Analysis
-
max time kernel
151s -
max time network
6s -
platform
windows7_x64 -
resource
win7 -
submitted
24-06-2020 15:09
Static task
static1
Behavioral task
behavioral1
Sample
proforma invoice.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
proforma invoice.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
proforma invoice.exe
-
Size
426KB
-
MD5
9e589779b1777914e2fd220aa90841c1
-
SHA1
94d8313b3769e059e11a73c122204f229403e823
-
SHA256
6f03cb7c4d22e4580f919f348c2f35ec39efff0ac267c0e39833baf906c6bc06
-
SHA512
e3e8eb235e898e5c413abc9faab86817bb65b3435f01895a4499c2e575a2dd9de8cdd94c3ffa24caeaeef8a6aa35012cfc078ba2c37804cbc62385a83f333379
Score
7/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 4509 IoCs
Processes:
proforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exedescription pid process target process PID 616 wrote to memory of 1420 616 proforma invoice.exe RegAsm.exe PID 616 wrote to memory of 1420 616 proforma invoice.exe RegAsm.exe PID 616 wrote to memory of 1420 616 proforma invoice.exe RegAsm.exe PID 616 wrote to memory of 1420 616 proforma invoice.exe RegAsm.exe PID 616 wrote to memory of 1420 616 proforma invoice.exe RegAsm.exe PID 616 wrote to memory of 1420 616 proforma invoice.exe RegAsm.exe PID 616 wrote to memory of 1420 616 proforma invoice.exe RegAsm.exe PID 616 wrote to memory of 1420 616 proforma invoice.exe RegAsm.exe PID 616 wrote to memory of 1612 616 proforma invoice.exe proforma invoice.exe PID 616 wrote to memory of 1612 616 proforma invoice.exe proforma invoice.exe PID 616 wrote to memory of 1612 616 proforma invoice.exe proforma invoice.exe PID 616 wrote to memory of 1612 616 proforma invoice.exe proforma invoice.exe PID 1612 wrote to memory of 748 1612 proforma invoice.exe RegAsm.exe PID 1612 wrote to memory of 748 1612 proforma invoice.exe RegAsm.exe PID 1612 wrote to memory of 748 1612 proforma invoice.exe RegAsm.exe PID 1612 wrote to memory of 748 1612 proforma invoice.exe RegAsm.exe PID 1612 wrote to memory of 748 1612 proforma invoice.exe RegAsm.exe PID 1612 wrote to memory of 748 1612 proforma invoice.exe RegAsm.exe PID 1612 wrote to memory of 748 1612 proforma invoice.exe RegAsm.exe PID 1612 wrote to memory of 748 1612 proforma invoice.exe RegAsm.exe PID 1612 wrote to memory of 1524 1612 proforma invoice.exe proforma invoice.exe PID 1612 wrote to memory of 1524 1612 proforma invoice.exe proforma invoice.exe PID 1612 wrote to memory of 1524 1612 proforma invoice.exe proforma invoice.exe PID 1612 wrote to memory of 1524 1612 proforma invoice.exe proforma invoice.exe PID 1524 wrote to memory of 1404 1524 proforma invoice.exe RegAsm.exe PID 1524 wrote to memory of 1404 1524 proforma invoice.exe RegAsm.exe PID 1524 wrote to memory of 1404 1524 proforma invoice.exe RegAsm.exe PID 1524 wrote to memory of 1404 1524 proforma invoice.exe RegAsm.exe PID 1524 wrote to memory of 1404 1524 proforma invoice.exe RegAsm.exe PID 1524 wrote to memory of 1404 1524 proforma invoice.exe RegAsm.exe PID 1524 wrote to memory of 1404 1524 proforma invoice.exe RegAsm.exe PID 1524 wrote to memory of 1404 1524 proforma invoice.exe RegAsm.exe PID 1524 wrote to memory of 1856 1524 proforma invoice.exe proforma invoice.exe PID 1524 wrote to memory of 1856 1524 proforma invoice.exe proforma invoice.exe PID 1524 wrote to memory of 1856 1524 proforma invoice.exe proforma invoice.exe PID 1524 wrote to memory of 1856 1524 proforma invoice.exe proforma invoice.exe PID 1856 wrote to memory of 1184 1856 proforma invoice.exe RegAsm.exe PID 1856 wrote to memory of 1184 1856 proforma invoice.exe RegAsm.exe PID 1856 wrote to memory of 1184 1856 proforma invoice.exe RegAsm.exe PID 1856 wrote to memory of 1184 1856 proforma invoice.exe RegAsm.exe PID 1856 wrote to memory of 1184 1856 proforma invoice.exe RegAsm.exe PID 1856 wrote to memory of 1184 1856 proforma invoice.exe RegAsm.exe PID 1856 wrote to memory of 1184 1856 proforma invoice.exe RegAsm.exe PID 1856 wrote to memory of 1184 1856 proforma invoice.exe RegAsm.exe PID 1856 wrote to memory of 1680 1856 proforma invoice.exe proforma invoice.exe PID 1856 wrote to memory of 1680 1856 proforma invoice.exe proforma invoice.exe PID 1856 wrote to memory of 1680 1856 proforma invoice.exe proforma invoice.exe PID 1856 wrote to memory of 1680 1856 proforma invoice.exe proforma invoice.exe PID 1680 wrote to memory of 1584 1680 proforma invoice.exe RegAsm.exe PID 1680 wrote to memory of 1584 1680 proforma invoice.exe RegAsm.exe PID 1680 wrote to memory of 1584 1680 proforma invoice.exe RegAsm.exe PID 1680 wrote to memory of 1584 1680 proforma invoice.exe RegAsm.exe PID 1680 wrote to memory of 1584 1680 proforma invoice.exe RegAsm.exe PID 1680 wrote to memory of 1584 1680 proforma invoice.exe RegAsm.exe PID 1680 wrote to memory of 1584 1680 proforma invoice.exe RegAsm.exe PID 1680 wrote to memory of 1584 1680 proforma invoice.exe RegAsm.exe PID 1680 wrote to memory of 1616 1680 proforma invoice.exe proforma invoice.exe PID 1680 wrote to memory of 1616 1680 proforma invoice.exe proforma invoice.exe PID 1680 wrote to memory of 1616 1680 proforma invoice.exe proforma invoice.exe PID 1680 wrote to memory of 1616 1680 proforma invoice.exe proforma invoice.exe PID 1616 wrote to memory of 1916 1616 proforma invoice.exe RegAsm.exe PID 1616 wrote to memory of 1916 1616 proforma invoice.exe RegAsm.exe PID 1616 wrote to memory of 1916 1616 proforma invoice.exe RegAsm.exe PID 1616 wrote to memory of 1916 1616 proforma invoice.exe RegAsm.exe -
Suspicious behavior: MapViewOfSection 394 IoCs
Processes:
proforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exepid process 616 proforma invoice.exe 1612 proforma invoice.exe 1524 proforma invoice.exe 1856 proforma invoice.exe 1680 proforma invoice.exe 1616 proforma invoice.exe 1988 proforma invoice.exe 1484 proforma invoice.exe 1804 proforma invoice.exe 288 proforma invoice.exe 1836 proforma invoice.exe 1884 proforma invoice.exe 1680 proforma invoice.exe 1212 proforma invoice.exe 1340 proforma invoice.exe 1780 proforma invoice.exe 1612 proforma invoice.exe 1580 proforma invoice.exe 1884 proforma invoice.exe 1812 proforma invoice.exe 1812 proforma invoice.exe 1812 proforma invoice.exe 1340 proforma invoice.exe 328 proforma invoice.exe 1804 proforma invoice.exe 2040 proforma invoice.exe 1780 proforma invoice.exe 1576 proforma invoice.exe 1520 proforma invoice.exe 1904 proforma invoice.exe 1532 proforma invoice.exe 1404 proforma invoice.exe 1404 proforma invoice.exe 1356 proforma invoice.exe 1356 proforma invoice.exe 828 proforma invoice.exe 1612 proforma invoice.exe 1612 proforma invoice.exe 1544 proforma invoice.exe 1988 proforma invoice.exe 564 proforma invoice.exe 1812 proforma invoice.exe 1916 proforma invoice.exe 324 proforma invoice.exe 1584 proforma invoice.exe 1792 proforma invoice.exe 1408 proforma invoice.exe 1624 proforma invoice.exe 1060 proforma invoice.exe 1948 proforma invoice.exe 1428 proforma invoice.exe 1916 proforma invoice.exe 1560 proforma invoice.exe 1356 proforma invoice.exe 1356 proforma invoice.exe 1564 proforma invoice.exe 2088 proforma invoice.exe 2180 proforma invoice.exe 2260 proforma invoice.exe 2348 proforma invoice.exe 2428 proforma invoice.exe 2508 proforma invoice.exe 2508 proforma invoice.exe 2628 proforma invoice.exe -
Suspicious use of SetThreadContext 351 IoCs
Processes:
proforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exedescription pid process target process PID 616 set thread context of 1420 616 proforma invoice.exe RegAsm.exe PID 1612 set thread context of 748 1612 proforma invoice.exe RegAsm.exe PID 1524 set thread context of 1404 1524 proforma invoice.exe RegAsm.exe PID 1856 set thread context of 1184 1856 proforma invoice.exe RegAsm.exe PID 1680 set thread context of 1584 1680 proforma invoice.exe RegAsm.exe PID 1616 set thread context of 1916 1616 proforma invoice.exe RegAsm.exe PID 1988 set thread context of 2024 1988 proforma invoice.exe RegAsm.exe PID 1484 set thread context of 1428 1484 proforma invoice.exe RegAsm.exe PID 1804 set thread context of 864 1804 proforma invoice.exe RegAsm.exe PID 288 set thread context of 1768 288 proforma invoice.exe RegAsm.exe PID 1836 set thread context of 1936 1836 proforma invoice.exe RegAsm.exe PID 1884 set thread context of 1912 1884 proforma invoice.exe RegAsm.exe PID 1680 set thread context of 1440 1680 proforma invoice.exe RegAsm.exe PID 1212 set thread context of 1960 1212 proforma invoice.exe RegAsm.exe PID 1340 set thread context of 1640 1340 proforma invoice.exe RegAsm.exe PID 1780 set thread context of 792 1780 proforma invoice.exe RegAsm.exe PID 1612 set thread context of 1972 1612 proforma invoice.exe RegAsm.exe PID 1580 set thread context of 1908 1580 proforma invoice.exe RegAsm.exe PID 1884 set thread context of 1472 1884 proforma invoice.exe RegAsm.exe PID 1812 set thread context of 240 1812 proforma invoice.exe RegAsm.exe PID 1340 set thread context of 1328 1340 proforma invoice.exe RegAsm.exe PID 328 set thread context of 288 328 proforma invoice.exe RegAsm.exe PID 1804 set thread context of 1168 1804 proforma invoice.exe RegAsm.exe PID 2040 set thread context of 564 2040 proforma invoice.exe RegAsm.exe PID 1780 set thread context of 1340 1780 proforma invoice.exe RegAsm.exe PID 1576 set thread context of 1092 1576 proforma invoice.exe RegAsm.exe PID 1520 set thread context of 1548 1520 proforma invoice.exe RegAsm.exe PID 1904 set thread context of 1644 1904 proforma invoice.exe RegAsm.exe PID 1532 set thread context of 1784 1532 proforma invoice.exe RegAsm.exe PID 1404 set thread context of 1640 1404 proforma invoice.exe RegAsm.exe PID 1356 set thread context of 1636 1356 proforma invoice.exe RegAsm.exe PID 828 set thread context of 736 828 proforma invoice.exe RegAsm.exe PID 1612 set thread context of 688 1612 proforma invoice.exe RegAsm.exe PID 1544 set thread context of 680 1544 proforma invoice.exe RegAsm.exe PID 1988 set thread context of 1484 1988 proforma invoice.exe RegAsm.exe PID 564 set thread context of 1944 564 proforma invoice.exe RegAsm.exe PID 1812 set thread context of 1328 1812 proforma invoice.exe RegAsm.exe PID 1916 set thread context of 912 1916 proforma invoice.exe RegAsm.exe PID 324 set thread context of 1888 324 proforma invoice.exe RegAsm.exe PID 1584 set thread context of 764 1584 proforma invoice.exe RegAsm.exe PID 1792 set thread context of 1952 1792 proforma invoice.exe RegAsm.exe PID 1408 set thread context of 1768 1408 proforma invoice.exe RegAsm.exe PID 1624 set thread context of 1612 1624 proforma invoice.exe RegAsm.exe PID 1060 set thread context of 1816 1060 proforma invoice.exe RegAsm.exe PID 1948 set thread context of 1620 1948 proforma invoice.exe RegAsm.exe PID 1428 set thread context of 1804 1428 proforma invoice.exe RegAsm.exe PID 1916 set thread context of 1076 1916 proforma invoice.exe RegAsm.exe PID 1560 set thread context of 1780 1560 proforma invoice.exe RegAsm.exe PID 1356 set thread context of 1428 1356 proforma invoice.exe RegAsm.exe PID 1564 set thread context of 1988 1564 proforma invoice.exe RegAsm.exe PID 2088 set thread context of 2124 2088 proforma invoice.exe RegAsm.exe PID 2180 set thread context of 2208 2180 proforma invoice.exe RegAsm.exe PID 2260 set thread context of 2288 2260 proforma invoice.exe RegAsm.exe PID 2348 set thread context of 2376 2348 proforma invoice.exe RegAsm.exe PID 2428 set thread context of 2456 2428 proforma invoice.exe RegAsm.exe PID 2508 set thread context of 2576 2508 proforma invoice.exe RegAsm.exe PID 2628 set thread context of 2656 2628 proforma invoice.exe RegAsm.exe PID 2716 set thread context of 2744 2716 proforma invoice.exe RegAsm.exe PID 2796 set thread context of 2824 2796 proforma invoice.exe RegAsm.exe PID 2868 set thread context of 2908 2868 proforma invoice.exe RegAsm.exe PID 2956 set thread context of 2992 2956 proforma invoice.exe RegAsm.exe PID 3048 set thread context of 2056 3048 proforma invoice.exe RegAsm.exe PID 324 set thread context of 1960 324 proforma invoice.exe RegAsm.exe PID 2228 set thread context of 1564 2228 proforma invoice.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 363 IoCs
Processes:
proforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeRegAsm.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeRegAsm.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exedescription pid process Token: SeDebugPrivilege 616 proforma invoice.exe Token: SeDebugPrivilege 1612 proforma invoice.exe Token: SeDebugPrivilege 1524 proforma invoice.exe Token: SeDebugPrivilege 1856 proforma invoice.exe Token: SeDebugPrivilege 1680 proforma invoice.exe Token: SeDebugPrivilege 1616 proforma invoice.exe Token: SeDebugPrivilege 1988 proforma invoice.exe Token: SeDebugPrivilege 1484 proforma invoice.exe Token: SeDebugPrivilege 1804 proforma invoice.exe Token: SeDebugPrivilege 288 proforma invoice.exe Token: SeDebugPrivilege 1836 proforma invoice.exe Token: SeDebugPrivilege 1884 proforma invoice.exe Token: SeDebugPrivilege 1680 proforma invoice.exe Token: SeDebugPrivilege 1212 proforma invoice.exe Token: SeDebugPrivilege 1340 proforma invoice.exe Token: SeDebugPrivilege 1780 proforma invoice.exe Token: SeDebugPrivilege 1612 proforma invoice.exe Token: SeDebugPrivilege 1580 proforma invoice.exe Token: SeDebugPrivilege 1884 proforma invoice.exe Token: SeDebugPrivilege 1812 proforma invoice.exe Token: SeDebugPrivilege 1340 proforma invoice.exe Token: SeDebugPrivilege 328 proforma invoice.exe Token: SeDebugPrivilege 1804 proforma invoice.exe Token: SeDebugPrivilege 2040 proforma invoice.exe Token: SeDebugPrivilege 1420 RegAsm.exe Token: SeDebugPrivilege 1780 proforma invoice.exe Token: SeDebugPrivilege 1576 proforma invoice.exe Token: SeDebugPrivilege 1520 proforma invoice.exe Token: SeDebugPrivilege 1904 proforma invoice.exe Token: SeDebugPrivilege 1532 proforma invoice.exe Token: SeDebugPrivilege 1404 proforma invoice.exe Token: SeDebugPrivilege 1356 proforma invoice.exe Token: SeDebugPrivilege 828 proforma invoice.exe Token: SeDebugPrivilege 1612 proforma invoice.exe Token: SeDebugPrivilege 1544 proforma invoice.exe Token: SeDebugPrivilege 1988 proforma invoice.exe Token: SeDebugPrivilege 564 proforma invoice.exe Token: SeDebugPrivilege 1812 proforma invoice.exe Token: SeDebugPrivilege 1916 proforma invoice.exe Token: SeDebugPrivilege 324 proforma invoice.exe Token: SeDebugPrivilege 1584 proforma invoice.exe Token: SeDebugPrivilege 1792 proforma invoice.exe Token: SeDebugPrivilege 1408 proforma invoice.exe Token: SeDebugPrivilege 1624 proforma invoice.exe Token: SeDebugPrivilege 1060 proforma invoice.exe Token: SeDebugPrivilege 1948 proforma invoice.exe Token: SeDebugPrivilege 1428 proforma invoice.exe Token: SeDebugPrivilege 1916 proforma invoice.exe Token: SeDebugPrivilege 1560 proforma invoice.exe Token: SeDebugPrivilege 1356 proforma invoice.exe Token: SeDebugPrivilege 1564 proforma invoice.exe Token: SeDebugPrivilege 2088 proforma invoice.exe Token: SeDebugPrivilege 2180 proforma invoice.exe Token: SeDebugPrivilege 2260 proforma invoice.exe Token: SeDebugPrivilege 2348 proforma invoice.exe Token: SeDebugPrivilege 2428 proforma invoice.exe Token: SeDebugPrivilege 1340 RegAsm.exe Token: SeDebugPrivilege 2508 proforma invoice.exe Token: SeDebugPrivilege 2628 proforma invoice.exe Token: SeDebugPrivilege 2716 proforma invoice.exe Token: SeDebugPrivilege 2796 proforma invoice.exe Token: SeDebugPrivilege 2868 proforma invoice.exe Token: SeDebugPrivilege 2956 proforma invoice.exe Token: SeDebugPrivilege 3048 proforma invoice.exe -
Suspicious behavior: EnumeratesProcesses 54649 IoCs
Processes:
proforma invoice.exepid process 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe 616 proforma invoice.exe -
Drops startup file 2 IoCs
Processes:
proforma invoice.exeproforma invoice.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe proforma invoice.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe proforma invoice.exe -
Adds Run entry to start application 2 TTPs 11 IoCs
Processes:
RegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Drops startup file
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"5⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"6⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"18⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"19⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"20⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"21⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"22⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"23⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"24⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"25⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"26⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"27⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"28⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"29⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"30⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"31⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"32⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"33⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"34⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"35⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"36⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"37⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"38⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"39⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"40⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"41⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"42⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"43⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"44⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"45⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"46⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"47⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"48⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"49⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"50⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"51⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"52⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"53⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"54⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"55⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"56⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"57⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"58⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"62⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"63⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