1aa2ba9a2898cc652c73b06bc862739c8a996f9f241b3c0dfd82115583b6e887

Analysis

max time kernel
150s
max time network
116s
platform
windows10_x64
resource
win10
submitted
08-07-2020 07:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4a2827e59e646de4a83818f494796b96.exe
Size

448KB
MD5

4a2827e59e646de4a83818f494796b96
SHA1

9f513fa6dc12d023e8a069929486931d8d4aadf3
SHA256

1aa2ba9a2898cc652c73b06bc862739c8a996f9f241b3c0dfd82115583b6e887
SHA512

e8ea9af5a4ebc8cb7d96569f19becd18da5c6862296939d46aad139b9f4deec8d1853af542b3929df307ed87b6425f6b8b3fbda0d093a673404095f3512360d2

Score

7^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 2993 IoCs

Processes:

description	pid	process	target process
PID 2976 wrote to memory of 2888	2976	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2976 wrote to memory of 2888	2976	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2976 wrote to memory of 2888	2976	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2976 wrote to memory of 2888	2976	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2976 wrote to memory of 3852	2976	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 2976 wrote to memory of 3852	2976	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 2976 wrote to memory of 3852	2976	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 3852 wrote to memory of 3892	3852	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3852 wrote to memory of 3892	3852	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3852 wrote to memory of 3892	3852	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3852 wrote to memory of 3892	3852	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3852 wrote to memory of 3340	3852	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 3852 wrote to memory of 3340	3852	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 3852 wrote to memory of 3340	3852	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 3340 wrote to memory of 1672	3340	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3340 wrote to memory of 1672	3340	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3340 wrote to memory of 1672	3340	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3340 wrote to memory of 1672	3340	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3340 wrote to memory of 1984	3340	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 3340 wrote to memory of 1984	3340	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 3340 wrote to memory of 1984	3340	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 1984 wrote to memory of 3496	1984	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1984 wrote to memory of 3496	1984	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1984 wrote to memory of 3496	1984	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1984 wrote to memory of 3496	1984	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1984 wrote to memory of 1896	1984	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 1984 wrote to memory of 1896	1984	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 1984 wrote to memory of 1896	1984	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 1896 wrote to memory of 1652	1896	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1896 wrote to memory of 1652	1896	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1896 wrote to memory of 1652	1896	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1896 wrote to memory of 1652	1896	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1896 wrote to memory of 3724	1896	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 1896 wrote to memory of 3724	1896	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 1896 wrote to memory of 3724	1896	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 3724 wrote to memory of 636	3724	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3724 wrote to memory of 636	3724	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3724 wrote to memory of 636	3724	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3724 wrote to memory of 636	3724	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3724 wrote to memory of 352	3724	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 3724 wrote to memory of 352	3724	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 3724 wrote to memory of 352	3724	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 352 wrote to memory of 1164	352	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 352 wrote to memory of 1164	352	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 352 wrote to memory of 1164	352	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 352 wrote to memory of 1164	352	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 352 wrote to memory of 1460	352	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 352 wrote to memory of 1460	352	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 352 wrote to memory of 1460	352	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 1460 wrote to memory of 1648	1460	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1460 wrote to memory of 1648	1460	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1460 wrote to memory of 1648	1460	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1460 wrote to memory of 1648	1460	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1460 wrote to memory of 2000	1460	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 1460 wrote to memory of 2000	1460	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 1460 wrote to memory of 2000	1460	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe
PID 2000 wrote to memory of 2084	2000	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2000 wrote to memory of 2084	2000	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2000 wrote to memory of 2084	2000	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2000 wrote to memory of 2088	2000	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2000 wrote to memory of 2088	2000	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2000 wrote to memory of 2088	2000	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2000 wrote to memory of 2088	2000	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2000 wrote to memory of 2716	2000	4a2827e59e646de4a83818f494796b96.exe	4a2827e59e646de4a83818f494796b96.exe

Suspicious behavior: MapViewOfSection 508 IoCs

Processes:

4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe

pid	process
2976	4a2827e59e646de4a83818f494796b96.exe
3852	4a2827e59e646de4a83818f494796b96.exe
3340	4a2827e59e646de4a83818f494796b96.exe
1984	4a2827e59e646de4a83818f494796b96.exe
1896	4a2827e59e646de4a83818f494796b96.exe
3724	4a2827e59e646de4a83818f494796b96.exe
352	4a2827e59e646de4a83818f494796b96.exe
1460	4a2827e59e646de4a83818f494796b96.exe
2000	4a2827e59e646de4a83818f494796b96.exe
2000	4a2827e59e646de4a83818f494796b96.exe
2716	4a2827e59e646de4a83818f494796b96.exe
3048	4a2827e59e646de4a83818f494796b96.exe
3212	4a2827e59e646de4a83818f494796b96.exe
3212	4a2827e59e646de4a83818f494796b96.exe
2908	4a2827e59e646de4a83818f494796b96.exe
1004	4a2827e59e646de4a83818f494796b96.exe
892	4a2827e59e646de4a83818f494796b96.exe
1796	4a2827e59e646de4a83818f494796b96.exe
1796	4a2827e59e646de4a83818f494796b96.exe
1576	4a2827e59e646de4a83818f494796b96.exe
1576	4a2827e59e646de4a83818f494796b96.exe
3648	4a2827e59e646de4a83818f494796b96.exe
2524	4a2827e59e646de4a83818f494796b96.exe
2524	4a2827e59e646de4a83818f494796b96.exe
2524	4a2827e59e646de4a83818f494796b96.exe
3104	4a2827e59e646de4a83818f494796b96.exe
3104	4a2827e59e646de4a83818f494796b96.exe
3104	4a2827e59e646de4a83818f494796b96.exe
1656	4a2827e59e646de4a83818f494796b96.exe
2600	4a2827e59e646de4a83818f494796b96.exe
2596	4a2827e59e646de4a83818f494796b96.exe
2596	4a2827e59e646de4a83818f494796b96.exe
3476	4a2827e59e646de4a83818f494796b96.exe
2532	4a2827e59e646de4a83818f494796b96.exe
2644	4a2827e59e646de4a83818f494796b96.exe
2084	4a2827e59e646de4a83818f494796b96.exe
3344	4a2827e59e646de4a83818f494796b96.exe
2556	4a2827e59e646de4a83818f494796b96.exe
2556	4a2827e59e646de4a83818f494796b96.exe
956	4a2827e59e646de4a83818f494796b96.exe
664	4a2827e59e646de4a83818f494796b96.exe
1424	4a2827e59e646de4a83818f494796b96.exe
1424	4a2827e59e646de4a83818f494796b96.exe
1656	4a2827e59e646de4a83818f494796b96.exe
3324	4a2827e59e646de4a83818f494796b96.exe
644	4a2827e59e646de4a83818f494796b96.exe
644	4a2827e59e646de4a83818f494796b96.exe
2052	4a2827e59e646de4a83818f494796b96.exe
1660	4a2827e59e646de4a83818f494796b96.exe
1672	4a2827e59e646de4a83818f494796b96.exe
3212	4a2827e59e646de4a83818f494796b96.exe
2384	4a2827e59e646de4a83818f494796b96.exe
3412	4a2827e59e646de4a83818f494796b96.exe
3136	4a2827e59e646de4a83818f494796b96.exe
1576	4a2827e59e646de4a83818f494796b96.exe
1876	4a2827e59e646de4a83818f494796b96.exe
2792	4a2827e59e646de4a83818f494796b96.exe
3768	4a2827e59e646de4a83818f494796b96.exe
3412	4a2827e59e646de4a83818f494796b96.exe
3456	4a2827e59e646de4a83818f494796b96.exe
3728	4a2827e59e646de4a83818f494796b96.exe
1112	4a2827e59e646de4a83818f494796b96.exe
536	4a2827e59e646de4a83818f494796b96.exe
68	4a2827e59e646de4a83818f494796b96.exe

Suspicious use of SetThreadContext 368 IoCs

Processes:

description	pid	process	target process
PID 2976 set thread context of 2888	2976	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3852 set thread context of 3892	3852	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3340 set thread context of 1672	3340	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1984 set thread context of 3496	1984	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1896 set thread context of 1652	1896	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3724 set thread context of 636	3724	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 352 set thread context of 1164	352	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1460 set thread context of 1648	1460	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2000 set thread context of 2088	2000	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2716 set thread context of 3848	2716	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3048 set thread context of 2976	3048	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3212 set thread context of 3324	3212	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2908 set thread context of 1912	2908	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1004 set thread context of 1896	1004	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 892 set thread context of 1676	892	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1796 set thread context of 1492	1796	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1576 set thread context of 2696	1576	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3648 set thread context of 1888	3648	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2524 set thread context of 2192	2524	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3104 set thread context of 1876	3104	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1656 set thread context of 3724	1656	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2600 set thread context of 2984	2600	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2596 set thread context of 1208	2596	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3476 set thread context of 3868	3476	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2532 set thread context of 3788	2532	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2644 set thread context of 2796	2644	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2084 set thread context of 2560	2084	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3344 set thread context of 3792	3344	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2556 set thread context of 1300	2556	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 956 set thread context of 1916	956	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 664 set thread context of 1532	664	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1424 set thread context of 4000	1424	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1656 set thread context of 1168	1656	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3324 set thread context of 1624	3324	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 644 set thread context of 420	644	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2052 set thread context of 408	2052	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1660 set thread context of 2980	1660	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1672 set thread context of 1884	1672	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3212 set thread context of 1232	3212	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2384 set thread context of 3764	2384	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3412 set thread context of 3404	3412	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3136 set thread context of 992	3136	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1576 set thread context of 2052	1576	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1876 set thread context of 932	1876	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2792 set thread context of 3868	2792	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3768 set thread context of 3560	3768	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3412 set thread context of 2560	3412	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3456 set thread context of 3468	3456	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 3728 set thread context of 996	3728	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1112 set thread context of 3292	1112	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 536 set thread context of 3040	536	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 68 set thread context of 3836	68	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2792 set thread context of 1120	2792	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 2872 set thread context of 3852	2872	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 1380 set thread context of 3820	1380	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 4144 set thread context of 4176	4144	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 4252 set thread context of 4284	4252	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 4360 set thread context of 4392	4360	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 4456 set thread context of 4488	4456	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 4552 set thread context of 4584	4552	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 4648 set thread context of 4688	4648	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 4752 set thread context of 4784	4752	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 4848 set thread context of 4888	4848	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe
PID 4956 set thread context of 4988	4956	4a2827e59e646de4a83818f494796b96.exe	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 380 IoCs

Processes:

4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exeRegAsm.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exeRegAsm.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe

description	pid	process
Token: SeDebugPrivilege	2976	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3852	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3340	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1984	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1896	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3724	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	352	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1460	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2000	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2716	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3048	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3212	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2908	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1004	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	892	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1796	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1576	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3648	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2524	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3104	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1656	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2600	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2596	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3476	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2532	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2644	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2084	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2888	RegAsm.exe
Token: SeDebugPrivilege	3344	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2556	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	956	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	664	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1424	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1656	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3324	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	644	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2052	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1660	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1672	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3212	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2384	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3412	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3136	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1576	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1876	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2792	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3768	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3412	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3456	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3728	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1112	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	536	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	68	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2792	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	2872	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	1380	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	4144	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	3792	RegAsm.exe
Token: SeDebugPrivilege	4252	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	4360	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	4456	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	4552	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	4648	4a2827e59e646de4a83818f494796b96.exe
Token: SeDebugPrivilege	4752	4a2827e59e646de4a83818f494796b96.exe

