darkcomet | 47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0

Analysis

max time kernel
151s
max time network
133s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2022 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
Size

743KB
MD5

7a36baa345dda1b89c496aa79a6a5a12
SHA1

273d7396a8645c5d6803481fa64399747c358d69
SHA256

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0
SHA512

f4f61f3c10e5a4452aa864bd45acfc39907376a8109c0a023453201f171229ebbbce995f652161047d0456635649d1af2adeed279903709ae325cbec31edeb74
SSDEEP

12288:PZ9FiM41ncjbrIsEcjDnFLTrXD7jMBnUZ0E4k61L0fVn+2Au:zQM4UbQcnnVT7oto0ENN9b

Score

10^/10

darkcomet 1 persistence rat trojan

Malware Config

Extracted

Family

darkcomet

Botnet

nothingissecurelol.chickenkiller.com:9003

Mutex

DC_MUTEX-SMQ80ND

Attributes

gencode
GdrP5FJmohEg
install
false
offline_keylogger
true
persistence
false

Signatures

Darkcomet
DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.
trojan rat darkcomet
Executes dropped EXE 3 IoCs

Processes:

AeLookupSvi.exeProfSvc.exeAeLookupSvi.exe

pid process

2332 AeLookupSvi.exe
3448 ProfSvc.exe
4256 AeLookupSvi.exe

pid	process
2332	AeLookupSvi.exe
3448	ProfSvc.exe
4256	AeLookupSvi.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exeAeLookupSvi.exeProfSvc.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	AeLookupSvi.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	ProfSvc.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

AeLookupSvi.exeAeLookupSvi.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application Experience = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AeLookupSvi.exe"	AeLookupSvi.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Application Experience = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\AeLookupSvi.exe"	AeLookupSvi.exe

Suspicious use of SetThreadContext 64 IoCs

Processes:

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exeProfSvc.exe

description	pid	process	target process
PID 4024 set thread context of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 3448 set thread context of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3588	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 2444	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4820	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4876	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3316	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3820	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4888	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4400	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4208	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 5116	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1332	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1924	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1888	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4976	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3032	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4192	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3340	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 2084	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4732	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3928	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3408	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3924	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4948	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4932	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4844	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 2196	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1444	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1612	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 5072	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1496	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3684	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4008	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 2752	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4332	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 864	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4488	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 392	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3832	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 860	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3652	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4904	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1992	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4676	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1156	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 2164	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 2132	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 2200	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1340	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 2688	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 5044	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4336	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1132	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 2436	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4428	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 4744	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3200	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1628	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1640	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 3708	3448	ProfSvc.exe	vbc.exe
PID 3448 set thread context of 1140	3448	ProfSvc.exe	vbc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe

pid	process
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exevbc.exeAeLookupSvi.exeProfSvc.exevbc.exevbc.exe

