Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
24-06-2020 15:09
Static task
static1
Behavioral task
behavioral1
Sample
proforma invoice.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
proforma invoice.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
proforma invoice.exe
-
Size
426KB
-
MD5
9e589779b1777914e2fd220aa90841c1
-
SHA1
94d8313b3769e059e11a73c122204f229403e823
-
SHA256
6f03cb7c4d22e4580f919f348c2f35ec39efff0ac267c0e39833baf906c6bc06
-
SHA512
e3e8eb235e898e5c413abc9faab86817bb65b3435f01895a4499c2e575a2dd9de8cdd94c3ffa24caeaeef8a6aa35012cfc078ba2c37804cbc62385a83f333379
Score
7/10
Malware Config
Signatures
-
Drops startup file 2 IoCs
Processes:
proforma invoice.exeproforma invoice.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe proforma invoice.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe proforma invoice.exe -
Suspicious use of WriteProcessMemory 2069 IoCs
Processes:
proforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exedescription pid process target process PID 644 wrote to memory of 1916 644 proforma invoice.exe RegAsm.exe PID 644 wrote to memory of 1916 644 proforma invoice.exe RegAsm.exe PID 644 wrote to memory of 1916 644 proforma invoice.exe RegAsm.exe PID 644 wrote to memory of 1916 644 proforma invoice.exe RegAsm.exe PID 644 wrote to memory of 2424 644 proforma invoice.exe proforma invoice.exe PID 644 wrote to memory of 2424 644 proforma invoice.exe proforma invoice.exe PID 644 wrote to memory of 2424 644 proforma invoice.exe proforma invoice.exe PID 2424 wrote to memory of 3792 2424 proforma invoice.exe RegAsm.exe PID 2424 wrote to memory of 3792 2424 proforma invoice.exe RegAsm.exe PID 2424 wrote to memory of 3792 2424 proforma invoice.exe RegAsm.exe PID 2424 wrote to memory of 3436 2424 proforma invoice.exe RegAsm.exe PID 2424 wrote to memory of 3436 2424 proforma invoice.exe RegAsm.exe PID 2424 wrote to memory of 3436 2424 proforma invoice.exe RegAsm.exe PID 2424 wrote to memory of 3436 2424 proforma invoice.exe RegAsm.exe PID 2424 wrote to memory of 2728 2424 proforma invoice.exe proforma invoice.exe PID 2424 wrote to memory of 2728 2424 proforma invoice.exe proforma invoice.exe PID 2424 wrote to memory of 2728 2424 proforma invoice.exe proforma invoice.exe PID 2728 wrote to memory of 3644 2728 proforma invoice.exe RegAsm.exe PID 2728 wrote to memory of 3644 2728 proforma invoice.exe RegAsm.exe PID 2728 wrote to memory of 3644 2728 proforma invoice.exe RegAsm.exe PID 2728 wrote to memory of 3644 2728 proforma invoice.exe RegAsm.exe PID 2728 wrote to memory of 4024 2728 proforma invoice.exe proforma invoice.exe PID 2728 wrote to memory of 4024 2728 proforma invoice.exe proforma invoice.exe PID 2728 wrote to memory of 4024 2728 proforma invoice.exe proforma invoice.exe PID 4024 wrote to memory of 3800 4024 proforma invoice.exe RegAsm.exe PID 4024 wrote to memory of 3800 4024 proforma invoice.exe RegAsm.exe PID 4024 wrote to memory of 3800 4024 proforma invoice.exe RegAsm.exe PID 4024 wrote to memory of 1700 4024 proforma invoice.exe RegAsm.exe PID 4024 wrote to memory of 1700 4024 proforma invoice.exe RegAsm.exe PID 4024 wrote to memory of 1700 4024 proforma invoice.exe RegAsm.exe PID 4024 wrote to memory of 1700 4024 proforma invoice.exe RegAsm.exe PID 4024 wrote to memory of 800 4024 proforma invoice.exe proforma invoice.exe PID 4024 wrote to memory of 800 4024 proforma invoice.exe proforma invoice.exe PID 4024 wrote to memory of 800 4024 proforma invoice.exe proforma invoice.exe PID 800 wrote to memory of 1648 800 proforma invoice.exe RegAsm.exe PID 800 wrote to memory of 1648 800 proforma invoice.exe RegAsm.exe PID 800 wrote to memory of 1648 800 proforma invoice.exe RegAsm.exe PID 800 wrote to memory of 1648 800 proforma invoice.exe RegAsm.exe PID 800 wrote to memory of 3672 800 proforma invoice.exe proforma invoice.exe PID 800 wrote to memory of 3672 800 proforma invoice.exe proforma invoice.exe PID 800 wrote to memory of 3672 800 proforma invoice.exe proforma invoice.exe PID 3672 wrote to memory of 640 3672 proforma invoice.exe RegAsm.exe PID 3672 wrote to memory of 640 3672 proforma invoice.exe RegAsm.exe PID 3672 wrote to memory of 640 3672 proforma invoice.exe RegAsm.exe PID 3672 wrote to memory of 640 3672 proforma invoice.exe RegAsm.exe PID 3672 wrote to memory of 3512 3672 proforma invoice.exe proforma invoice.exe PID 3672 wrote to memory of 3512 3672 proforma invoice.exe proforma invoice.exe PID 3672 wrote to memory of 3512 3672 proforma invoice.exe proforma invoice.exe PID 3512 wrote to memory of 3744 3512 proforma invoice.exe RegAsm.exe PID 3512 wrote to memory of 3744 3512 proforma invoice.exe RegAsm.exe PID 3512 wrote to memory of 3744 3512 proforma invoice.exe RegAsm.exe PID 3512 wrote to memory of 3764 3512 proforma invoice.exe RegAsm.exe PID 3512 wrote to memory of 3764 3512 proforma invoice.exe RegAsm.exe PID 3512 wrote to memory of 3764 3512 proforma invoice.exe RegAsm.exe PID 3512 wrote to memory of 3764 3512 proforma invoice.exe RegAsm.exe PID 3512 wrote to memory of 2280 3512 proforma invoice.exe proforma invoice.exe PID 3512 wrote to memory of 2280 3512 proforma invoice.exe proforma invoice.exe PID 3512 wrote to memory of 2280 3512 proforma invoice.exe proforma invoice.exe PID 2280 wrote to memory of 804 2280 proforma invoice.exe RegAsm.exe PID 2280 wrote to memory of 804 2280 proforma invoice.exe RegAsm.exe PID 2280 wrote to memory of 804 2280 proforma invoice.exe RegAsm.exe PID 2280 wrote to memory of 804 2280 proforma invoice.exe RegAsm.exe PID 2280 wrote to memory of 848 2280 proforma invoice.exe proforma invoice.exe PID 2280 wrote to memory of 848 2280 proforma invoice.exe proforma invoice.exe -
Suspicious behavior: MapViewOfSection 343 IoCs
Processes:
proforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exepid process 644 proforma invoice.exe 2424 proforma invoice.exe 2424 proforma invoice.exe 2728 proforma invoice.exe 4024 proforma invoice.exe 4024 proforma invoice.exe 800 proforma invoice.exe 3672 proforma invoice.exe 3512 proforma invoice.exe 3512 proforma invoice.exe 2280 proforma invoice.exe 848 proforma invoice.exe 848 proforma invoice.exe 3340 proforma invoice.exe 1260 proforma invoice.exe 3084 proforma invoice.exe 2944 proforma invoice.exe 2944 proforma invoice.exe 2088 proforma invoice.exe 3996 proforma invoice.exe 3816 proforma invoice.exe 4016 proforma invoice.exe 3100 proforma invoice.exe 1264 proforma invoice.exe 1120 proforma invoice.exe 3900 proforma invoice.exe 496 proforma invoice.exe 3104 proforma invoice.exe 3888 proforma invoice.exe 3836 proforma invoice.exe 3392 proforma invoice.exe 1456 proforma invoice.exe 1456 proforma invoice.exe 1052 proforma invoice.exe 1052 proforma invoice.exe 3796 proforma invoice.exe 3796 proforma invoice.exe 3796 proforma invoice.exe 2624 proforma invoice.exe 2112 proforma invoice.exe 2112 proforma invoice.exe 2548 proforma invoice.exe 2748 proforma invoice.exe 3796 proforma invoice.exe 2652 proforma invoice.exe 4028 proforma invoice.exe 1648 proforma invoice.exe 4140 proforma invoice.exe 4240 proforma invoice.exe 4364 proforma invoice.exe 4480 proforma invoice.exe 4480 proforma invoice.exe 4600 proforma invoice.exe 4696 proforma invoice.exe 4792 proforma invoice.exe 4888 proforma invoice.exe 4992 proforma invoice.exe 5088 proforma invoice.exe 4148 proforma invoice.exe 1852 proforma invoice.exe 1336 proforma invoice.exe 4008 proforma invoice.exe 4296 proforma invoice.exe 4296 proforma invoice.exe -
Suspicious use of SetThreadContext 260 IoCs
Processes:
proforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exedescription pid process target process PID 644 set thread context of 1916 644 proforma invoice.exe RegAsm.exe PID 2424 set thread context of 3436 2424 proforma invoice.exe RegAsm.exe PID 2728 set thread context of 3644 2728 proforma invoice.exe RegAsm.exe PID 4024 set thread context of 1700 4024 proforma invoice.exe RegAsm.exe PID 800 set thread context of 1648 800 proforma invoice.exe RegAsm.exe PID 3672 set thread context of 640 3672 proforma invoice.exe RegAsm.exe PID 3512 set thread context of 3764 3512 proforma invoice.exe RegAsm.exe PID 2280 set thread context of 804 2280 proforma invoice.exe RegAsm.exe PID 848 set thread context of 2428 848 proforma invoice.exe RegAsm.exe PID 3340 set thread context of 2828 3340 proforma invoice.exe RegAsm.exe PID 1260 set thread context of 3796 1260 proforma invoice.exe RegAsm.exe PID 3084 set thread context of 800 3084 proforma invoice.exe RegAsm.exe PID 2944 set thread context of 2112 2944 proforma invoice.exe RegAsm.exe PID 2088 set thread context of 3812 2088 proforma invoice.exe RegAsm.exe PID 3996 set thread context of 988 3996 proforma invoice.exe RegAsm.exe PID 3816 set thread context of 3152 3816 proforma invoice.exe RegAsm.exe PID 4016 set thread context of 1260 4016 proforma invoice.exe RegAsm.exe PID 3100 set thread context of 2120 3100 proforma invoice.exe RegAsm.exe PID 1264 set thread context of 1524 1264 proforma invoice.exe RegAsm.exe PID 1120 set thread context of 4024 1120 proforma invoice.exe RegAsm.exe PID 3900 set thread context of 1948 3900 proforma invoice.exe RegAsm.exe PID 496 set thread context of 4032 496 proforma invoice.exe RegAsm.exe PID 3104 set thread context of 3844 3104 proforma invoice.exe RegAsm.exe PID 3888 set thread context of 3512 3888 proforma invoice.exe RegAsm.exe PID 3836 set thread context of 3760 3836 proforma invoice.exe RegAsm.exe PID 3392 set thread context of 2500 3392 proforma invoice.exe RegAsm.exe PID 1456 set thread context of 3764 1456 proforma invoice.exe RegAsm.exe PID 1052 set thread context of 2468 1052 proforma invoice.exe RegAsm.exe PID 3796 set thread context of 3852 3796 proforma invoice.exe RegAsm.exe PID 2624 set thread context of 1676 2624 proforma invoice.exe RegAsm.exe PID 2112 set thread context of 2864 2112 proforma invoice.exe RegAsm.exe PID 2548 set thread context of 1456 2548 proforma invoice.exe RegAsm.exe PID 2748 set thread context of 3064 2748 proforma invoice.exe RegAsm.exe PID 3796 set thread context of 3920 3796 proforma invoice.exe RegAsm.exe PID 2652 set thread context of 1804 2652 proforma invoice.exe RegAsm.exe PID 4028 set thread context of 1120 4028 proforma invoice.exe RegAsm.exe PID 1648 set thread context of 3392 1648 proforma invoice.exe RegAsm.exe PID 4140 set thread context of 4172 4140 proforma invoice.exe RegAsm.exe PID 4240 set thread context of 4272 4240 proforma invoice.exe RegAsm.exe PID 4364 set thread context of 4408 4364 proforma invoice.exe RegAsm.exe PID 4480 set thread context of 4536 4480 proforma invoice.exe RegAsm.exe PID 4600 set thread context of 4632 4600 proforma invoice.exe RegAsm.exe PID 4696 set thread context of 4728 4696 proforma invoice.exe RegAsm.exe PID 4792 set thread context of 4824 4792 proforma invoice.exe RegAsm.exe PID 4888 set thread context of 4928 4888 proforma invoice.exe RegAsm.exe PID 4992 set thread context of 5024 4992 proforma invoice.exe RegAsm.exe PID 5088 set thread context of 1516 5088 proforma invoice.exe RegAsm.exe PID 4148 set thread context of 3676 4148 proforma invoice.exe RegAsm.exe PID 1852 set thread context of 4132 1852 proforma invoice.exe RegAsm.exe PID 1336 set thread context of 2424 1336 proforma invoice.exe RegAsm.exe PID 4008 set thread context of 4172 4008 proforma invoice.exe RegAsm.exe PID 4296 set thread context of 4084 4296 proforma invoice.exe RegAsm.exe PID 1688 set thread context of 2112 1688 proforma invoice.exe RegAsm.exe PID 3764 set thread context of 928 3764 proforma invoice.exe RegAsm.exe PID 4276 set thread context of 4224 4276 proforma invoice.exe RegAsm.exe PID 3096 set thread context of 4544 3096 proforma invoice.exe RegAsm.exe PID 4572 set thread context of 4396 4572 proforma invoice.exe RegAsm.exe PID 4504 set thread context of 4480 4504 proforma invoice.exe RegAsm.exe PID 4684 set thread context of 4700 4684 proforma invoice.exe RegAsm.exe PID 5000 set thread context of 4820 5000 proforma invoice.exe RegAsm.exe PID 4908 set thread context of 4888 4908 proforma invoice.exe RegAsm.exe PID 1648 set thread context of 4016 1648 proforma invoice.exe RegAsm.exe PID 4212 set thread context of 3852 4212 proforma invoice.exe RegAsm.exe PID 2732 set thread context of 3156 2732 proforma invoice.exe RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 272 IoCs
Processes:
proforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeRegAsm.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeRegAsm.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeproforma invoice.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 644 proforma invoice.exe Token: SeDebugPrivilege 2424 proforma invoice.exe Token: SeDebugPrivilege 2728 proforma invoice.exe Token: SeDebugPrivilege 4024 proforma invoice.exe Token: SeDebugPrivilege 800 proforma invoice.exe Token: SeDebugPrivilege 3672 proforma invoice.exe Token: SeDebugPrivilege 3512 proforma invoice.exe Token: SeDebugPrivilege 2280 proforma invoice.exe Token: SeDebugPrivilege 848 proforma invoice.exe Token: SeDebugPrivilege 3340 proforma invoice.exe Token: SeDebugPrivilege 1260 proforma invoice.exe Token: SeDebugPrivilege 3084 proforma invoice.exe Token: SeDebugPrivilege 2944 proforma invoice.exe Token: SeDebugPrivilege 2088 proforma invoice.exe Token: SeDebugPrivilege 3996 proforma invoice.exe Token: SeDebugPrivilege 3816 proforma invoice.exe Token: SeDebugPrivilege 4016 proforma invoice.exe Token: SeDebugPrivilege 1916 RegAsm.exe Token: SeDebugPrivilege 3100 proforma invoice.exe Token: SeDebugPrivilege 1264 proforma invoice.exe Token: SeDebugPrivilege 1120 proforma invoice.exe Token: SeDebugPrivilege 3900 proforma invoice.exe Token: SeDebugPrivilege 496 proforma invoice.exe Token: SeDebugPrivilege 3104 proforma invoice.exe Token: SeDebugPrivilege 3888 proforma invoice.exe Token: SeDebugPrivilege 3836 proforma invoice.exe Token: SeDebugPrivilege 3392 proforma invoice.exe Token: SeDebugPrivilege 1456 proforma invoice.exe Token: SeDebugPrivilege 1052 proforma invoice.exe Token: SeDebugPrivilege 3796 proforma invoice.exe Token: SeDebugPrivilege 2624 proforma invoice.exe Token: SeDebugPrivilege 2112 proforma invoice.exe Token: SeDebugPrivilege 2548 proforma invoice.exe Token: SeDebugPrivilege 2748 proforma invoice.exe Token: SeDebugPrivilege 3796 proforma invoice.exe Token: SeDebugPrivilege 2652 proforma invoice.exe Token: SeDebugPrivilege 4028 proforma invoice.exe Token: SeDebugPrivilege 1648 proforma invoice.exe Token: SeDebugPrivilege 4140 proforma invoice.exe Token: SeDebugPrivilege 4240 proforma invoice.exe Token: SeDebugPrivilege 2120 RegAsm.exe Token: SeDebugPrivilege 4364 proforma invoice.exe Token: SeDebugPrivilege 4480 proforma invoice.exe Token: SeDebugPrivilege 4600 proforma invoice.exe Token: SeDebugPrivilege 4696 proforma invoice.exe Token: SeDebugPrivilege 4792 proforma invoice.exe Token: SeDebugPrivilege 4888 proforma invoice.exe Token: SeDebugPrivilege 4992 proforma invoice.exe Token: SeDebugPrivilege 5088 proforma invoice.exe Token: SeDebugPrivilege 4148 proforma invoice.exe Token: SeDebugPrivilege 1852 proforma invoice.exe Token: SeDebugPrivilege 1336 proforma invoice.exe Token: SeDebugPrivilege 4008 proforma invoice.exe Token: SeDebugPrivilege 4296 proforma invoice.exe Token: SeDebugPrivilege 1688 proforma invoice.exe Token: SeDebugPrivilege 3764 proforma invoice.exe Token: SeDebugPrivilege 4276 proforma invoice.exe Token: SeDebugPrivilege 3096 proforma invoice.exe Token: SeDebugPrivilege 4572 proforma invoice.exe Token: SeDebugPrivilege 4504 proforma invoice.exe Token: SeDebugPrivilege 4684 proforma invoice.exe Token: SeDebugPrivilege 5000 proforma invoice.exe Token: SeDebugPrivilege 4908 proforma invoice.exe Token: SeDebugPrivilege 4408 RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 73856 IoCs
Processes:
proforma invoice.exepid process 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe 644 proforma invoice.exe -
Adds Run entry to start application 2 TTPs 10 IoCs
Processes:
RegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\DsWhv = "C:\\Users\\Admin\\AppData\\Roaming\\DsWhv\\DsWhv.exe" RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"2⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"5⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"6⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"7⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"8⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"18⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"19⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"20⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"21⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"22⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"23⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"24⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"25⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"26⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"27⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"28⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"29⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"30⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"31⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"32⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"33⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"34⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"35⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"36⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"37⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"38⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"39⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"40⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"41⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"42⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"43⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"44⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"45⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"46⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"47⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"48⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"49⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"50⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"51⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"52⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"53⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"54⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"55⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"56⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"57⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"58⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"62⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"63⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"64⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"68⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"74⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"78⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"83⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"84⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"93⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"98⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