Suspicious behavior: EnumeratesProcesses 105653 IoCs

Processes:

4a2827e59e646de4a83818f494796b96.exe

pid	process
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe
2976	4a2827e59e646de4a83818f494796b96.exe

Drops startup file 2 IoCs

Processes:

4a2827e59e646de4a83818f494796b96.exe4a2827e59e646de4a83818f494796b96.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe	4a2827e59e646de4a83818f494796b96.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe	4a2827e59e646de4a83818f494796b96.exe

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Drops startup file
PID:2976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Drops startup file
PID:3852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:3892

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:1672

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:3496

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
5⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
PID:1652

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
6⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
PID:636

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
7⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
8⤵
PID:1164

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
8⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
9⤵
PID:1648

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
9⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
10⤵
PID:2084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
10⤵
PID:2088

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
PID:3848

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3048

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
PID:2976

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
13⤵
PID:3160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
13⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
14⤵
PID:1912

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
15⤵
PID:1896

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
16⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
17⤵
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
17⤵
PID:1492

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
18⤵
PID:2600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
18⤵
PID:2696

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
18⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
19⤵
PID:1888

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
19⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
20⤵
PID:1956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
20⤵
PID:2840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
20⤵
PID:2192

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
20⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
21⤵
PID:1660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
21⤵
PID:2504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
21⤵
PID:1876

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
21⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
22⤵
PID:3724

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
22⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
23⤵
PID:2984

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
23⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
24⤵
PID:3932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
24⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
24⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
PID:3868

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
25⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
26⤵
PID:3788

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
26⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
27⤵
PID:2796

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
27⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
28⤵
PID:2560

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
28⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
29⤵
- Suspicious use of AdjustPrivilegeToken
PID:3792

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
29⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
30⤵
PID:3008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
30⤵
PID:1300

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
30⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
31⤵
PID:1916

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
31⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
32⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
32⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
33⤵
PID:3796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
33⤵
PID:4000

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
33⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
34⤵
PID:1168

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
34⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
35⤵
PID:1624

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
35⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
36⤵
PID:996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
36⤵
PID:420

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
36⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
37⤵
PID:408

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
37⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
38⤵
PID:2980

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
38⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
39⤵
PID:1884

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
39⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
40⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
40⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2384

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
41⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
42⤵
PID:3404

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
42⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3136

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
43⤵
PID:992

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
43⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
44⤵
PID:2052

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
44⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
45⤵
PID:932

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
45⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
46⤵
PID:3868

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
46⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
47⤵
PID:3560

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
47⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
48⤵
PID:2560

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
48⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
49⤵
PID:3468

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
49⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
50⤵
PID:996

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
50⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
51⤵
PID:3292

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
51⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:3040

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
52⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:68

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
53⤵
PID:3836

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
53⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
54⤵
PID:1120

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
54⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
55⤵
PID:3852

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
55⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
56⤵
PID:3820

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
56⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
57⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
57⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
58⤵
PID:4284

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
58⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
59⤵
PID:4392

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
59⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
60⤵
PID:4488

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
61⤵
PID:4584

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
61⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
62⤵
PID:4680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
62⤵
PID:4688

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
62⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
63⤵
PID:4784

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
63⤵
- Suspicious use of SetThreadContext
PID:4848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
64⤵
PID:4880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
64⤵
PID:4888

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
64⤵
- Suspicious use of SetThreadContext
PID:4956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
65⤵
PID:4988

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
65⤵
PID:5052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
66⤵
PID:5084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
66⤵
PID:5092

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
66⤵
PID:1112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
67⤵
PID:4152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
67⤵
PID:4188

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
67⤵
PID:1244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
68⤵
PID:2896

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
68⤵
PID:1668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
69⤵
PID:2504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
69⤵
PID:4004

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
69⤵
PID:800

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
69⤵
PID:2456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
70⤵
PID:1936

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
70⤵
PID:1648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
71⤵
PID:2448

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
71⤵
PID:1872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
72⤵
PID:3892

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
72⤵
PID:3260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
73⤵
PID:1776

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
73⤵
PID:492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
74⤵
PID:2976

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
74⤵
PID:1056

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
75⤵
PID:4292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
75⤵
PID:4180

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
75⤵
PID:4332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
76⤵
PID:4164

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
76⤵
PID:4268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
77⤵
PID:4352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
77⤵
PID:4252

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
77⤵
PID:4448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
78⤵
PID:4460

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
78⤵
PID:4792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
79⤵
PID:4576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
79⤵
PID:4624

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
79⤵
PID:4672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
80⤵
PID:4648

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
80⤵
PID:4832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
81⤵
PID:5100

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
81⤵
PID:3728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
82⤵
PID:4976

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
82⤵
PID:4152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
83⤵
PID:3660

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
83⤵
PID:4116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
84⤵
PID:552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
84⤵
PID:3240

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
84⤵
PID:2184

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
85⤵
PID:3836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
85⤵
PID:2056

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
85⤵
PID:1164

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
86⤵
PID:1884

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
86⤵
PID:3588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
87⤵
PID:2908

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
87⤵
PID:644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
88⤵
PID:1168

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
88⤵
PID:4296

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
89⤵
PID:3476

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
89⤵
PID:4200

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
89⤵
PID:2868

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
89⤵
PID:4136

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
90⤵
PID:4472

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
90⤵
PID:4332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
91⤵
PID:4336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
91⤵
PID:4344

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
91⤵
PID:4576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
92⤵
PID:4548

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
92⤵
PID:4896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
93⤵
PID:4936

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
93⤵
PID:3860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
94⤵
PID:4748

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
94⤵
PID:4924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
95⤵
PID:5020

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
95⤵
PID:1532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
96⤵
PID:3496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
96⤵
PID:552

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
96⤵
PID:3324

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
97⤵
PID:4112

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
97⤵
PID:5100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
98⤵
PID:2968

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
98⤵
PID:4188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
99⤵
PID:4176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
99⤵
PID:1300

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
99⤵
PID:4612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
100⤵
PID:3412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
100⤵
PID:4588

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
100⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
100⤵
PID:4220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
101⤵
PID:4884

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
101⤵
PID:4640

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
102⤵
PID:2108

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
102⤵
PID:420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
103⤵
PID:1236

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
103⤵
PID:4980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
104⤵
PID:68

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
104⤵
PID:1120

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
104⤵
PID:1500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
105⤵
PID:956

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
105⤵
PID:852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
106⤵
PID:2136

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
106⤵
PID:1872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
107⤵
PID:4352

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
107⤵
PID:4216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
108⤵
PID:3000

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
108⤵
PID:4340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
109⤵
PID:4428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
109⤵
PID:4496

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
109⤵
PID:3912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
110⤵
PID:3500

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
110⤵
PID:4572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
111⤵
PID:4660

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
111⤵
PID:4984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
112⤵
PID:3340

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
112⤵
PID:4948

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
113⤵
PID:636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
113⤵
PID:3136

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
113⤵
PID:2496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
114⤵
PID:3004

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
114⤵
PID:4416

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
115⤵
PID:376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
115⤵
PID:3344

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
115⤵
PID:1660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
116⤵
PID:4552

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
116⤵
PID:4648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
117⤵
PID:4996

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
117⤵
PID:3008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
118⤵
PID:4892

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
118⤵
PID:500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
119⤵
PID:420

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
119⤵
PID:3908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
120⤵
PID:1884

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
120⤵
PID:504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
121⤵
PID:3456

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
121⤵
PID:2696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
122⤵
PID:3224

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
122⤵
PID:4520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
123⤵
PID:4336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
123⤵
PID:1056

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
123⤵
PID:4728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
124⤵
PID:4680

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
124⤵
PID:3972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
125⤵
PID:4060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
125⤵
PID:3244

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
125⤵
PID:4984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
126⤵
PID:3540

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
126⤵
PID:808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
127⤵
PID:4116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
127⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
127⤵
PID:4500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
128⤵
PID:4276

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
128⤵
PID:4904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
129⤵
PID:4864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
129⤵
PID:2516

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
129⤵
PID:796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
130⤵
PID:1624

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
130⤵
PID:4148

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
131⤵
PID:4480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
131⤵
PID:3736

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
131⤵
PID:1236

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
132⤵
PID:4448

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
132⤵
PID:4592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
133⤵
PID:5084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
133⤵
PID:4972

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
133⤵
PID:4916

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
134⤵
PID:5032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
134⤵
PID:3552

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
134⤵
PID:4508

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
135⤵
PID:1424

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
135⤵
PID:3796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
136⤵
PID:4204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
136⤵
PID:1576

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
136⤵
PID:1620

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
137⤵
PID:3848

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
137⤵
PID:4788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
138⤵
PID:500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
138⤵
PID:4264

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
138⤵
PID:3908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
139⤵
PID:3492

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
139⤵
PID:4208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
140⤵
PID:4388

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
140⤵
PID:4668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
141⤵
PID:4520

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
141⤵
PID:4176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
142⤵
PID:3292

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
142⤵
PID:4200

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
143⤵
PID:4832

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
143⤵
PID:964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
144⤵
PID:4776

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
144⤵
PID:2752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
145⤵
PID:4992

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
145⤵
PID:4824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
146⤵
PID:552

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
146⤵
PID:4440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
147⤵
PID:4492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
147⤵
PID:4224

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
147⤵
PID:4104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
148⤵
PID:4584

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
148⤵
PID:1888

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
149⤵
PID:2532

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
149⤵
PID:1620

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
150⤵
PID:4712

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
150⤵
PID:4140

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
151⤵
PID:4280

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
151⤵
PID:4924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
152⤵
PID:3620

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
152⤵
PID:664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
152⤵
PID:4792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
152⤵
PID:4068

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
152⤵
PID:4704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
153⤵
PID:4520

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
153⤵
PID:3240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
154⤵
PID:1644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
154⤵
PID:1776

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
154⤵
PID:1576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
155⤵
PID:1380

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
155⤵
PID:2580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
156⤵
PID:2572

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
156⤵
PID:4464

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
157⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
157⤵
PID:1936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
158⤵
PID:1984

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
158⤵
PID:4312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
159⤵
PID:4836

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
159⤵
PID:5080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
160⤵
PID:3268

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
160⤵
PID:376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
161⤵
PID:5104

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
161⤵
PID:4436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
162⤵
PID:4868

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
162⤵
PID:4180

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
163⤵
PID:4356

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
163⤵
PID:4564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
164⤵
PID:2568

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
164⤵
PID:3476

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
165⤵
PID:4340

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
165⤵
PID:4216

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
166⤵
PID:4172

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
166⤵
PID:636

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
167⤵
PID:1876

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
167⤵
PID:4664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
168⤵
PID:2888

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
168⤵
PID:3552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
169⤵
PID:1392

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
169⤵
PID:4536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
170⤵
PID:4840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
170⤵
PID:2240

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
170⤵
PID:3884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
171⤵
PID:4256

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
171⤵
PID:3260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:2524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:3024