description	pid	process
Token: SeDebugPrivilege	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
Token: SeIncreaseQuotaPrivilege	3992	vbc.exe
Token: SeSecurityPrivilege	3992	vbc.exe
Token: SeTakeOwnershipPrivilege	3992	vbc.exe
Token: SeLoadDriverPrivilege	3992	vbc.exe
Token: SeSystemProfilePrivilege	3992	vbc.exe
Token: SeSystemtimePrivilege	3992	vbc.exe
Token: SeProfSingleProcessPrivilege	3992	vbc.exe
Token: SeIncBasePriorityPrivilege	3992	vbc.exe
Token: SeCreatePagefilePrivilege	3992	vbc.exe
Token: SeBackupPrivilege	3992	vbc.exe
Token: SeRestorePrivilege	3992	vbc.exe
Token: SeShutdownPrivilege	3992	vbc.exe
Token: SeDebugPrivilege	3992	vbc.exe
Token: SeSystemEnvironmentPrivilege	3992	vbc.exe
Token: SeChangeNotifyPrivilege	3992	vbc.exe
Token: SeRemoteShutdownPrivilege	3992	vbc.exe
Token: SeUndockPrivilege	3992	vbc.exe
Token: SeManageVolumePrivilege	3992	vbc.exe
Token: SeImpersonatePrivilege	3992	vbc.exe
Token: SeCreateGlobalPrivilege	3992	vbc.exe
Token: 33	3992	vbc.exe
Token: 34	3992	vbc.exe
Token: 35	3992	vbc.exe
Token: 36	3992	vbc.exe
Token: SeDebugPrivilege	2332	AeLookupSvi.exe
Token: SeDebugPrivilege	3448	ProfSvc.exe
Token: SeIncreaseQuotaPrivilege	4052	vbc.exe
Token: SeSecurityPrivilege	4052	vbc.exe
Token: SeTakeOwnershipPrivilege	4052	vbc.exe
Token: SeLoadDriverPrivilege	4052	vbc.exe
Token: SeSystemProfilePrivilege	4052	vbc.exe
Token: SeSystemtimePrivilege	4052	vbc.exe
Token: SeProfSingleProcessPrivilege	4052	vbc.exe
Token: SeIncBasePriorityPrivilege	4052	vbc.exe
Token: SeCreatePagefilePrivilege	4052	vbc.exe
Token: SeBackupPrivilege	4052	vbc.exe
Token: SeRestorePrivilege	4052	vbc.exe
Token: SeShutdownPrivilege	4052	vbc.exe
Token: SeDebugPrivilege	4052	vbc.exe
Token: SeSystemEnvironmentPrivilege	4052	vbc.exe
Token: SeChangeNotifyPrivilege	4052	vbc.exe
Token: SeRemoteShutdownPrivilege	4052	vbc.exe
Token: SeUndockPrivilege	4052	vbc.exe
Token: SeManageVolumePrivilege	4052	vbc.exe
Token: SeImpersonatePrivilege	4052	vbc.exe
Token: SeCreateGlobalPrivilege	4052	vbc.exe
Token: 33	4052	vbc.exe
Token: 34	4052	vbc.exe
Token: 35	4052	vbc.exe
Token: 36	4052	vbc.exe
Token: SeIncreaseQuotaPrivilege	1508	vbc.exe
Token: SeSecurityPrivilege	1508	vbc.exe
Token: SeTakeOwnershipPrivilege	1508	vbc.exe
Token: SeLoadDriverPrivilege	1508	vbc.exe
Token: SeSystemProfilePrivilege	1508	vbc.exe
Token: SeSystemtimePrivilege	1508	vbc.exe
Token: SeProfSingleProcessPrivilege	1508	vbc.exe
Token: SeIncBasePriorityPrivilege	1508	vbc.exe
Token: SeCreatePagefilePrivilege	1508	vbc.exe
Token: SeBackupPrivilege	1508	vbc.exe
Token: SeRestorePrivilege	1508	vbc.exe
Token: SeShutdownPrivilege	1508	vbc.exe
Token: SeDebugPrivilege	1508	vbc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

vbc.exe

pid process

3992 vbc.exe

pid	process
3992	vbc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exeAeLookupSvi.exeProfSvc.exe

description	pid	process	target process
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 3992	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	vbc.exe
PID 4024 wrote to memory of 2332	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	AeLookupSvi.exe
PID 4024 wrote to memory of 2332	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	AeLookupSvi.exe
PID 4024 wrote to memory of 2332	4024	47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe	AeLookupSvi.exe
PID 2332 wrote to memory of 3448	2332	AeLookupSvi.exe	ProfSvc.exe
PID 2332 wrote to memory of 3448	2332	AeLookupSvi.exe	ProfSvc.exe
PID 2332 wrote to memory of 3448	2332	AeLookupSvi.exe	ProfSvc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4052	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4256	3448	ProfSvc.exe	AeLookupSvi.exe
PID 3448 wrote to memory of 4256	3448	ProfSvc.exe	AeLookupSvi.exe
PID 3448 wrote to memory of 4256	3448	ProfSvc.exe	AeLookupSvi.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 1508	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 4244	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 3588	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 3588	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 3588	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 3588	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 3588	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 3588	3448	ProfSvc.exe	vbc.exe
PID 3448 wrote to memory of 3588	3448	ProfSvc.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe
"C:\Users\Admin\AppData\Local\Temp\47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4024

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3992

C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2332

C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe"
3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4052

C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe"
4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4256