"64⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"68⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"74⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"78⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"83⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"84⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"93⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"98⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"99⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"105⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"106⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"107⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"108⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"109⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"110⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"114⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"115⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"118⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"120⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"121⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"124⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"126⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"126⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"127⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"130⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"130⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"131⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"132⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"133⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"133⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"138⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"138⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"139⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"141⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"141⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"141⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"142⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"142⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"143⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"143⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"146⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"146⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"147⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"147⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"148⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"149⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"149⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"150⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"150⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"151⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"151⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"152⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"152⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"153⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"153⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"154⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"155⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"155⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"156⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"156⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"157⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"158⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"159⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"161⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"161⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"162⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"162⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"163⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"163⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"164⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"164⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"165⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"165⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"166⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"166⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"167⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"167⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"168⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"168⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"169⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"169⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"170⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"170⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"171⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"171⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"172⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"172⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"173⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"173⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"174⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"174⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"175⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"175⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"176⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"176⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"177⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"178⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"178⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"179⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"179⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"180⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"180⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"181⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"181⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"182⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"182⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"183⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"184⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"184⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"185⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"186⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"187⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"187⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"188⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"188⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"188⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"188⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"189⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"190⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"190⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"191⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"191⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"192⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"192⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"193⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"194⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"195⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"195⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"195⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"196⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"196⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"197⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"197⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"198⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"198⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"199⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"200⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"200⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"201⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"202⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"203⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"203⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"203⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"205⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"205⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"206⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"206⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"206⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"207⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"207⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"208⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"209⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"209⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"210⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"210⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"211⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"211⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"212⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"212⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"213⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"213⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"214⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"214⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"215⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"215⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"216⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"216⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"217⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"217⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"218⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"218⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"219⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"219⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"220⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"220⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"222⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"222⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"223⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"223⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"224⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"224⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"225⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"225⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"226⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"226⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"227⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"227⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"228⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"228⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"228⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"229⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"229⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"229⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"230⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"230⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"231⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"231⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"233⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"233⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"234⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"234⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"234⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"235⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"235⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"236⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"236⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"237⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"237⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"238⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"238⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"239⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"239⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"240⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"240⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"241⤵