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:3968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:4960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:3336

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
172⤵
PID:5008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
173⤵
PID:1904

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
173⤵
PID:2504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
174⤵
PID:3788

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
174⤵
PID:4432

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
175⤵
PID:4168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
175⤵
PID:3836

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
175⤵
PID:4516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
176⤵
PID:4220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
176⤵
PID:4104

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
176⤵
PID:4616

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
177⤵
PID:4236

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
177⤵
PID:4296

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
177⤵
PID:4604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
178⤵
PID:1172

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
178⤵
PID:5064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
179⤵
PID:1736

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
179⤵
PID:1656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
180⤵
PID:4736

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
180⤵
PID:3000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
181⤵
PID:1116

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
181⤵
PID:3924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
182⤵
PID:1452

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
182⤵
PID:4912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
182⤵
PID:1620

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
182⤵
PID:1876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
183⤵
PID:1984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
183⤵
PID:3808

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
183⤵
PID:1124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
184⤵
PID:3792

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
184⤵
PID:4748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
185⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
185⤵
PID:3404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
186⤵
PID:3212

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
186⤵
PID:4584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
187⤵
PID:536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
187⤵
PID:3492

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
187⤵
PID:3160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
188⤵
PID:4128

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
188⤵
PID:2524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
189⤵
PID:3848

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
189⤵
PID:3660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
190⤵
PID:4312

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
190⤵
PID:3224

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
191⤵
PID:3272

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
191⤵
PID:4492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
192⤵
PID:4800

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
192⤵
PID:4788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
193⤵
PID:4236

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
193⤵
PID:4668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
194⤵
PID:4792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
194⤵
PID:1304

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
194⤵
PID:1348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
195⤵
PID:4604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
195⤵
PID:5028

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
195⤵
PID:1648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
196⤵
PID:3548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
196⤵
PID:4676

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
196⤵
PID:4892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
197⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
197⤵
PID:4248

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
198⤵
PID:1308

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
198⤵
PID:5096

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:4480

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
199⤵
PID:3268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
200⤵
PID:4748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
200⤵
PID:1112

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
200⤵
PID:2420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
201⤵
PID:4992

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
201⤵
PID:3500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
202⤵
PID:408

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
202⤵
PID:2624

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
203⤵
PID:4948

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
203⤵
PID:3660

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
204⤵
PID:5012

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
204⤵
PID:4828

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
205⤵
PID:2076

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
205⤵
PID:2136

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
206⤵
PID:3292

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
206⤵
PID:4336

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
207⤵
PID:4836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
207⤵
PID:3548

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
207⤵
PID:4356

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
208⤵
PID:1668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
208⤵
PID:4372

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
208⤵
PID:1252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
209⤵
PID:4976

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
209⤵
PID:5056

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
210⤵
PID:4104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
210⤵
PID:4252

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
210⤵
PID:3272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
211⤵
PID:3816

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
211⤵
PID:2728

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
212⤵
PID:4188

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
212⤵
PID:2188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
213⤵
PID:4560

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
213⤵
PID:1656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
214⤵
PID:2056

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
214⤵
PID:5032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
214⤵
PID:3840

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
214⤵
PID:2700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
215⤵
PID:3836

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
215⤵
PID:3812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
216⤵
PID:4176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
216⤵
PID:3336

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
216⤵
PID:1176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
217⤵
PID:4608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
217⤵
PID:4100

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
217⤵
PID:4240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
217⤵
PID:4300

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
217⤵
PID:4520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
218⤵
PID:3572

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
218⤵
PID:4368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
219⤵
PID:1624

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
219⤵
PID:3024

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
220⤵
PID:2576

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
220⤵
PID:1208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
221⤵
PID:3692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
221⤵
PID:4200

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
221⤵
PID:4752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
222⤵
PID:2768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
222⤵
PID:2184

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
222⤵
PID:4360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
223⤵
PID:4544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
223⤵
PID:1668

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
223⤵
PID:4312

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
224⤵
PID:4068

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
224⤵
PID:1984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
225⤵
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
225⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
225⤵
PID:4884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
226⤵
PID:500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
226⤵
PID:4628

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
226⤵
PID:5000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
227⤵
PID:4932

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
227⤵
PID:4708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
228⤵
PID:4448

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
228⤵
PID:4720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
229⤵
PID:4176

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
229⤵
PID:4320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
230⤵
PID:5072

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
230⤵
PID:2160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
231⤵
PID:2460

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
231⤵
PID:4920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
232⤵
PID:4756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
232⤵
PID:3412

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
232⤵
PID:4368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
233⤵
PID:5020

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
233⤵
PID:4888

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
234⤵
PID:3048

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
234⤵
PID:800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
235⤵
PID:4788

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
235⤵
PID:1348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
236⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
236⤵
PID:4244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
237⤵
PID:3348

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
237⤵
PID:3808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
238⤵
PID:1544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
238⤵
PID:2872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
238⤵
PID:3792

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
238⤵
PID:3620

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
239⤵
PID:4220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
239⤵
PID:4804

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
239⤵
PID:4868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
240⤵
PID:4900

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
240⤵
PID:3932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
241⤵
PID:4660

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
241⤵
PID:3988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
242⤵
PID:4740

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
242⤵
PID:4208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
243⤵
PID:1308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
243⤵
PID:3868

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
243⤵
PID:4472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
244⤵
PID:4452

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
244⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
244⤵
PID:5048

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
245⤵
PID:5108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
245⤵
PID:4432

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
245⤵
PID:4896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
246⤵
PID:4676

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
246⤵
PID:1532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
247⤵
PID:4140

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
247⤵
PID:1232

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
248⤵
PID:4428

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
248⤵
PID:4756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
249⤵
PID:3456

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
249⤵
PID:4520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
250⤵
PID:4324

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
250⤵
PID:3476

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
250⤵
PID:1208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
251⤵
PID:3912

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
251⤵
PID:364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
252⤵
PID:352

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
252⤵
PID:3708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
253⤵
PID:4272

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
253⤵
PID:4364

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
254⤵
PID:5012

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
254⤵
PID:3808

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
255⤵
PID:1380

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
255⤵
PID:4344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
256⤵
PID:2728

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
256⤵
PID:4928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
257⤵
PID:3768

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
257⤵
PID:4016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
258⤵
PID:4228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
258⤵
PID:2516

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
258⤵
PID:3908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
259⤵
PID:1936

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
259⤵
PID:1776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
260⤵
PID:4180

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
260⤵
PID:4420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
260⤵
PID:4488

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
260⤵
PID:4396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
261⤵
PID:552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
261⤵
PID:2696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
261⤵
PID:4720

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
261⤵
PID:4700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
262⤵
PID:4780

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
262⤵
PID:3692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
263⤵
PID:4444

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
263⤵
PID:4612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
264⤵
PID:4132

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
264⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
264⤵
PID:3512

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
265⤵
PID:3772

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
265⤵
PID:2240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
266⤵
PID:4404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
266⤵
PID:1172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
266⤵
PID:4384

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
266⤵
PID:4844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
267⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
267⤵
PID:3468

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
268⤵
PID:4876

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
268⤵
PID:2716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
269⤵
PID:500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
269⤵
PID:3588

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
269⤵
PID:4460

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
270⤵
PID:1492

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
270⤵
PID:992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
271⤵
PID:2968

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
271⤵
PID:4328

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
272⤵
PID:2504

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
272⤵
PID:4156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
273⤵
PID:1500

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
273⤵
PID:420

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
274⤵
PID:2576

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
274⤵
PID:5112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
275⤵
PID:4344

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
275⤵
PID:4372

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
276⤵
PID:4784

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
276⤵
PID:3240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
277⤵
PID:4420

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
277⤵
PID:2980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
278⤵
PID:4448

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
278⤵
PID:4556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
279⤵
PID:4608

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
279⤵
PID:964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
280⤵
PID:4520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
280⤵
PID:4412

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
280⤵
PID:3560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
281⤵
PID:4204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
281⤵
PID:4312

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
281⤵
PID:4404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
282⤵
PID:3572

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
282⤵
PID:2568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
283⤵
PID:2240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
283⤵
PID:3868

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
283⤵
PID:4900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
284⤵
PID:500

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
284⤵
PID:4648

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
284⤵
PID:628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
285⤵
PID:3344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
285⤵
PID:1308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
285⤵
PID:2716

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
285⤵
PID:3720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
286⤵
PID:3404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
286⤵
PID:4804

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
286⤵
PID:4152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
287⤵
PID:852

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
287⤵
PID:4156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
288⤵
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
288⤵
PID:4272

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
288⤵
PID:2184

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
288⤵
PID:1876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
289⤵
PID:1164

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
289⤵
PID:4484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
290⤵
PID:3232

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
290⤵
PID:3884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
291⤵
PID:4024

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
291⤵
PID:1776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
291⤵
PID:4996

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
291⤵
PID:1984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
292⤵
PID:4984

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
292⤵
PID:4236

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
293⤵
PID:3692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
293⤵
PID:1924

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
293⤵
PID:4300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
294⤵
PID:3924

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
294⤵
PID:4560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
295⤵
PID:4492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
295⤵
PID:2568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
295⤵
PID:3660

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
295⤵
PID:4440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
296⤵
PID:2504

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
296⤵
PID:2052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
297⤵
PID:4784

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
297⤵
PID:5032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
298⤵
PID:3000

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
298⤵
PID:4848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
299⤵
PID:2968

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
299⤵
PID:2596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
300⤵
PID:536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
300⤵
PID:4100

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
300⤵
PID:1784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
301⤵
PID:4920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
301⤵
PID:3724

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
301⤵
PID:4696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
302⤵
PID:5056

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
302⤵
PID:4296

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
303⤵
PID:4832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
303⤵
PID:4900

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
303⤵
PID:3292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
304⤵
PID:3812

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
304⤵
PID:3720

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
305⤵
PID:2976

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
305⤵
PID:1892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
306⤵
PID:5084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
306⤵
PID:4704

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
306⤵
PID:4064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
307⤵
PID:4976

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
307⤵
PID:4000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
308⤵
PID:4320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
308⤵
PID:4484

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
308⤵
PID:3608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
309⤵
PID:1620

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
309⤵
PID:4172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
310⤵
PID:4592

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
310⤵
PID:4816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
311⤵
PID:4248

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
311⤵
PID:4252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
312⤵
PID:4560

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
312⤵
PID:4396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
313⤵
PID:3736

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
313⤵
PID:5096

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
314⤵
PID:4316

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
314⤵
PID:5044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
315⤵
PID:4800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
315⤵
PID:4848

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
315⤵
PID:2104

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
316⤵
PID:4540

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
316⤵
PID:4832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
317⤵
PID:1816

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
317⤵
PID:3260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
318⤵
PID:2840

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
318⤵
PID:68

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
319⤵
PID:796

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
319⤵
PID:3840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
320⤵
PID:2868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
320⤵
PID:1968

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
320⤵
PID:4200

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
321⤵
PID:1776

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
321⤵
PID:2696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
322⤵
PID:2240

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
322⤵
PID:3716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
323⤵
PID:1300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
323⤵
PID:4612

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
323⤵
PID:4220

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
324⤵
PID:5008

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
324⤵
PID:5052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
325⤵
PID:4924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
325⤵
PID:4608