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4244

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3588

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2444

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4820

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3316

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3820

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4888

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4400

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4208

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5116

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1332

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1924

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1888

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4976

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4192

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2084

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4732

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3928

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3408

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3924

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4948

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4932

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4844

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2196

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1444

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1612

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5072

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1496

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3684

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4008

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2752

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4332

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:864

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4488

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:392

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3832

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:860

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3652

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4904

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1992

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4676

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1156

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2164

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2132

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2200

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2688

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5044

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4336

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1132

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4744

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3200

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1628

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1640

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3708

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1140

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:964

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1596

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2836

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3916

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4004

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1308

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:204

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4388

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5084

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1260

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3424

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2372

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:460

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4168

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2684

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1516

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4856

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4132

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2208

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4296

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4408

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4412

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5020

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1316

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2464

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2528

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4204

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3384

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4452

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4108

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:888

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3036

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3348

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:208

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4712

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3736

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:444

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4232

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4548

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4700

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1916

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4048

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3464

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5060

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4416

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4240

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1928

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3104

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4116

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:432

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1336

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4300

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4220

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2532

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3080

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2952

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2376

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3688

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3344

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4776

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3828

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4836

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1352

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1708

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3988

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3632

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3264

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4908

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:324

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1904

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:396

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1696

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1220

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3388

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2328

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3088

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3848

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3840

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1288

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4424

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1272

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3792

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4656

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3592

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1280

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4076

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2428

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:744

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4272

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2600

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3056

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3312

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3668

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:648

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2000

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5040

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3380

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4708

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3596

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1932

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4788

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2692

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5024

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3292

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:216

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4100

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5004

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1668

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3092

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3940

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3572

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3224

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2332

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4280

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4752

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4216

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2520

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2136

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1476

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1464

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4000

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4800

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3712

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:628

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3508

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:260

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3064

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2564

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:364

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2056

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1736

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1064

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:336

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4828

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2840

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1632

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1088

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1884

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:520

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2416

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2160

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3816

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4756

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3016

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2388

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3412

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5136

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5172

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5208

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5248

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5288

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5324

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5360

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5396

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5472

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5552

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5588

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5628

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5664

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5700

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5780

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5820

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5864

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5900

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5940

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5980

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6016

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6052

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6088

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6128

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5144

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5204

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5228

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5264

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5332

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5384

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5412

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4920

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5524

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5560

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5612

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5656

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5696

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3256

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5788

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5848

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5888

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5924

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5960

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6000

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6064

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6100

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:116

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5168

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5232

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5296

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5356

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5424

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4916

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5504

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5532

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5580

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5672

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5720

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5772

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5860

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5880

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5948

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6008

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:644

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6108

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5156

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5188

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5268

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5344

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5432

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5464

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5544

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5600

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5688

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5756

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5828

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5908

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6004

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6048

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6076

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5180

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5256

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5348

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5500

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5620

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5728

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5804

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5896

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5996

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6060

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5128

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5244

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1636

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5308

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5496

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5616

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5692

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1856

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6032

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5160

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5200

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5312

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:488

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4816

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5576

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5716

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4824

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3580

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4392

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5104

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4472

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5540

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5952

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6140

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4796

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5304

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5548

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5732

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2176

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1900

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:2264

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5408

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5812

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6012

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:3860

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:1500

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5808

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6112

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4808

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5932

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5404

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5676

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6028

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5884

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5652

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:4892

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5712

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5776

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5236

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:5196

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6160

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6200

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6240

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6280

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6316

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6352

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6400

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6436

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6472

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6512

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6548

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6584

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6624

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6664

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6700

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6740

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6780

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6820

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6856

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6892

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6932

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6968

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7008

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7044

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7080

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7116

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7156

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6172

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6228

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6264

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6308

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6364

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6412

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6468

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6488

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6556

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6612

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6648

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6696

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6732

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6788

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6832

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6876

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6908

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6964

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7016

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7068

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7112

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7164

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6196

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6252

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6328

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6388

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6448

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6480

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6544

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6604

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6676

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6728

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6808

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6852

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6912

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6980

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7036

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7088

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7132

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6212

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6304

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6340

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6416

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6508

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6576

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6660

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6756

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6840

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6884

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6948

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6992

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7152

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6188

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6292

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6344

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6460

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6528

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6616

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6736

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6800

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6940

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:312

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7072

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:7144

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6288

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
4⤵
PID:6396

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Scripting

T1064

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\AeLookupSvi.exe.log
Filesize
128B

