Analysis
-
max time kernel
150s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27/03/2025, 02:23
Static task
static1
Behavioral task
behavioral1
Sample
8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe
Resource
win10v2004-20250314-en
General
-
Target
8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe
-
Size
644KB
-
MD5
f125be2430fa6fa2160adfcf0f148af3
-
SHA1
16d12e95770066d022f7c137053af7a47c53a153
-
SHA256
8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178
-
SHA512
f8cafa66842a3aa5948447de9c061f48282d3e2a7c14b9f476dde16170b177b3e17997d1fc4c2671e73bbd3d29461a64c5cd11c1bd2bc27f91b6e15cdea140b3
-
SSDEEP
12288:9dD0MqyNQJc5zS+CzHRSHUMGLKp4Q7bqMavwuFzK4BsWk7Ahc:9dDcjJO+xL4vIQ7b/7gK4mWkN
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2976 schtasks.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2300 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2408 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2156 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2968 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2816 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2892 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2892 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2876 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2876 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2924 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 3048 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2728 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2828 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2828 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2748 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2700 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2700 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2736 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2812 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2024 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2024 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2296 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1620 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1620 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1644 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1032 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2868 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 3032 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1424 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2108 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1680 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1680 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2604 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1492 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2940 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2996 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 3036 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2992 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1272 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2308 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1976 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1976 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1612 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1740 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1740 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2184 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2184 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2452 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1720 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1720 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2516 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2260 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2416 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2128 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2180 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2060 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1468 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1468 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2420 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1540 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1540 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 1144 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 2232 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2524 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 29 PID 2280 wrote to memory of 2524 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 29 PID 2280 wrote to memory of 2524 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 29 PID 2280 wrote to memory of 2524 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 29 PID 2524 wrote to memory of 2976 2524 cmd.exe 32 PID 2524 wrote to memory of 2976 2524 cmd.exe 32 PID 2524 wrote to memory of 2976 2524 cmd.exe 32 PID 2524 wrote to memory of 2976 2524 cmd.exe 32 PID 2280 wrote to memory of 2116 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 31 PID 2280 wrote to memory of 2116 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 31 PID 2280 wrote to memory of 2116 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 31 PID 2280 wrote to memory of 2116 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 31 PID 2280 wrote to memory of 2116 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 31 PID 2280 wrote to memory of 2300 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 33 PID 2280 wrote to memory of 2300 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 33 PID 2280 wrote to memory of 2300 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 33 PID 2280 wrote to memory of 2300 2280 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 33 PID 2300 wrote to memory of 2172 2300 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 34 PID 2300 wrote to memory of 2172 2300 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 34 PID 2300 wrote to memory of 2172 2300 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 34 PID 2300 wrote to memory of 2172 2300 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 34 PID 2300 wrote to memory of 2172 2300 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 34 PID 2300 wrote to memory of 2408 2300 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 35 PID 2300 wrote to memory of 2408 2300 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 35 PID 2300 wrote to memory of 2408 2300 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 35 PID 2300 wrote to memory of 2408 2300 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 35 PID 2408 wrote to memory of 2512 2408 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 36 PID 2408 wrote to memory of 2512 2408 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 36 PID 2408 wrote to memory of 2512 2408 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 36 PID 2408 wrote to memory of 2512 2408 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 36 PID 2408 wrote to memory of 2512 2408 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 36 PID 2408 wrote to memory of 2156 2408 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 37 PID 2408 wrote to memory of 2156 2408 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 37 PID 2408 wrote to memory of 2156 2408 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 37 PID 2408 wrote to memory of 2156 2408 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 37 PID 2156 wrote to memory of 2820 2156 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 38 PID 2156 wrote to memory of 2820 2156 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 38 PID 2156 wrote to memory of 2820 2156 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 38 PID 2156 wrote to memory of 2820 2156 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 38 PID 2156 wrote to memory of 2820 2156 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 38 PID 2156 wrote to memory of 2968 2156 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 39 PID 2156 wrote to memory of 2968 2156 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 39 PID 2156 wrote to memory of 2968 2156 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 39 PID 2156 wrote to memory of 2968 2156 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 39 PID 2968 wrote to memory of 2796 2968 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 40 PID 2968 wrote to memory of 2796 2968 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 40 PID 2968 wrote to memory of 2796 2968 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 40 PID 2968 wrote to memory of 2796 2968 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 40 PID 2968 wrote to memory of 2796 2968 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 40 PID 2968 wrote to memory of 2816 2968 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 41 PID 2968 wrote to memory of 2816 2968 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 41 PID 2968 wrote to memory of 2816 2968 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 41 PID 2968 wrote to memory of 2816 2968 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 41 PID 2816 wrote to memory of 2888 2816 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 42 PID 2816 wrote to memory of 2888 2816 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 42 PID 2816 wrote to memory of 2888 2816 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 42 PID 2816 wrote to memory of 2888 2816 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 42 PID 2816 wrote to memory of 2888 2816 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 42 PID 2816 wrote to memory of 2892 2816 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 43 PID 2816 wrote to memory of 2892 2816 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 43 PID 2816 wrote to memory of 2892 2816 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 43 PID 2816 wrote to memory of 2892 2816 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 43 PID 2892 wrote to memory of 2228 2892 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 44 PID 2892 wrote to memory of 2228 2892 8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\cmd.execmd /c schtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\d71d733395be48288bbc78c852fcd1cf.xml"2⤵