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
325⤵
PID:1252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
326⤵
PID:4276

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
326⤵
PID:4168

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
327⤵
PID:3524

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
327⤵
PID:1664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
328⤵
PID:4596

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
328⤵
PID:1876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
329⤵
PID:4892

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
329⤵
PID:2184

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
330⤵
PID:4060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
330⤵
PID:1904

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
330⤵
PID:3404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
331⤵
PID:4904

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
331⤵
PID:4988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
332⤵
PID:5104

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
332⤵
PID:3912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
333⤵
PID:3736

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
333⤵
PID:5060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
334⤵
PID:1208

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
334⤵
PID:4192

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
335⤵
PID:1380

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
335⤵
PID:3648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
336⤵
PID:3348

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
336⤵
PID:628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
337⤵
PID:552

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
337⤵
PID:4228

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
338⤵
PID:3708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
338⤵
PID:964

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
338⤵
PID:4308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
339⤵
PID:3908

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
339⤵
PID:4756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
340⤵
PID:2696

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
340⤵
PID:4188

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
341⤵
PID:3924

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
341⤵
PID:4644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
342⤵
PID:4208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
342⤵
PID:2052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
342⤵
PID:4776

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
342⤵
PID:4244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
343⤵
PID:2480

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
343⤵
PID:4884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
344⤵
PID:3808

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
344⤵
PID:4424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
345⤵
PID:3324

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
345⤵
PID:2968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
346⤵
PID:4112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
346⤵
PID:1884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
346⤵
PID:4872

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
346⤵
PID:4584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
347⤵
PID:4876

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
347⤵
PID:5028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
348⤵
PID:1492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
348⤵
PID:1872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
348⤵
PID:5076

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
348⤵
PID:4064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
349⤵
PID:2448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
349⤵
PID:2772

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
349⤵
PID:4744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
349⤵
PID:3764

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
349⤵
PID:4296

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
350⤵
PID:3708

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
350⤵
PID:2352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
351⤵
PID:3840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
351⤵
PID:3428

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
351⤵
PID:3816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
352⤵
PID:2084

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
352⤵
PID:4756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
353⤵
PID:4752

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
353⤵
PID:4824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
354⤵
PID:1936

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
354⤵
PID:3704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
355⤵
PID:2420

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
355⤵
PID:488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
356⤵
PID:2832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
356⤵
PID:4384

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
356⤵
PID:4792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
357⤵
PID:3892

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
357⤵
PID:4444

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
358⤵
PID:3820

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
358⤵
PID:5012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
359⤵
PID:3784

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
359⤵
PID:3884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
360⤵
PID:1544

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
360⤵
PID:4376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
361⤵
PID:1208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
361⤵
PID:1676

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
361⤵
PID:4492

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
361⤵
PID:1204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
362⤵
PID:1668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
362⤵
PID:2188

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
362⤵
PID:4452

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
363⤵
PID:4704

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
363⤵
PID:4348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
364⤵
PID:4424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
364⤵
PID:4880

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
364⤵
PID:1112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
365⤵
PID:1872

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
365⤵
PID:4524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
366⤵
PID:2772

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
366⤵
PID:4964

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
367⤵
PID:2496

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
367⤵
PID:4024

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
368⤵
PID:628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
368⤵
PID:4232

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
368⤵
PID:4924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
368⤵
PID:4236

C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe
"C:\Users\Admin\AppData\Local\Temp\4a2827e59e646de4a83818f494796b96.exe"
368⤵
PID:2352

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
369⤵
PID:2700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe

Download Submit
memory/68-951-0x0000000000000000-mapping.dmp

Download
memory/68-153-0x0000000000000000-mapping.dmp

Download
memory/352-18-0x0000000000000000-mapping.dmp

Download
memory/352-752-0x0000000000446E8E-mapping.dmp

Download
memory/364-750-0x0000000000000000-mapping.dmp

Download
memory/376-477-0x0000000000000000-mapping.dmp

Download
memory/408-602-0x0000000000446E8E-mapping.dmp

Download
memory/408-107-0x0000000000446E8E-mapping.dmp

Download
memory/420-353-0x0000000000446E8E-mapping.dmp

Download
memory/420-303-0x0000000000000000-mapping.dmp

Download
memory/420-104-0x0000000000446E8E-mapping.dmp

Download
memory/420-816-0x0000000000000000-mapping.dmp

Download
memory/488-1062-0x0000000000000000-mapping.dmp

Download
memory/492-216-0x0000000000000000-mapping.dmp

Download
memory/500-351-0x0000000000000000-mapping.dmp

Download
memory/504-357-0x0000000000000000-mapping.dmp

Download
memory/536-150-0x0000000000000000-mapping.dmp

Download
memory/552-1007-0x0000000000446E8E-mapping.dmp

Download
memory/552-434-0x0000000000446E8E-mapping.dmp

Download
memory/552-284-0x0000000000446E8E-mapping.dmp

Download
memory/628-849-0x0000000000000000-mapping.dmp

Download
memory/628-1005-0x0000000000000000-mapping.dmp

Download
memory/636-17-0x0000000000446E8E-mapping.dmp

Download
memory/636-495-0x0000000000000000-mapping.dmp

Download
memory/644-258-0x0000000000000000-mapping.dmp

Download
memory/644-102-0x0000000000000000-mapping.dmp

Download
memory/664-90-0x0000000000000000-mapping.dmp

Download
memory/796-384-0x0000000000000000-mapping.dmp

Download
memory/796-953-0x0000000000446E8E-mapping.dmp

Download
memory/800-203-0x0000000000446E8E-mapping.dmp

Download
memory/800-699-0x0000000000000000-mapping.dmp

Download
memory/808-375-0x0000000000000000-mapping.dmp

Download
memory/852-857-0x0000000000446E8E-mapping.dmp

Download
memory/852-312-0x0000000000000000-mapping.dmp

Download
memory/892-42-0x0000000000000000-mapping.dmp

Download
memory/932-131-0x0000000000446E8E-mapping.dmp

Download
memory/956-311-0x0000000000446E8E-mapping.dmp

Download
memory/956-87-0x0000000000000000-mapping.dmp

Download
memory/964-834-0x0000000000000000-mapping.dmp

Download
memory/964-1010-0x0000000000446E8E-mapping.dmp

Download
memory/964-426-0x0000000000000000-mapping.dmp

Download
memory/992-807-0x0000000000000000-mapping.dmp

Download
memory/992-125-0x0000000000446E8E-mapping.dmp

Download
memory/996-146-0x0000000000446E8E-mapping.dmp

Download
memory/1004-39-0x0000000000000000-mapping.dmp

Download
memory/1056-365-0x0000000000446E8E-mapping.dmp

Download
memory/1056-219-0x0000000000000000-mapping.dmp

Download
memory/1112-596-0x0000000000446E8E-mapping.dmp

Download
memory/1112-195-0x0000000000000000-mapping.dmp

Download
memory/1112-1089-0x0000000000000000-mapping.dmp

Download
memory/1112-147-0x0000000000000000-mapping.dmp

Download
memory/1116-539-0x0000000000446E8E-mapping.dmp

Download
memory/1120-158-0x0000000000446E8E-mapping.dmp

Download
memory/1120-308-0x0000000000446E8E-mapping.dmp

Download
memory/1124-546-0x0000000000000000-mapping.dmp

Download
memory/1164-20-0x0000000000446E8E-mapping.dmp

Download
memory/1164-252-0x0000000000000000-mapping.dmp

Download
memory/1164-863-0x0000000000446E8E-mapping.dmp

Download
memory/1168-260-0x0000000000446E8E-mapping.dmp

Download
memory/1168-98-0x0000000000446E8E-mapping.dmp

Download
memory/1172-530-0x0000000000446E8E-mapping.dmp

Download
memory/1176-645-0x0000000000000000-mapping.dmp

Download
memory/1204-1080-0x0000000000000000-mapping.dmp

Download
memory/1208-657-0x0000000000000000-mapping.dmp

Download
memory/1208-998-0x0000000000446E8E-mapping.dmp

Download
memory/1208-68-0x0000000000446E8E-mapping.dmp

Download
memory/1208-788-0x0000000000446E8E-mapping.dmp

Download
memory/1208-747-0x0000000000000000-mapping.dmp

Download
memory/1232-738-0x0000000000000000-mapping.dmp

Download
memory/1232-116-0x0000000000446E8E-mapping.dmp

Download
memory/1232-593-0x0000000000446E8E-mapping.dmp

Download
memory/1236-390-0x0000000000000000-mapping.dmp

Download
memory/1236-305-0x0000000000446E8E-mapping.dmp

Download
memory/1244-198-0x0000000000000000-mapping.dmp

Download
memory/1252-972-0x0000000000000000-mapping.dmp

Download
memory/1252-621-0x0000000000000000-mapping.dmp

Download
memory/1252-671-0x0000000000446E8E-mapping.dmp

Download
memory/1300-293-0x0000000000446E8E-mapping.dmp

Download
memory/1300-86-0x0000000000446E8E-mapping.dmp

Download
memory/1304-578-0x0000000000446E8E-mapping.dmp

Download
memory/1308-590-0x0000000000446E8E-mapping.dmp

Download
memory/1348-702-0x0000000000000000-mapping.dmp

Download
memory/1348-579-0x0000000000000000-mapping.dmp

Download
memory/1380-1001-0x0000000000446E8E-mapping.dmp

Download
memory/1380-461-0x0000000000446E8E-mapping.dmp

Download
memory/1380-761-0x0000000000446E8E-mapping.dmp

Download
memory/1380-162-0x0000000000000000-mapping.dmp

Download
memory/1392-503-0x0000000000446E8E-mapping.dmp

Download
memory/1424-93-0x0000000000000000-mapping.dmp

Download
memory/1424-401-0x0000000000446E8E-mapping.dmp

Download
memory/1460-21-0x0000000000000000-mapping.dmp

Download
memory/1492-47-0x0000000000446E8E-mapping.dmp

Download
memory/1492-806-0x0000000000446E8E-mapping.dmp

Download
memory/1500-309-0x0000000000000000-mapping.dmp

Download
memory/1500-815-0x0000000000446E8E-mapping.dmp

Download
memory/1532-282-0x0000000000000000-mapping.dmp

Download
memory/1532-551-0x0000000000446E8E-mapping.dmp

Download
memory/1532-92-0x0000000000446E8E-mapping.dmp

Download
memory/1532-735-0x0000000000000000-mapping.dmp

Download
memory/1544-1076-0x0000000000446E8E-mapping.dmp

Download
memory/1576-404-0x0000000000446E8E-mapping.dmp

Download
memory/1576-126-0x0000000000000000-mapping.dmp

Download
memory/1576-459-0x0000000000000000-mapping.dmp

Download
memory/1576-48-0x0000000000000000-mapping.dmp

Download
memory/1620-444-0x0000000000000000-mapping.dmp

Download
memory/1620-542-0x0000000000446E8E-mapping.dmp

Download
memory/1620-405-0x0000000000000000-mapping.dmp

Download
memory/1620-923-0x0000000000446E8E-mapping.dmp

Download
memory/1624-386-0x0000000000446E8E-mapping.dmp

Download
memory/1624-653-0x0000000000446E8E-mapping.dmp

Download
memory/1624-101-0x0000000000446E8E-mapping.dmp

Download
memory/1648-23-0x0000000000446E8E-mapping.dmp

Download
memory/1648-582-0x0000000000000000-mapping.dmp

Download
memory/1648-207-0x0000000000000000-mapping.dmp

Download
memory/1652-14-0x0000000000446E8E-mapping.dmp

Download
memory/1656-96-0x0000000000000000-mapping.dmp

Download
memory/1656-636-0x0000000000000000-mapping.dmp

Download
memory/1656-60-0x0000000000000000-mapping.dmp

Download
memory/1656-534-0x0000000000000000-mapping.dmp

Download
memory/1660-108-0x0000000000000000-mapping.dmp

Download
memory/1660-342-0x0000000000000000-mapping.dmp

Download
memory/1664-978-0x0000000000000000-mapping.dmp

Download
memory/1668-201-0x0000000000000000-mapping.dmp

Download
memory/1668-665-0x0000000000446E8E-mapping.dmp

Download
memory/1672-111-0x0000000000000000-mapping.dmp

Download
memory/1672-8-0x0000000000446E8E-mapping.dmp

Download
memory/1676-44-0x0000000000446E8E-mapping.dmp

Download
memory/1676-467-0x0000000000446E8E-mapping.dmp

Download
memory/1736-533-0x0000000000446E8E-mapping.dmp

Download
memory/1776-215-0x0000000000446E8E-mapping.dmp

Download
memory/1776-458-0x0000000000446E8E-mapping.dmp

Download
memory/1776-774-0x0000000000000000-mapping.dmp

Download
memory/1776-959-0x0000000000446E8E-mapping.dmp

Download
memory/1784-897-0x0000000000000000-mapping.dmp

Download
memory/1796-45-0x0000000000000000-mapping.dmp

Download
memory/1816-947-0x0000000000446E8E-mapping.dmp

Download
memory/1872-1091-0x0000000000446E8E-mapping.dmp

Download
memory/1872-210-0x0000000000000000-mapping.dmp

Download
memory/1872-315-0x0000000000000000-mapping.dmp

Download
memory/1876-129-0x0000000000000000-mapping.dmp

Download
memory/1876-981-0x0000000000000000-mapping.dmp

Download
memory/1876-497-0x0000000000446E8E-mapping.dmp

Download
memory/1876-59-0x0000000000446E8E-mapping.dmp

Download
memory/1876-861-0x0000000000000000-mapping.dmp

Download
memory/1876-543-0x0000000000000000-mapping.dmp

Download
memory/1884-113-0x0000000000446E8E-mapping.dmp

Download
memory/1884-356-0x0000000000446E8E-mapping.dmp

Download
memory/1884-254-0x0000000000446E8E-mapping.dmp

Download
memory/1888-441-0x0000000000000000-mapping.dmp

Download
memory/1888-53-0x0000000000446E8E-mapping.dmp

Download
memory/1892-912-0x0000000000000000-mapping.dmp

Download
memory/1896-41-0x0000000000446E8E-mapping.dmp

Download
memory/1896-12-0x0000000000000000-mapping.dmp

Download
memory/1904-986-0x0000000000446E8E-mapping.dmp

Download
memory/1904-515-0x0000000000446E8E-mapping.dmp

Download
memory/1912-38-0x0000000000446E8E-mapping.dmp

Download
memory/1916-89-0x0000000000446E8E-mapping.dmp

Download
memory/1924-875-0x0000000000446E8E-mapping.dmp

Download
memory/1936-773-0x0000000000446E8E-mapping.dmp

Download
memory/1936-468-0x0000000000000000-mapping.dmp

Download
memory/1936-206-0x0000000000446E8E-mapping.dmp

Download
memory/1936-1058-0x0000000000446E8E-mapping.dmp

Download
memory/1968-956-0x0000000000446E8E-mapping.dmp

Download
memory/1984-870-0x0000000000000000-mapping.dmp

Download
memory/1984-470-0x0000000000446E8E-mapping.dmp

Download
memory/1984-9-0x0000000000000000-mapping.dmp

Download
memory/1984-669-0x0000000000000000-mapping.dmp

Download
memory/2000-24-0x0000000000000000-mapping.dmp

Download
memory/2052-885-0x0000000000000000-mapping.dmp

Download
memory/2052-128-0x0000000000446E8E-mapping.dmp

Download
memory/2052-105-0x0000000000000000-mapping.dmp

Download
memory/2056-251-0x0000000000446E8E-mapping.dmp

Download
memory/2076-611-0x0000000000446E8E-mapping.dmp

Download
memory/2084-78-0x0000000000000000-mapping.dmp

Download
memory/2084-1052-0x0000000000446E8E-mapping.dmp

Download
memory/2088-26-0x0000000000446E8E-mapping.dmp

Download
memory/2104-942-0x0000000000000000-mapping.dmp

Download
memory/2108-302-0x0000000000446E8E-mapping.dmp

Download
memory/2136-612-0x0000000000000000-mapping.dmp

Download
memory/2136-314-0x0000000000446E8E-mapping.dmp

Download
memory/2160-687-0x0000000000000000-mapping.dmp

Download
memory/2184-662-0x0000000000446E8E-mapping.dmp

Download
memory/2184-249-0x0000000000000000-mapping.dmp

Download
memory/2184-860-0x0000000000446E8E-mapping.dmp

Download
memory/2184-984-0x0000000000000000-mapping.dmp