MD5
a5dcc7c9c08af7dddd82be5b036a4416

SHA1
4f998ca1526d199e355ffb435bae111a2779b994

SHA256
e24033ceec97fd03402b03acaaabd1d1e378e83bb1683afbccac760e00f8ead5

SHA512
56035de734836c0c39f0b48641c51c26adb6e79c6c65e23ca96603f71c95b8673e2ef853146e87efc899dd1878d0bbc2c82d91fbf0fce81c552048e986f9bb5a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
Filesize
10KB

MD5
735c4d78663190b26c3bd7d55fe6d055

SHA1
41b86ac84eddf2ca11ec6e4822f78f38f61c809a

SHA256
227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

SHA512
fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
Filesize
10KB

MD5
735c4d78663190b26c3bd7d55fe6d055

SHA1
41b86ac84eddf2ca11ec6e4822f78f38f61c809a

SHA256
227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

SHA512
fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
Filesize
10KB

MD5
735c4d78663190b26c3bd7d55fe6d055

SHA1
41b86ac84eddf2ca11ec6e4822f78f38f61c809a

SHA256
227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

SHA512
fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\AeLookupSvi.exe
Filesize
10KB

MD5
735c4d78663190b26c3bd7d55fe6d055

SHA1
41b86ac84eddf2ca11ec6e4822f78f38f61c809a

SHA256
227d6056cf5b8238ccf2cc73399b1e137fecface0c9f9d1a06b87270645d1a1c

SHA512
fecd523dd8725fb52fdfcdc29231b7d7de22cd424ab0469fcc267dbf63239addce9706771859863642f1ab63d245ca9a7062e6205f419c2e5e750909cf6cfb67

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
Filesize
743KB

MD5
7a36baa345dda1b89c496aa79a6a5a12

SHA1
273d7396a8645c5d6803481fa64399747c358d69

SHA256
47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0

SHA512
f4f61f3c10e5a4452aa864bd45acfc39907376a8109c0a023453201f171229ebbbce995f652161047d0456635649d1af2adeed279903709ae325cbec31edeb74

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\ProfSvc.exe
Filesize
743KB

MD5
7a36baa345dda1b89c496aa79a6a5a12

SHA1
273d7396a8645c5d6803481fa64399747c358d69

SHA256
47a2ac8ed1e82d0d45224a2c6ec24bb1a1e4bead2dcdf5850babd31c7b2c75e0

SHA512
f4f61f3c10e5a4452aa864bd45acfc39907376a8109c0a023453201f171229ebbbce995f652161047d0456635649d1af2adeed279903709ae325cbec31edeb74

Download Submit
memory/392-356-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/392-352-0x0000000000000000-mapping.dmp

Download
memory/860-367-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/860-363-0x0000000000000000-mapping.dmp

Download
memory/864-346-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/864-342-0x0000000000000000-mapping.dmp

Download
memory/1132-429-0x0000000000000000-mapping.dmp

Download
memory/1156-389-0x0000000000000000-mapping.dmp

Download
memory/1156-393-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-226-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1332-222-0x0000000000000000-mapping.dmp

Download
memory/1340-413-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1340-409-0x0000000000000000-mapping.dmp

Download
memory/1444-302-0x0000000000000000-mapping.dmp

Download
memory/1444-306-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1496-321-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1496-317-0x0000000000000000-mapping.dmp

Download
memory/1508-161-0x0000000000000000-mapping.dmp

Download
memory/1508-165-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1612-311-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1612-307-0x0000000000000000-mapping.dmp

Download
memory/1628-454-0x0000000000000000-mapping.dmp

Download
memory/1888-232-0x0000000000000000-mapping.dmp

Download
memory/1888-236-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1924-227-0x0000000000000000-mapping.dmp

Download
memory/1924-231-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/1992-379-0x0000000000000000-mapping.dmp

Download
memory/1992-383-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2084-257-0x0000000000000000-mapping.dmp

Download
memory/2084-261-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2132-399-0x0000000000000000-mapping.dmp

Download
memory/2132-403-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2164-394-0x0000000000000000-mapping.dmp