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /TN name /XML "C:\Users\Admin\AppData\Local\Temp\d71d733395be48288bbc78c852fcd1cf.xml"3⤵
- Scheduled Task/Job: Scheduled Task
PID:2976
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2116
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵PID:2172
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2408 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"4⤵PID:2512
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"5⤵PID:2820
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"6⤵PID:2796
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"7⤵PID:2888
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2892 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"8⤵PID:2228
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"8⤵
- Suspicious behavior: MapViewOfSection
PID:2876 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"9⤵PID:2808
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"9⤵
- Suspicious behavior: MapViewOfSection
PID:2924 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"10⤵PID:2224
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"10⤵
- Suspicious behavior: MapViewOfSection
PID:3048 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"11⤵PID:2716
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"11⤵
- Suspicious behavior: MapViewOfSection
PID:2728 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"12⤵PID:1712
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"12⤵
- Suspicious behavior: MapViewOfSection
PID:2828 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"13⤵PID:2804
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"13⤵
- Suspicious behavior: MapViewOfSection
PID:2748 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"14⤵PID:2692
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"14⤵
- Suspicious behavior: MapViewOfSection
PID:2700 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"15⤵PID:896
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"15⤵
- Suspicious behavior: MapViewOfSection
PID:2736 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"16⤵PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"16⤵
- Suspicious behavior: MapViewOfSection
PID:2812 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"17⤵PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"17⤵
- Suspicious behavior: MapViewOfSection
PID:2024 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"18⤵PID:2236
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"18⤵
- Suspicious behavior: MapViewOfSection
PID:2296 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"19⤵PID:1656
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"19⤵
- Suspicious behavior: MapViewOfSection
PID:1620 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"20⤵PID:2056
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"20⤵
- Suspicious behavior: MapViewOfSection
PID:1644 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"21⤵PID:2032
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"21⤵
- Suspicious behavior: MapViewOfSection
PID:1032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"22⤵PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"22⤵
- Suspicious behavior: MapViewOfSection
PID:2868 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"23⤵PID:2760
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"23⤵
- Suspicious behavior: MapViewOfSection
PID:3032 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"24⤵PID:1576
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"24⤵
- Suspicious behavior: MapViewOfSection
PID:1424 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"25⤵PID:2588
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"25⤵
- Suspicious behavior: MapViewOfSection
PID:2108 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"26⤵PID:3008
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"26⤵
- Suspicious behavior: MapViewOfSection
PID:1680 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"27⤵PID:2504
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"27⤵
- Suspicious behavior: MapViewOfSection
PID:2604 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"28⤵PID:948
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"28⤵
- Suspicious behavior: MapViewOfSection
PID:1492 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"29⤵PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"29⤵
- Suspicious behavior: MapViewOfSection
PID:2940 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"30⤵PID:1464
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"30⤵
- Suspicious behavior: MapViewOfSection
PID:2996 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"31⤵PID:3044
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"31⤵
- Suspicious behavior: MapViewOfSection
PID:3036 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"32⤵PID:2944
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"32⤵
- Suspicious behavior: MapViewOfSection
PID:2992 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"33⤵PID:1020
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"33⤵
- Suspicious behavior: MapViewOfSection
PID:1272 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"34⤵PID:856
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"34⤵
- Suspicious behavior: MapViewOfSection
PID:2308 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"35⤵PID:1984
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"35⤵
- Suspicious behavior: MapViewOfSection
PID:1976 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"36⤵PID:700
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"36⤵
- Suspicious behavior: MapViewOfSection
PID:1612 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"37⤵PID:1824
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"37⤵
- Suspicious behavior: MapViewOfSection
PID:1740 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"38⤵PID:784
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"38⤵
- Suspicious behavior: MapViewOfSection
PID:2184 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"39⤵PID:2660
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"39⤵
- Suspicious behavior: MapViewOfSection
PID:2452 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"40⤵PID:2208
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"40⤵
- Suspicious behavior: MapViewOfSection
PID:1720 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"41⤵PID:2584
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"41⤵
- Suspicious behavior: MapViewOfSection
PID:2516 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"42⤵PID:2544
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"42⤵
- Suspicious behavior: MapViewOfSection
PID:2260 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"43⤵PID:2276
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"43⤵
- Suspicious behavior: MapViewOfSection
PID:2416 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"44⤵PID:2268
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"44⤵
- Suspicious behavior: MapViewOfSection
PID:2128 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"45⤵PID:2132
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"45⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:2180 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"46⤵PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"46⤵
- Suspicious behavior: MapViewOfSection
PID:2060 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"47⤵PID:808
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"47⤵
- Suspicious behavior: MapViewOfSection
PID:1468 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"48⤵PID:840
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"48⤵
- Suspicious behavior: MapViewOfSection
PID:2420 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"49⤵PID:2600
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"49⤵
- Suspicious behavior: MapViewOfSection
PID:1540 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"50⤵PID:1828
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"50⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
PID:1144 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"51⤵PID:2240
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"51⤵
- Suspicious behavior: MapViewOfSection
PID:2232 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"52⤵PID:2272