"99⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"105⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"106⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"107⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"108⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"109⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"110⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"114⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"115⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"118⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"120⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"121⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"124⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"126⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"126⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"127⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"130⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"130⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"131⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"132⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"133⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"133⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"138⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"138⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"139⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"141⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"141⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"142⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"142⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"143⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"143⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"146⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"146⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"147⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"147⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"148⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"149⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"149⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"150⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"150⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"151⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"151⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"151⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"152⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"152⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"153⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"153⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"154⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"155⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"155⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"155⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"156⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"156⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"157⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"158⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"159⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"161⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"161⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"162⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"162⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"162⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"163⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"163⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"163⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"164⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"164⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"165⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"165⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"165⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"166⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"166⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"167⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"167⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"168⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"168⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"169⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"169⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"170⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"170⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"171⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"171⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"172⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"172⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"173⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"173⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"173⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"174⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"174⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"174⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"175⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"175⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"176⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"176⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"177⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"178⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"178⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"179⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"179⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"180⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"180⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"180⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"181⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"181⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"182⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"182⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"183⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"184⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"184⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"185⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"186⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"187⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"187⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"188⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"188⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"189⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"190⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"190⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"191⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"191⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"192⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"192⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"193⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"194⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"195⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"195⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"195⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"196⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"196⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"196⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"197⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"197⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"197⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"198⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"198⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"199⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"200⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"200⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"201⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"202⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"203⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"203⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"203⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"203⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"205⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"205⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"206⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"206⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"206⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"207⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"207⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"208⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"209⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"209⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"210⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"210⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"210⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"210⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"210⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"211⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"211⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"211⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"212⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"212⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"213⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"213⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"214⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"214⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"215⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"215⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"216⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"216⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"217⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"217⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"218⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"218⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"219⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"219⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"220⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"220⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"222⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"222⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"223⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"223⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"224⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"224⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"225⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"225⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"226⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"226⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"227⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"227⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"228⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"228⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"228⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"228⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"229⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"229⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"229⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"230⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"230⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"231⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"231⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"233⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"233⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"234⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"234⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"234⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"234⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"235⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"235⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"236⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"236⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"237⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"237⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"238⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"238⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"239⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"239⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"240⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"240⤵
-
C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"C:\Users\Admin\AppData\Local\Temp\proforma invoice.exe"240⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"241⤵