Download
memory/2188-633-0x0000000000000000-mapping.dmp

Download
memory/2188-1082-0x0000000000446E8E-mapping.dmp

Download
memory/2192-56-0x0000000000446E8E-mapping.dmp

Download
memory/2240-792-0x0000000000000000-mapping.dmp

Download
memory/2240-962-0x0000000000446E8E-mapping.dmp

Download
memory/2240-506-0x0000000000446E8E-mapping.dmp

Download
memory/2352-1047-0x0000000000000000-mapping.dmp

Download
memory/2352-1101-0x0000000000000000-mapping.dmp

Download
memory/2384-117-0x0000000000000000-mapping.dmp

Download
memory/2420-1061-0x0000000000446E8E-mapping.dmp

Download
memory/2420-597-0x0000000000000000-mapping.dmp

Download
memory/2448-209-0x0000000000446E8E-mapping.dmp

Download
memory/2456-204-0x0000000000000000-mapping.dmp

Download
memory/2460-689-0x0000000000446E8E-mapping.dmp

Download
memory/2480-1025-0x0000000000446E8E-mapping.dmp

Download
memory/2496-336-0x0000000000000000-mapping.dmp

Download
memory/2496-1097-0x0000000000446E8E-mapping.dmp

Download
memory/2504-884-0x0000000000446E8E-mapping.dmp

Download
memory/2504-516-0x0000000000000000-mapping.dmp

Download
memory/2504-812-0x0000000000446E8E-mapping.dmp

Download
memory/2516-770-0x0000000000446E8E-mapping.dmp

Download
memory/2516-383-0x0000000000446E8E-mapping.dmp

Download
memory/2524-561-0x0000000000000000-mapping.dmp

Download
memory/2524-54-0x0000000000000000-mapping.dmp

Download
memory/2532-72-0x0000000000000000-mapping.dmp

Download
memory/2532-443-0x0000000000446E8E-mapping.dmp

Download
memory/2556-84-0x0000000000000000-mapping.dmp

Download
memory/2560-80-0x0000000000446E8E-mapping.dmp

Download
memory/2560-140-0x0000000000446E8E-mapping.dmp

Download
memory/2568-488-0x0000000000446E8E-mapping.dmp

Download
memory/2568-843-0x0000000000000000-mapping.dmp

Download
memory/2572-464-0x0000000000446E8E-mapping.dmp

Download
memory/2576-656-0x0000000000446E8E-mapping.dmp

Download
memory/2576-818-0x0000000000446E8E-mapping.dmp

Download
memory/2580-462-0x0000000000000000-mapping.dmp

Download
memory/2596-66-0x0000000000000000-mapping.dmp

Download
memory/2596-894-0x0000000000000000-mapping.dmp

Download
memory/2600-63-0x0000000000000000-mapping.dmp

Download
memory/2624-603-0x0000000000000000-mapping.dmp

Download
memory/2644-75-0x0000000000000000-mapping.dmp

Download
memory/2696-1016-0x0000000000446E8E-mapping.dmp

Download
memory/2696-50-0x0000000000446E8E-mapping.dmp

Download
memory/2696-960-0x0000000000000000-mapping.dmp

Download
memory/2696-360-0x0000000000000000-mapping.dmp

Download
memory/2700-1103-0x0000000000446E8E-mapping.dmp

Download
memory/2700-639-0x0000000000000000-mapping.dmp

Download
memory/2716-27-0x0000000000000000-mapping.dmp

Download
memory/2716-851-0x0000000000446E8E-mapping.dmp

Download
memory/2716-801-0x0000000000000000-mapping.dmp

Download
memory/2728-630-0x0000000000000000-mapping.dmp

Download
memory/2728-764-0x0000000000446E8E-mapping.dmp

Download
memory/2752-429-0x0000000000000000-mapping.dmp

Download
memory/2772-1094-0x0000000000446E8E-mapping.dmp

Download
memory/2792-132-0x0000000000000000-mapping.dmp

Download
memory/2792-156-0x0000000000000000-mapping.dmp

Download
memory/2796-77-0x0000000000446E8E-mapping.dmp

Download
memory/2840-377-0x0000000000446E8E-mapping.dmp

Download
memory/2840-728-0x0000000000446E8E-mapping.dmp

Download
memory/2840-950-0x0000000000446E8E-mapping.dmp

Download
memory/2868-263-0x0000000000446E8E-mapping.dmp

Download
memory/2872-159-0x0000000000000000-mapping.dmp

Download
memory/2888-0-0x0000000000400000-0x000000000044C000-memory.dmp

Filesize
304KB

Download
memory/2888-500-0x0000000000446E8E-mapping.dmp

Download
memory/2888-1-0x0000000000446E8E-mapping.dmp

Download
memory/2896-200-0x0000000000446E8E-mapping.dmp

Download
memory/2908-36-0x0000000000000000-mapping.dmp

Download
memory/2908-257-0x0000000000446E8E-mapping.dmp

Download
memory/2968-893-0x0000000000446E8E-mapping.dmp

Download
memory/2968-809-0x0000000000446E8E-mapping.dmp

Download
memory/2968-1032-0x0000000000000000-mapping.dmp

Download
memory/2968-290-0x0000000000446E8E-mapping.dmp

Download
memory/2976-911-0x0000000000446E8E-mapping.dmp

Download
memory/2976-32-0x0000000000446E8E-mapping.dmp

Download
memory/2976-218-0x0000000000446E8E-mapping.dmp

Download
memory/2980-828-0x0000000000000000-mapping.dmp

Download
memory/2980-110-0x0000000000446E8E-mapping.dmp

Download
memory/2984-65-0x0000000000446E8E-mapping.dmp

Download
memory/3000-537-0x0000000000000000-mapping.dmp

Download
memory/3000-890-0x0000000000446E8E-mapping.dmp

Download
memory/3000-320-0x0000000000446E8E-mapping.dmp

Download
memory/3004-338-0x0000000000446E8E-mapping.dmp

Download
memory/3008-348-0x0000000000000000-mapping.dmp

Download
memory/3024-654-0x0000000000000000-mapping.dmp

Download
memory/3040-152-0x0000000000446E8E-mapping.dmp

Download
memory/3048-698-0x0000000000446E8E-mapping.dmp

Download
memory/3048-30-0x0000000000000000-mapping.dmp

Download
memory/3104-57-0x0000000000000000-mapping.dmp

Download
memory/3136-123-0x0000000000000000-mapping.dmp

Download
memory/3136-335-0x0000000000446E8E-mapping.dmp

Download
memory/3160-558-0x0000000000000000-mapping.dmp

Download
memory/3212-554-0x0000000000446E8E-mapping.dmp

Download
memory/3212-114-0x0000000000000000-mapping.dmp

Download
memory/3212-33-0x0000000000000000-mapping.dmp

Download
memory/3224-362-0x0000000000446E8E-mapping.dmp

Download
memory/3224-567-0x0000000000000000-mapping.dmp

Download
memory/3232-866-0x0000000000446E8E-mapping.dmp

Download
memory/3240-825-0x0000000000000000-mapping.dmp

Download
memory/3240-456-0x0000000000000000-mapping.dmp

Download
memory/3240-248-0x0000000000446E8E-mapping.dmp

Download
memory/3244-371-0x0000000000446E8E-mapping.dmp

Download
memory/3260-213-0x0000000000000000-mapping.dmp

Download
memory/3260-948-0x0000000000000000-mapping.dmp

Download
memory/3260-510-0x0000000000000000-mapping.dmp

Download
memory/3268-594-0x0000000000000000-mapping.dmp

Download
memory/3268-476-0x0000000000446E8E-mapping.dmp

Download
memory/3272-569-0x0000000000446E8E-mapping.dmp

Download
memory/3272-627-0x0000000000000000-mapping.dmp

Download
memory/3292-614-0x0000000000446E8E-mapping.dmp

Download
memory/3292-422-0x0000000000446E8E-mapping.dmp

Download
memory/3292-906-0x0000000000000000-mapping.dmp

Download
memory/3292-149-0x0000000000446E8E-mapping.dmp

Download
memory/3324-1031-0x0000000000446E8E-mapping.dmp

Download
memory/3324-285-0x0000000000000000-mapping.dmp

Download
memory/3324-35-0x0000000000446E8E-mapping.dmp

Download
memory/3324-99-0x0000000000000000-mapping.dmp

Download
memory/3336-512-0x0000000000446E8E-mapping.dmp

Download
memory/3336-644-0x0000000000446E8E-mapping.dmp

Download
memory/3340-5-0x0000000000000000-mapping.dmp

Download
memory/3340-332-0x0000000000446E8E-mapping.dmp

Download
memory/3344-341-0x0000000000446E8E-mapping.dmp

Download
memory/3344-81-0x0000000000000000-mapping.dmp

Download
memory/3348-707-0x0000000000446E8E-mapping.dmp

Download
memory/3348-1004-0x0000000000446E8E-mapping.dmp

Download
memory/3404-552-0x0000000000000000-mapping.dmp

Download
memory/3404-987-0x0000000000000000-mapping.dmp

Download
memory/3404-122-0x0000000000446E8E-mapping.dmp

Download
memory/3412-692-0x0000000000446E8E-mapping.dmp

Download
memory/3412-120-0x0000000000000000-mapping.dmp

Download
memory/3412-138-0x0000000000000000-mapping.dmp

Download
memory/3428-1049-0x0000000000446E8E-mapping.dmp

Download
memory/3456-743-0x0000000000446E8E-mapping.dmp

Download
memory/3456-359-0x0000000000446E8E-mapping.dmp

Download
memory/3456-141-0x0000000000000000-mapping.dmp

Download
memory/3468-143-0x0000000000446E8E-mapping.dmp

Download
memory/3468-798-0x0000000000000000-mapping.dmp

Download
memory/3476-69-0x0000000000000000-mapping.dmp

Download
memory/3476-489-0x0000000000000000-mapping.dmp

Download
memory/3476-746-0x0000000000446E8E-mapping.dmp

Download
memory/3492-557-0x0000000000446E8E-mapping.dmp

Download
memory/3492-413-0x0000000000446E8E-mapping.dmp

Download
memory/3496-11-0x0000000000446E8E-mapping.dmp

Download
memory/3500-600-0x0000000000000000-mapping.dmp

Download
memory/3500-326-0x0000000000446E8E-mapping.dmp

Download
memory/3512-789-0x0000000000000000-mapping.dmp

Download
memory/3524-977-0x0000000000446E8E-mapping.dmp

Download
memory/3540-374-0x0000000000446E8E-mapping.dmp

Download
memory/3548-617-0x0000000000446E8E-mapping.dmp

Download
memory/3552-501-0x0000000000000000-mapping.dmp

Download
memory/3552-398-0x0000000000446E8E-mapping.dmp

Download
memory/3560-137-0x0000000000446E8E-mapping.dmp

Download
memory/3560-837-0x0000000000000000-mapping.dmp

Download
memory/3572-842-0x0000000000446E8E-mapping.dmp

Download
memory/3572-650-0x0000000000446E8E-mapping.dmp

Download
memory/3588-255-0x0000000000000000-mapping.dmp

Download
memory/3588-803-0x0000000000446E8E-mapping.dmp

Download
memory/3608-921-0x0000000000000000-mapping.dmp

Download
memory/3620-711-0x0000000000000000-mapping.dmp

Download
memory/3648-51-0x0000000000000000-mapping.dmp

Download
memory/3648-1002-0x0000000000000000-mapping.dmp

Download
memory/3660-881-0x0000000000446E8E-mapping.dmp

Download
memory/3660-564-0x0000000000000000-mapping.dmp

Download
memory/3660-606-0x0000000000000000-mapping.dmp

Download
memory/3660-245-0x0000000000446E8E-mapping.dmp

Download
memory/3692-783-0x0000000000000000-mapping.dmp

Download
memory/3704-1059-0x0000000000000000-mapping.dmp

Download
memory/3708-753-0x0000000000000000-mapping.dmp

Download
memory/3708-1046-0x0000000000446E8E-mapping.dmp

Download
memory/3716-963-0x0000000000000000-mapping.dmp

Download
memory/3720-852-0x0000000000000000-mapping.dmp

Download
memory/3720-909-0x0000000000000000-mapping.dmp

Download
memory/3720-704-0x0000000000446E8E-mapping.dmp

Download
memory/3724-62-0x0000000000446E8E-mapping.dmp

Download
memory/3724-15-0x0000000000000000-mapping.dmp

Download
memory/3724-899-0x0000000000446E8E-mapping.dmp

Download
memory/3728-240-0x0000000000000000-mapping.dmp

Download
memory/3728-144-0x0000000000000000-mapping.dmp

Download
memory/3736-389-0x0000000000446E8E-mapping.dmp

Download
memory/3736-935-0x0000000000446E8E-mapping.dmp

Download
memory/3736-995-0x0000000000446E8E-mapping.dmp

Download
memory/3764-119-0x0000000000446E8E-mapping.dmp

Download
memory/3764-1043-0x0000000000446E8E-mapping.dmp

Download
memory/3768-767-0x0000000000446E8E-mapping.dmp

Download
memory/3768-135-0x0000000000000000-mapping.dmp

Download
memory/3772-791-0x0000000000446E8E-mapping.dmp