Download
memory/2164-398-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2196-301-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2196-297-0x0000000000000000-mapping.dmp

Download
memory/2200-404-0x0000000000000000-mapping.dmp

Download
memory/2200-408-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2332-139-0x0000000000000000-mapping.dmp

Download
memory/2332-144-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/2332-150-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/2332-142-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/2436-434-0x0000000000000000-mapping.dmp

Download
memory/2444-180-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2444-176-0x0000000000000000-mapping.dmp

Download
memory/2688-414-0x0000000000000000-mapping.dmp

Download
memory/2752-336-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/2752-332-0x0000000000000000-mapping.dmp

Download
memory/3032-242-0x0000000000000000-mapping.dmp

Download
memory/3032-246-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3200-449-0x0000000000000000-mapping.dmp

Download
memory/3316-192-0x0000000000000000-mapping.dmp

Download
memory/3316-196-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3340-252-0x0000000000000000-mapping.dmp

Download
memory/3340-256-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3408-272-0x0000000000000000-mapping.dmp

Download
memory/3408-276-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3448-146-0x0000000000000000-mapping.dmp

Download
memory/3448-148-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/3448-149-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/3588-171-0x0000000000000000-mapping.dmp

Download
memory/3588-175-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3652-372-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3652-368-0x0000000000000000-mapping.dmp

Download
memory/3684-326-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3684-322-0x0000000000000000-mapping.dmp

Download
memory/3820-201-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3820-197-0x0000000000000000-mapping.dmp

Download
memory/3832-362-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3832-357-0x0000000000000000-mapping.dmp

Download
memory/3924-281-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3924-277-0x0000000000000000-mapping.dmp

Download
memory/3928-267-0x0000000000000000-mapping.dmp

Download
memory/3928-271-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3992-138-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3992-134-0x0000000000000000-mapping.dmp

Download
memory/3992-135-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3992-136-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3992-143-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/3992-137-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4008-331-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4008-327-0x0000000000000000-mapping.dmp

Download
memory/4024-132-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/4024-133-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/4024-151-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/4052-152-0x0000000000000000-mapping.dmp

Download
memory/4052-159-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4192-247-0x0000000000000000-mapping.dmp

Download
memory/4192-251-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4208-216-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4208-212-0x0000000000000000-mapping.dmp

Download
memory/4244-166-0x0000000000000000-mapping.dmp

Download
memory/4244-170-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4256-183-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/4256-156-0x0000000000000000-mapping.dmp

Download
memory/4256-361-0x00000000752B0000-0x0000000075861000-memory.dmp

Filesize
5.7MB

Download
memory/4332-341-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4332-337-0x0000000000000000-mapping.dmp

Download
memory/4336-424-0x0000000000000000-mapping.dmp

Download
memory/4400-207-0x0000000000000000-mapping.dmp

Download
memory/4400-211-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4428-439-0x0000000000000000-mapping.dmp

Download
memory/4488-347-0x0000000000000000-mapping.dmp

Download
memory/4488-351-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4676-384-0x0000000000000000-mapping.dmp

Download
memory/4676-388-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4732-266-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4732-262-0x0000000000000000-mapping.dmp

Download
memory/4744-444-0x0000000000000000-mapping.dmp

Download
memory/4820-181-0x0000000000000000-mapping.dmp

Download
memory/4820-186-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4844-296-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4844-292-0x0000000000000000-mapping.dmp

Download
memory/4876-191-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4876-187-0x0000000000000000-mapping.dmp

Download
memory/4888-206-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4888-202-0x0000000000000000-mapping.dmp

Download
memory/4904-377-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4904-378-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4904-373-0x0000000000000000-mapping.dmp

Download
memory/4932-291-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4932-287-0x0000000000000000-mapping.dmp

Download
memory/4948-282-0x0000000000000000-mapping.dmp

Download
memory/4948-286-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/4976-237-0x0000000000000000-mapping.dmp

Download
memory/4976-241-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5044-419-0x0000000000000000-mapping.dmp

Download
memory/5072-316-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5072-312-0x0000000000000000-mapping.dmp

Download
memory/5116-221-0x0000000000400000-0x00000000004B2000-memory.dmp

Filesize
712KB

Download
memory/5116-217-0x0000000000000000-mapping.dmp

Download