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"52⤵PID:1100
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"53⤵PID:2652
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"53⤵PID:1968
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"54⤵PID:964
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"54⤵PID:1548
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"55⤵PID:1496
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"55⤵PID:1796
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"56⤵PID:276
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"56⤵PID:1900
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"57⤵PID:2616
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"57⤵PID:1096
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"58⤵PID:752
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"58⤵PID:1696
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"59⤵PID:1700
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"59⤵PID:2564
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"60⤵PID:1160
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"60⤵PID:828
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"61⤵PID:1528
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"61⤵PID:2220
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"62⤵PID:932
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"62⤵PID:588
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"63⤵PID:576
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"63⤵PID:2484
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"64⤵PID:2644
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"64⤵PID:2040
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"65⤵PID:1912
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"65⤵PID:2636
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"66⤵PID:2340
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"66⤵PID:1512
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"67⤵PID:2520
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"67⤵PID:2608
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"68⤵PID:2264
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"68⤵PID:1672
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"69⤵PID:2080
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"69⤵PID:2344
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"70⤵PID:2376
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"70⤵PID:2656
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"71⤵PID:2548
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"71⤵PID:2028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"72⤵PID:1600
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"72⤵PID:1260
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"73⤵PID:2532
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"73⤵PID:1176
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"74⤵PID:2172
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"74⤵PID:2300
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"75⤵PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"75⤵PID:2424
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"76⤵PID:2948
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"76⤵PID:2820
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"77⤵PID:1372
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"77⤵PID:2844
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"78⤵PID:2148
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"78⤵PID:2008
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"79⤵PID:2960
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"79⤵PID:844
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"80⤵PID:1244
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"80⤵PID:2524
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"81⤵PID:2560
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"81⤵PID:2824
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"82⤵PID:2852
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"82⤵PID:2972
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"83⤵PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"83⤵PID:2884
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"84⤵PID:2712
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"84⤵PID:3056
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"85⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"85⤵PID:2928
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"86⤵PID:2920
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"86⤵PID:2732
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"87⤵PID:2684
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"87⤵PID:2036
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"88⤵PID:2708
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"88⤵PID:896
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"89⤵PID:2764
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"89⤵PID:2756
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"90⤵PID:568
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"90⤵PID:2288
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"91⤵PID:2284
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"91⤵PID:2744
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"92⤵PID:1116
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"92⤵PID:2176
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"93⤵PID:2056
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"93⤵PID:2672
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"94⤵PID:2032
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"94⤵PID:1644
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"95⤵PID:1524
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"95⤵PID:1032
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"96⤵PID:2760
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"96⤵PID:2868
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"97⤵PID:516
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"97⤵PID:1788
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"98⤵PID:2588
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"98⤵PID:2092
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"99⤵PID:3008
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"99⤵PID:2312
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"100⤵PID:2504
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"100⤵PID:872
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"101⤵PID:1472
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"101⤵PID:2552
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"102⤵PID:816
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"102⤵PID:2740
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"103⤵PID:2988
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"103⤵PID:3012
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"104⤵PID:236
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"104⤵PID:3044
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"105⤵PID:2984
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"105⤵PID:3028
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"106⤵PID:3040
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"106⤵PID:1020
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"107⤵PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"107⤵PID:856
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"108⤵PID:652
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"108⤵PID:2308
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"109⤵PID:1920
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"109⤵PID:1816
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"110⤵PID:1824
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"110⤵PID:1632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"111⤵PID:784
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"111⤵PID:1740
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"112⤵PID:584
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"112⤵PID:320
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"113⤵PID:2208
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"113⤵PID:2448
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"114⤵PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"114⤵PID:2508
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"115⤵PID:2544
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"115⤵PID:2540
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"116⤵PID:2276
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"116⤵PID:2260
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"117⤵PID:2136
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"117⤵PID:1996
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"118⤵PID:592
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"118⤵PID:2140
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"119⤵PID:2436
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"119⤵PID:952
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"120⤵PID:1624
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"120⤵PID:2788
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"121⤵PID:2592
-
-
C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"C:\Users\Admin\AppData\Local\Temp\8c27edb9a77712a4e13e8133f233ba34d7182e7823d0408fd12da11c91f94178.exe"121⤵PID:708
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"122⤵PID:2600
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-