Download
memory/3784-1073-0x0000000000446E8E-mapping.dmp

Download
memory/3788-518-0x0000000000446E8E-mapping.dmp

Download
memory/3788-74-0x0000000000446E8E-mapping.dmp

Download
memory/3792-548-0x0000000000446E8E-mapping.dmp

Download
memory/3792-83-0x0000000000446E8E-mapping.dmp

Download
memory/3792-710-0x0000000000446E8E-mapping.dmp

Download
memory/3796-402-0x0000000000000000-mapping.dmp

Download
memory/3808-708-0x0000000000000000-mapping.dmp

Download
memory/3808-1028-0x0000000000446E8E-mapping.dmp

Download
memory/3808-545-0x0000000000446E8E-mapping.dmp

Download
memory/3808-759-0x0000000000000000-mapping.dmp

Download
memory/3812-642-0x0000000000000000-mapping.dmp

Download
memory/3812-908-0x0000000000446E8E-mapping.dmp

Download
memory/3816-1050-0x0000000000000000-mapping.dmp

Download
memory/3816-629-0x0000000000446E8E-mapping.dmp

Download
memory/3820-164-0x0000000000446E8E-mapping.dmp

Download
memory/3820-1070-0x0000000000446E8E-mapping.dmp

Download
memory/3836-155-0x0000000000446E8E-mapping.dmp

Download
memory/3836-641-0x0000000000446E8E-mapping.dmp

Download
memory/3836-521-0x0000000000446E8E-mapping.dmp

Download
memory/3840-638-0x0000000000446E8E-mapping.dmp

Download
memory/3840-954-0x0000000000000000-mapping.dmp

Download
memory/3848-407-0x0000000000446E8E-mapping.dmp

Download
memory/3848-29-0x0000000000446E8E-mapping.dmp

Download
memory/3848-563-0x0000000000446E8E-mapping.dmp

Download
memory/3852-161-0x0000000000446E8E-mapping.dmp

Download
memory/3852-2-0x0000000000000000-mapping.dmp

Download
memory/3860-276-0x0000000000000000-mapping.dmp

Download
memory/3868-134-0x0000000000446E8E-mapping.dmp

Download
memory/3868-71-0x0000000000446E8E-mapping.dmp

Download
memory/3868-845-0x0000000000446E8E-mapping.dmp

Download
memory/3868-725-0x0000000000446E8E-mapping.dmp

Download
memory/3884-867-0x0000000000000000-mapping.dmp

Download
memory/3884-1074-0x0000000000000000-mapping.dmp

Download
memory/3884-507-0x0000000000000000-mapping.dmp

Download
memory/3892-4-0x0000000000446E8E-mapping.dmp

Download
memory/3892-1067-0x0000000000446E8E-mapping.dmp

Download
memory/3892-212-0x0000000000446E8E-mapping.dmp

Download
memory/3908-411-0x0000000000000000-mapping.dmp

Download
memory/3908-1013-0x0000000000446E8E-mapping.dmp

Download
memory/3908-771-0x0000000000000000-mapping.dmp

Download
memory/3908-354-0x0000000000000000-mapping.dmp

Download
memory/3912-749-0x0000000000446E8E-mapping.dmp

Download
memory/3912-993-0x0000000000000000-mapping.dmp

Download
memory/3912-324-0x0000000000000000-mapping.dmp

Download
memory/3924-878-0x0000000000446E8E-mapping.dmp

Download
memory/3924-540-0x0000000000000000-mapping.dmp

Download
memory/3924-1019-0x0000000000446E8E-mapping.dmp

Download
memory/3932-717-0x0000000000000000-mapping.dmp

Download
memory/3972-369-0x0000000000000000-mapping.dmp

Download
memory/3988-720-0x0000000000000000-mapping.dmp

Download
memory/4000-95-0x0000000000446E8E-mapping.dmp

Download
memory/4000-918-0x0000000000000000-mapping.dmp

Download
memory/4016-768-0x0000000000000000-mapping.dmp

Download
memory/4024-1098-0x0000000000000000-mapping.dmp

Download
memory/4064-915-0x0000000000000000-mapping.dmp

Download
memory/4064-1041-0x0000000000000000-mapping.dmp

Download
memory/4068-452-0x0000000000446E8E-mapping.dmp

Download
memory/4068-668-0x0000000000446E8E-mapping.dmp

Download
memory/4100-896-0x0000000000446E8E-mapping.dmp

Download
memory/4104-524-0x0000000000446E8E-mapping.dmp

Download
memory/4104-438-0x0000000000000000-mapping.dmp

Download
memory/4112-287-0x0000000000446E8E-mapping.dmp

Download
memory/4116-246-0x0000000000000000-mapping.dmp

Download
memory/4128-560-0x0000000000446E8E-mapping.dmp

Download
memory/4136-264-0x0000000000000000-mapping.dmp

Download
memory/4140-737-0x0000000000446E8E-mapping.dmp

Download
memory/4140-447-0x0000000000000000-mapping.dmp

Download
memory/4144-165-0x0000000000000000-mapping.dmp

Download
memory/4148-387-0x0000000000000000-mapping.dmp

Download
memory/4152-855-0x0000000000000000-mapping.dmp

Download
memory/4152-243-0x0000000000000000-mapping.dmp

Download
memory/4156-813-0x0000000000000000-mapping.dmp

Download
memory/4156-858-0x0000000000000000-mapping.dmp

Download
memory/4164-224-0x0000000000446E8E-mapping.dmp

Download
memory/4168-975-0x0000000000000000-mapping.dmp

Download
memory/4172-494-0x0000000000446E8E-mapping.dmp

Download
memory/4172-924-0x0000000000000000-mapping.dmp

Download
memory/4176-420-0x0000000000000000-mapping.dmp

Download
memory/4176-587-0x0000000000446E8E-mapping.dmp

Download
memory/4176-167-0x0000000000446E8E-mapping.dmp

Download
memory/4176-683-0x0000000000446E8E-mapping.dmp

Download
memory/4180-221-0x0000000000446E8E-mapping.dmp

Download
memory/4180-483-0x0000000000000000-mapping.dmp

Download
memory/4188-1017-0x0000000000000000-mapping.dmp

Download
memory/4188-197-0x0000000000446E8E-mapping.dmp

Download
memory/4188-632-0x0000000000446E8E-mapping.dmp

Download
memory/4188-291-0x0000000000000000-mapping.dmp

Download
memory/4192-999-0x0000000000000000-mapping.dmp

Download
memory/4200-957-0x0000000000000000-mapping.dmp

Download
memory/4200-423-0x0000000000000000-mapping.dmp

Download
memory/4200-659-0x0000000000446E8E-mapping.dmp

Download
memory/4208-723-0x0000000000000000-mapping.dmp

Download
memory/4208-414-0x0000000000000000-mapping.dmp

Download
memory/4216-318-0x0000000000000000-mapping.dmp

Download
memory/4216-492-0x0000000000000000-mapping.dmp

Download
memory/4220-966-0x0000000000000000-mapping.dmp

Download
memory/4220-297-0x0000000000000000-mapping.dmp

Download
memory/4224-437-0x0000000000446E8E-mapping.dmp

Download
memory/4228-1008-0x0000000000000000-mapping.dmp

Download
memory/4236-575-0x0000000000446E8E-mapping.dmp

Download
memory/4236-1100-0x0000000000446E8E-mapping.dmp

Download
memory/4236-873-0x0000000000000000-mapping.dmp

Download
memory/4244-1023-0x0000000000000000-mapping.dmp

Download
memory/4244-705-0x0000000000000000-mapping.dmp

Download
memory/4248-588-0x0000000000000000-mapping.dmp

Download
memory/4248-929-0x0000000000446E8E-mapping.dmp

Download
memory/4252-168-0x0000000000000000-mapping.dmp

Download
memory/4252-227-0x0000000000446E8E-mapping.dmp

Download
memory/4252-626-0x0000000000446E8E-mapping.dmp

Download
memory/4252-930-0x0000000000000000-mapping.dmp

Download
memory/4256-509-0x0000000000446E8E-mapping.dmp

Download
memory/4264-410-0x0000000000446E8E-mapping.dmp

Download
memory/4268-225-0x0000000000000000-mapping.dmp

Download
memory/4272-755-0x0000000000446E8E-mapping.dmp

Download
memory/4276-380-0x0000000000446E8E-mapping.dmp

Download
memory/4276-974-0x0000000000446E8E-mapping.dmp

Download
memory/4280-449-0x0000000000446E8E-mapping.dmp

Download
memory/4284-170-0x0000000000446E8E-mapping.dmp

Download
memory/4296-1044-0x0000000000000000-mapping.dmp

Download
memory/4296-903-0x0000000000000000-mapping.dmp

Download
memory/4296-527-0x0000000000446E8E-mapping.dmp

Download
memory/4296-261-0x0000000000000000-mapping.dmp

Download
memory/4300-876-0x0000000000000000-mapping.dmp

Download
memory/4300-647-0x0000000000446E8E-mapping.dmp

Download
memory/4308-1011-0x0000000000000000-mapping.dmp

Download
memory/4312-471-0x0000000000000000-mapping.dmp

Download
memory/4312-666-0x0000000000000000-mapping.dmp

Download
memory/4312-566-0x0000000000446E8E-mapping.dmp

Download
memory/4312-839-0x0000000000446E8E-mapping.dmp

Download
memory/4316-938-0x0000000000446E8E-mapping.dmp

Download
memory/4320-684-0x0000000000000000-mapping.dmp

Download
memory/4328-810-0x0000000000000000-mapping.dmp

Download
memory/4332-222-0x0000000000000000-mapping.dmp

Download
memory/4332-267-0x0000000000000000-mapping.dmp

Download
memory/4336-615-0x0000000000000000-mapping.dmp

Download
memory/4340-491-0x0000000000446E8E-mapping.dmp

Download
memory/4340-321-0x0000000000000000-mapping.dmp

Download
memory/4344-762-0x0000000000000000-mapping.dmp

Download
memory/4344-269-0x0000000000446E8E-mapping.dmp

Download
memory/4344-821-0x0000000000446E8E-mapping.dmp

Download
memory/4348-1086-0x0000000000000000-mapping.dmp

Download
memory/4352-317-0x0000000000446E8E-mapping.dmp

Download
memory/4356-485-0x0000000000446E8E-mapping.dmp

Download
memory/4356-618-0x0000000000000000-mapping.dmp

Download
memory/4360-171-0x0000000000000000-mapping.dmp

Download
memory/4360-663-0x0000000000000000-mapping.dmp

Download
memory/4364-756-0x0000000000000000-mapping.dmp

Download
memory/4368-693-0x0000000000000000-mapping.dmp

Download
memory/4368-651-0x0000000000000000-mapping.dmp

Download
memory/4372-822-0x0000000000000000-mapping.dmp

Download
memory/4372-620-0x0000000000446E8E-mapping.dmp

Download
memory/4376-1077-0x0000000000000000-mapping.dmp

Download
memory/4384-1064-0x0000000000446E8E-mapping.dmp

Download
memory/4384-794-0x0000000000446E8E-mapping.dmp

Download
memory/4388-416-0x0000000000446E8E-mapping.dmp

Download
memory/4392-173-0x0000000000446E8E-mapping.dmp

Download
memory/4396-777-0x0000000000000000-mapping.dmp

Download
memory/4396-933-0x0000000000000000-mapping.dmp

Download
memory/4404-840-0x0000000000000000-mapping.dmp

Download
memory/4412-836-0x0000000000446E8E-mapping.dmp

Download
memory/4416-339-0x0000000000000000-mapping.dmp

Download
memory/4420-827-0x0000000000446E8E-mapping.dmp

Download
memory/4420-296-0x0000000000446E8E-mapping.dmp

Download
memory/4424-797-0x0000000000446E8E-mapping.dmp

Download
memory/4424-1029-0x0000000000000000-mapping.dmp

Download
memory/4428-740-0x0000000000446E8E-mapping.dmp

Download
memory/4432-519-0x0000000000000000-mapping.dmp

Download
memory/4432-731-0x0000000000446E8E-mapping.dmp

Download
memory/4436-480-0x0000000000000000-mapping.dmp

Download
memory/4440-882-0x0000000000000000-mapping.dmp

Download
memory/4440-435-0x0000000000000000-mapping.dmp

Download
memory/4444-1068-0x0000000000000000-mapping.dmp

Download
memory/4444-785-0x0000000000446E8E-mapping.dmp

Download
memory/4448-680-0x0000000000446E8E-mapping.dmp

Download
memory/4448-228-0x0000000000000000-mapping.dmp

Download
memory/4448-830-0x0000000000446E8E-mapping.dmp

Download
memory/4448-392-0x0000000000446E8E-mapping.dmp

Download
memory/4452-1083-0x0000000000000000-mapping.dmp

Download
memory/4456-174-0x0000000000000000-mapping.dmp

Download
memory/4460-804-0x0000000000000000-mapping.dmp

Download
memory/4460-230-0x0000000000446E8E-mapping.dmp

Download
memory/4464-465-0x0000000000000000-mapping.dmp

Download
