d055

SHA1
41b86ac84eddf2ca11ec6e4822f78f38f61c809a

SHA256
227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

SHA512
fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
Filesize
10KB

MD5
735c4d78663190b26c3bd7d55fe6d055

SHA1
41b86ac84eddf2ca11ec6e4822f78f38f61c809a

SHA256
227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

SHA512
fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
Filesize
10KB

MD5
735c4d78663190b26c3bd7d55fe6d055

SHA1
41b86ac84eddf2ca11ec6e4822f78f38f61c809a

SHA256
227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

SHA512
fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
Filesize
743KB

MD5
7a36baa345dda1b89c496aa79a6a5a12

SHA1
273d7396a8645c5d6803481fa64399747c358d69

SHA256
47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0

SHA512
f4f61f3c10e5a4452aa864bd45acfc39907376a8109c0a023453201f171229ebbbce995f652161047d0456635649d1af2adeed279903709ae325cbec31edeb74

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
Filesize
743KB

MD5
7a36baa345dda1b89c496aa79a6a5a12

SHA1
273d7396a8645c5d6803481fa64399747c358d69

SHA256
47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0

SHA512
f4f61f3c10e5a4452aa864bd45acfc39907376a8109c0a023453201f171229ebbbce995f652161047d0456635649d1af2adeed279903709ae325cbec31edeb74

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
Filesize
10KB

MD5
735c4d78663190b26c3bd7d55fe6d055

SHA1
41b86ac84eddf2ca11ec6e4822f78f38f61c809a

SHA256
227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

SHA512
fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
Filesize
743KB

MD5
7a36baa345dda1b89c496aa79a6a5a12

SHA1
273d7396a8645c5d6803481fa64399747c358d69

SHA256
47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0

SHA512
f4f61f3c10e5a4452aa864bd45acfc39907376a8109c0a023453201f171229ebbbce995f652161047d0456635649d1af2adeed279903709ae325cbec31edeb74

Download Submit
memory/188-814-0x000000000048F888-mapping.dmp

Download
memory/188-818-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/268-894-0x000000000048F888-mapping.dmp

Download
memory/268-898-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/340-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/340-133-0x000000000048F888-mapping.dmp

Download
memory/544-1154-0x000000000048F888-mapping.dmp

Download
memory/552-1214-0x000000000048F888-mapping.dmp

Download
memory/584-93-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/584-54-0x0000000075671000-0x0000000075673000-memory.dmp

Filesize
8KB

Download
memory/584-56-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/584-55-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/616-1138-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/616-1134-0x000000000048F888-mapping.dmp

Download
memory/812-177-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/812-173-0x000000000048F888-mapping.dmp

Download
memory/868-273-0x000000000048F888-mapping.dmp

Download
memory/868-277-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/900-754-0x000000000048F888-mapping.dmp

Download
memory/900-758-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/928-573-0x000000000048F888-mapping.dmp

Download
memory/928-92-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/928-577-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/928-82-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/928-84-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/928-77-0x0000000000000000-mapping.dmp

Download
memory/940-934-0x000000000048F888-mapping.dmp

Download
memory/940-938-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/944-217-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/944-213-0x000000000048F888-mapping.dmp

Download
memory/1032-109-0x000000000048F888-mapping.dmp

Download
memory/1032-116-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1064-697-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1064-693-0x000000000048F888-mapping.dmp

Download
memory/1080-457-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1080-453-0x000000000048F888-mapping.dmp

Download
memory/1108-71-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-73-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-83-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-66-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-64-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-81-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-75-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-67-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-69-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-62-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-60-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-58-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-57-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1108-72-0x000000000048F888-mapping.dmp

Download
memory/1132-673-0x000000000048F888-mapping.dmp

Download
memory/1132-677-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1152-257-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1152-253-0x000000000048F888-mapping.dmp

Download
memory/1192-778-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1192-774-0x000000000048F888-mapping.dmp

Download
memory/1196-657-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1196-653-0x000000000048F888-mapping.dmp

Download
memory/1212-1174-0x000000000048F888-mapping.dmp

Download
memory/1232-1254-0x000000000048F888-mapping.dmp

Download
memory/1256-337-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1256-333-0x000000000048F888-mapping.dmp

Download
memory/1292-197-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1292-193-0x000000000048F888-mapping.dmp

Download
memory/1324-838-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1324-834-0x000000000048F888-mapping.dmp

Download
memory/1332-593-0x000000000048F888-mapping.dmp

Download
memory/1332-597-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1384-738-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1384-734-0x000000000048F888-mapping.dmp

Download
memory/1404-1018-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1404-1014-0x000000000048F888-mapping.dmp

Download
memory/1432-1118-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1432-1114-0x000000000048F888-mapping.dmp

Download
memory/1472-1034-0x000000000048F888-mapping.dmp

Download
memory/1472-1038-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1492-373-0x000000000048F888-mapping.dmp

Download
memory/1492-377-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1512-353-0x000000000048F888-mapping.dmp

Download
memory/1512-357-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1528-1274-0x000000000048F888-mapping.dmp

Download
memory/1572-237-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1572-233-0x000000000048F888-mapping.dmp

Download
memory/1580-798-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1580-794-0x000000000048F888-mapping.dmp

Download
memory/1600-854-0x000000000048F888-mapping.dmp

Download
memory/1600-858-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1612-313-0x000000000048F888-mapping.dmp

Download
memory/1612-317-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1624-714-0x000000000048F888-mapping.dmp

Download
memory/1624-718-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1644-1194-0x000000000048F888-mapping.dmp

Download
memory/1652-91-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1652-87-0x0000000000000000-mapping.dmp

Download
memory/1652-90-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1668-517-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1668-513-0x000000000048F888-mapping.dmp

Download
memory/1708-637-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1708-633-0x000000000048F888-mapping.dmp

Download
memory/1716-397-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1716-393-0x000000000048F888-mapping.dmp

Download
memory/1720-473-0x000000000048F888-mapping.dmp

Download
memory/1720-477-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1732-1294-0x000000000048F888-mapping.dmp

Download
memory/1736-994-0x000000000048F888-mapping.dmp

Download
memory/1736-998-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1748-493-0x000000000048F888-mapping.dmp

Download
memory/1748-497-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1760-537-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1760-533-0x000000000048F888-mapping.dmp

Download
memory/1776-1078-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1776-1074-0x000000000048F888-mapping.dmp

Download
memory/1780-297-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1780-293-0x000000000048F888-mapping.dmp

Download
memory/1796-914-0x000000000048F888-mapping.dmp

Download
memory/1796-918-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1800-153-0x000000000048F888-mapping.dmp

Download
memory/1800-157-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1816-958-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1816-954-0x000000000048F888-mapping.dmp

Download
memory/1820-1054-0x000000000048F888-mapping.dmp

Download
memory/1820-1058-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1832-437-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1832-433-0x000000000048F888-mapping.dmp

Download
memory/1876-1234-0x000000000048F888-mapping.dmp

Download
memory/1884-978-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1884-974-0x000000000048F888-mapping.dmp

Download
memory/1936-553-0x000000000048F888-mapping.dmp

Download
memory/1936-557-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1952-698-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1952-117-0x00000000740B0000-0x000000007465B000-memory.dmp

Filesize
5.7MB

Download
memory/1952-113-0x0000000000000000-mapping.dmp

Download
memory/1960-613-0x000000000048F888-mapping.dmp

Download
memory/1960-617-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1964-874-0x000000000048F888-mapping.dmp

Download
memory/1964-878-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-1098-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1988-1094-0x000000000048F888-mapping.dmp

Download
memory/2008-417-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2008-413-0x000000000048F888-mapping.dmp

Download