memory/4472-266-0x0000000000446E8E-mapping.dmp

Download
memory/4472-726-0x0000000000000000-mapping.dmp

Download
memory/4484-864-0x0000000000000000-mapping.dmp

Download
memory/4484-920-0x0000000000446E8E-mapping.dmp

Download
memory/4488-176-0x0000000000446E8E-mapping.dmp

Download
memory/4488-776-0x0000000000446E8E-mapping.dmp

Download
memory/4492-570-0x0000000000000000-mapping.dmp

Download
memory/4492-1079-0x0000000000446E8E-mapping.dmp

Download
memory/4496-323-0x0000000000446E8E-mapping.dmp

Download
memory/4500-378-0x0000000000000000-mapping.dmp

Download
memory/4508-399-0x0000000000000000-mapping.dmp

Download
memory/4516-522-0x0000000000000000-mapping.dmp

Download
memory/4520-648-0x0000000000000000-mapping.dmp

Download
memory/4520-744-0x0000000000000000-mapping.dmp

Download
memory/4520-455-0x0000000000446E8E-mapping.dmp

Download
memory/4520-363-0x0000000000000000-mapping.dmp

Download
memory/4520-419-0x0000000000446E8E-mapping.dmp

Download
memory/4524-1092-0x0000000000000000-mapping.dmp

Download
memory/4536-504-0x0000000000000000-mapping.dmp

Download
memory/4540-944-0x0000000000446E8E-mapping.dmp

Download
memory/4548-272-0x0000000000446E8E-mapping.dmp

Download
memory/4552-344-0x0000000000446E8E-mapping.dmp

Download
memory/4552-177-0x0000000000000000-mapping.dmp

Download
memory/4556-831-0x0000000000000000-mapping.dmp

Download
memory/4560-879-0x0000000000000000-mapping.dmp

Download
memory/4560-635-0x0000000000446E8E-mapping.dmp

Download
memory/4560-932-0x0000000000446E8E-mapping.dmp

Download
memory/4564-486-0x0000000000000000-mapping.dmp

Download
memory/4572-327-0x0000000000000000-mapping.dmp

Download
memory/4576-270-0x0000000000000000-mapping.dmp

Download
memory/4584-440-0x0000000000446E8E-mapping.dmp

Download
memory/4584-179-0x0000000000446E8E-mapping.dmp

Download
memory/4584-1035-0x0000000000000000-mapping.dmp

Download
memory/4584-555-0x0000000000000000-mapping.dmp

Download
memory/4592-393-0x0000000000000000-mapping.dmp

Download
memory/4592-926-0x0000000000446E8E-mapping.dmp

Download
memory/4596-980-0x0000000000446E8E-mapping.dmp

Download
memory/4604-528-0x0000000000000000-mapping.dmp

Download
memory/4608-971-0x0000000000446E8E-mapping.dmp

Download
memory/4608-833-0x0000000000446E8E-mapping.dmp

Download
memory/4612-294-0x0000000000000000-mapping.dmp

Download
memory/4612-965-0x0000000000446E8E-mapping.dmp

Download
memory/4612-786-0x0000000000000000-mapping.dmp

Download
memory/4616-525-0x0000000000000000-mapping.dmp

Download
memory/4624-233-0x0000000000446E8E-mapping.dmp

Download
memory/4628-674-0x0000000000446E8E-mapping.dmp

Download
memory/4640-300-0x0000000000000000-mapping.dmp

Download
memory/4644-1020-0x0000000000000000-mapping.dmp

Download
memory/4648-180-0x0000000000000000-mapping.dmp

Download
memory/4648-848-0x0000000000446E8E-mapping.dmp

Download
memory/4648-236-0x0000000000446E8E-mapping.dmp

Download
memory/4648-345-0x0000000000000000-mapping.dmp

Download
memory/4660-719-0x0000000000446E8E-mapping.dmp

Download
memory/4660-329-0x0000000000446E8E-mapping.dmp

Download
memory/4664-498-0x0000000000000000-mapping.dmp

Download
memory/4668-417-0x0000000000000000-mapping.dmp

Download
memory/4668-576-0x0000000000000000-mapping.dmp

Download
memory/4672-234-0x0000000000000000-mapping.dmp

Download
memory/4676-584-0x0000000000446E8E-mapping.dmp

Download
memory/4676-734-0x0000000000446E8E-mapping.dmp

Download
memory/4680-368-0x0000000000446E8E-mapping.dmp

Download
memory/4688-182-0x0000000000446E8E-mapping.dmp

Download
memory/4696-900-0x0000000000000000-mapping.dmp

Download
memory/4700-780-0x0000000000000000-mapping.dmp

Download
memory/4704-914-0x0000000000446E8E-mapping.dmp

Download
memory/4704-453-0x0000000000000000-mapping.dmp

Download
memory/4704-1085-0x0000000000446E8E-mapping.dmp

Download
memory/4708-678-0x0000000000000000-mapping.dmp

Download
memory/4712-446-0x0000000000446E8E-mapping.dmp

Download
memory/4720-681-0x0000000000000000-mapping.dmp

Download
memory/4720-779-0x0000000000446E8E-mapping.dmp

Download
memory/4728-366-0x0000000000000000-mapping.dmp

Download
memory/4736-536-0x0000000000446E8E-mapping.dmp

Download
memory/4740-722-0x0000000000446E8E-mapping.dmp

Download
memory/4748-278-0x0000000000446E8E-mapping.dmp

Download
memory/4748-549-0x0000000000000000-mapping.dmp

Download
memory/4752-660-0x0000000000000000-mapping.dmp

Download
memory/4752-183-0x0000000000000000-mapping.dmp

Download
memory/4752-1055-0x0000000000446E8E-mapping.dmp

Download
memory/4756-741-0x0000000000000000-mapping.dmp

Download
memory/4756-1014-0x0000000000000000-mapping.dmp

Download
memory/4756-1053-0x0000000000000000-mapping.dmp

Download
memory/4776-428-0x0000000000446E8E-mapping.dmp

Download
memory/4776-1022-0x0000000000446E8E-mapping.dmp

Download
memory/4780-782-0x0000000000446E8E-mapping.dmp

Download
memory/4784-887-0x0000000000446E8E-mapping.dmp

Download
memory/4784-824-0x0000000000446E8E-mapping.dmp

Download
memory/4784-185-0x0000000000446E8E-mapping.dmp

Download
memory/4788-701-0x0000000000446E8E-mapping.dmp

Download
memory/4788-408-0x0000000000000000-mapping.dmp

Download
memory/4788-573-0x0000000000000000-mapping.dmp

Download
memory/4792-231-0x0000000000000000-mapping.dmp

Download
memory/4792-1065-0x0000000000000000-mapping.dmp

Download
memory/4800-572-0x0000000000446E8E-mapping.dmp

Download
memory/4804-854-0x0000000000446E8E-mapping.dmp

Download
memory/4804-713-0x0000000000446E8E-mapping.dmp

Download
memory/4816-927-0x0000000000000000-mapping.dmp

Download
memory/4824-432-0x0000000000000000-mapping.dmp

Download
memory/4824-1056-0x0000000000000000-mapping.dmp

Download
memory/4828-609-0x0000000000000000-mapping.dmp

Download
memory/4832-425-0x0000000000446E8E-mapping.dmp

Download
memory/4832-945-0x0000000000000000-mapping.dmp

Download
memory/4832-237-0x0000000000000000-mapping.dmp

Download
memory/4836-473-0x0000000000446E8E-mapping.dmp

Download
memory/4844-795-0x0000000000000000-mapping.dmp

Download
memory/4848-941-0x0000000000446E8E-mapping.dmp

Download
memory/4848-891-0x0000000000000000-mapping.dmp

Download
memory/4848-186-0x0000000000000000-mapping.dmp

Download
memory/4868-482-0x0000000000446E8E-mapping.dmp

Download
memory/4868-714-0x0000000000000000-mapping.dmp

Download
memory/4872-1034-0x0000000000446E8E-mapping.dmp

Download
memory/4876-1037-0x0000000000446E8E-mapping.dmp

Download
memory/4876-800-0x0000000000446E8E-mapping.dmp

Download
memory/4880-1088-0x0000000000446E8E-mapping.dmp

Download
memory/4884-299-0x0000000000446E8E-mapping.dmp

Download
memory/4884-672-0x0000000000000000-mapping.dmp

Download
memory/4884-1026-0x0000000000000000-mapping.dmp

Download
memory/4888-696-0x0000000000000000-mapping.dmp

Download
memory/4888-188-0x0000000000446E8E-mapping.dmp

Download
memory/4892-350-0x0000000000446E8E-mapping.dmp

Download
memory/4892-585-0x0000000000000000-mapping.dmp

Download
memory/4892-983-0x0000000000446E8E-mapping.dmp

Download
memory/4896-732-0x0000000000000000-mapping.dmp

Download
memory/4896-273-0x0000000000000000-mapping.dmp

Download
memory/4900-905-0x0000000000446E8E-mapping.dmp

Download
memory/4900-716-0x0000000000446E8E-mapping.dmp

Download
memory/4900-846-0x0000000000000000-mapping.dmp

Download
memory/4904-989-0x0000000000446E8E-mapping.dmp

Download
memory/4904-381-0x0000000000000000-mapping.dmp

Download
memory/4916-396-0x0000000000000000-mapping.dmp

Download
memory/4920-690-0x0000000000000000-mapping.dmp

Download
memory/4924-450-0x0000000000000000-mapping.dmp

Download
memory/4924-279-0x0000000000000000-mapping.dmp

Download
memory/4928-765-0x0000000000000000-mapping.dmp

Download
memory/4932-677-0x0000000000446E8E-mapping.dmp

Download
memory/4936-275-0x0000000000446E8E-mapping.dmp

Download
memory/4948-605-0x0000000000446E8E-mapping.dmp

Download
memory/4948-333-0x0000000000000000-mapping.dmp

Download
memory/4956-189-0x0000000000000000-mapping.dmp

Download
memory/4964-1095-0x0000000000000000-mapping.dmp

Download
memory/4972-395-0x0000000000446E8E-mapping.dmp

Download
memory/4976-623-0x0000000000446E8E-mapping.dmp

Download
memory/4976-242-0x0000000000446E8E-mapping.dmp

Download
memory/4976-917-0x0000000000446E8E-mapping.dmp

Download
memory/4980-306-0x0000000000000000-mapping.dmp

Download
memory/4984-330-0x0000000000000000-mapping.dmp

Download
memory/4984-872-0x0000000000446E8E-mapping.dmp

Download
memory/4984-372-0x0000000000000000-mapping.dmp

Download
memory/4988-990-0x0000000000000000-mapping.dmp

Download
memory/4988-191-0x0000000000446E8E-mapping.dmp

Download
memory/4992-431-0x0000000000446E8E-mapping.dmp

Download
memory/4992-599-0x0000000000446E8E-mapping.dmp

Download
memory/4996-347-0x0000000000446E8E-mapping.dmp

Download
memory/4996-869-0x0000000000446E8E-mapping.dmp

Download
memory/5000-675-0x0000000000000000-mapping.dmp

Download
memory/5008-513-0x0000000000000000-mapping.dmp

Download
memory/5008-968-0x0000000000446E8E-mapping.dmp

Download
memory/5012-1071-0x0000000000000000-mapping.dmp

Download
memory/5012-758-0x0000000000446E8E-mapping.dmp

Download
memory/5012-608-0x0000000000446E8E-mapping.dmp

Download
memory/5020-281-0x0000000000446E8E-mapping.dmp

Download
memory/5020-695-0x0000000000446E8E-mapping.dmp

Download
memory/5028-1038-0x0000000000000000-mapping.dmp

Download
memory/5028-581-0x0000000000446E8E-mapping.dmp

Download
memory/5032-888-0x0000000000000000-mapping.dmp

Download
memory/5044-939-0x0000000000000000-mapping.dmp

Download
memory/5048-729-0x0000000000000000-mapping.dmp

Download
memory/5052-969-0x0000000000000000-mapping.dmp

Download
memory/5052-192-0x0000000000000000-mapping.dmp

Download
memory/5056-624-0x0000000000000000-mapping.dmp

Download
memory/5056-902-0x0000000000446E8E-mapping.dmp

Download
memory/5060-996-0x0000000000000000-mapping.dmp

Download
memory/5064-531-0x0000000000000000-mapping.dmp

Download
memory/5072-686-0x0000000000446E8E-mapping.dmp

Download
memory/5076-1040-0x0000000000446E8E-mapping.dmp

Download
memory/5080-474-0x0000000000000000-mapping.dmp

Download
memory/5092-194-0x0000000000446E8E-mapping.dmp

Download
memory/5096-591-0x0000000000000000-mapping.dmp

Download
memory/5096-936-0x0000000000000000-mapping.dmp

Download
memory/5100-239-0x0000000000446E8E-mapping.dmp

Download
memory/5100-288-0x0000000000000000-mapping.dmp

Download
memory/5104-479-0x0000000000446E8E-mapping.dmp

Download
memory/5104-992-0x0000000000446E8E-mapping.dmp

Download
memory/5112-819-0x0000000000000000-mapping.dmp

Download