lokibot | 4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793

Analysis

max time kernel
150s
max time network
153s
platform
windows10_x64
resource
win10v200430
submitted
09-07-2020 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Size

263KB
MD5

e1204f68e985164c7c87828095f5bcb6
SHA1

67e5b6c6c5cd7f5fc50d63063de04db9ddfd218e
SHA256

4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793
SHA512

015962a5572986be335ea9e6691573a3396ee3864fb5b3b7da1f462127b102aef27a772b9b881802e2256edc52ba63c8476d7119326f81797381f3c3f30113d9

Score

10^/10

trojan spyware stealer lokibot

Malware Config

Extracted

Family

lokibot

http://195.69.140.147/.op/cr.php/vms5lZmxPBbEN

http://kbfvzoboss.bid/alien/fre.php

http://alphastand.trade/alien/fre.php

http://alphastand.win/alien/fre.php

http://alphastand.top/alien/fre.php

Signatures

Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Suspicious use of WriteProcessMemory 2156 IoCs

Processes:

description	pid	process	target process
PID 1648 wrote to memory of 1840	1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1648 wrote to memory of 1840	1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1648 wrote to memory of 1840	1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1648 wrote to memory of 1840	1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1648 wrote to memory of 2136	1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 1648 wrote to memory of 2136	1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 1648 wrote to memory of 2136	1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 2136 wrote to memory of 2192	2136	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2136 wrote to memory of 2192	2136	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2136 wrote to memory of 2192	2136	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2136 wrote to memory of 2192	2136	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2136 wrote to memory of 2864	2136	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 2136 wrote to memory of 2864	2136	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 2136 wrote to memory of 2864	2136	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 2864 wrote to memory of 3684	2864	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2864 wrote to memory of 3684	2864	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2864 wrote to memory of 3684	2864	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2864 wrote to memory of 3684	2864	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2864 wrote to memory of 3932	2864	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 2864 wrote to memory of 3932	2864	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 2864 wrote to memory of 3932	2864	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 3932 wrote to memory of 764	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 764	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 764	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 3828	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 3828	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 3828	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 3844	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 3844	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 3844	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 3872	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 3872	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 3872	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 3872	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 wrote to memory of 3708	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 3932 wrote to memory of 3708	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 3932 wrote to memory of 3708	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 3708 wrote to memory of 3060	3708	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3708 wrote to memory of 3060	3708	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3708 wrote to memory of 3060	3708	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3708 wrote to memory of 3060	3708	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3708 wrote to memory of 736	3708	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 3708 wrote to memory of 736	3708	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 3708 wrote to memory of 736	3708	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 736 wrote to memory of 440	736	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 736 wrote to memory of 440	736	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 736 wrote to memory of 440	736	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 736 wrote to memory of 440	736	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 736 wrote to memory of 696	736	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 736 wrote to memory of 696	736	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 736 wrote to memory of 696	736	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 696 wrote to memory of 1264	696	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 696 wrote to memory of 1264	696	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 696 wrote to memory of 1264	696	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 696 wrote to memory of 1264	696	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 696 wrote to memory of 1456	696	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 696 wrote to memory of 1456	696	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 696 wrote to memory of 1456	696	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 1456 wrote to memory of 1260	1456	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1456 wrote to memory of 1260	1456	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1456 wrote to memory of 1260	1456	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1456 wrote to memory of 1260	1456	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1456 wrote to memory of 1124	1456	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
PID 1456 wrote to memory of 1124	1456	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe

Suspicious behavior: MapViewOfSection 373 IoCs

Processes:

pid	process
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2136	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2864	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3708	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
736	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
696	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1456	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1124	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2032	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2032	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2032	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2116	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2116	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2116	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2116	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3680	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3784	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3772	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1912	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2992	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2992	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3348	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3348	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1988	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1060	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2148	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3060	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3060	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
428	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
428	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
428	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
428	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3020	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3020	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3544	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
4000	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
948	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
948	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3700	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2032	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2292	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3176	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3716	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3716	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3776	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3776	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1824	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1820	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1820	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1820	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1240	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
2448	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1260	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1260	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3680	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3680	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3680	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1444	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
3936	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe

Suspicious use of SetThreadContext 260 IoCs

Processes:

4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe

description	pid	process	target process
PID 1648 set thread context of 1840	1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2136 set thread context of 2192	2136	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2864 set thread context of 3684	2864	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3932 set thread context of 3872	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3708 set thread context of 3060	3708	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 736 set thread context of 440	736	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 696 set thread context of 1264	696	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1456 set thread context of 1260	1456	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1124 set thread context of 3720	1124	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2032 set thread context of 3776	2032	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2116 set thread context of 3684	2116	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3680 set thread context of 3852	3680	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3784 set thread context of 428	3784	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3772 set thread context of 1900	3772	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1912 set thread context of 3708	1912	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2992 set thread context of 1132	2992	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3348 set thread context of 2092	3348	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1988 set thread context of 2192	1988	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1060 set thread context of 1924	1060	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2148 set thread context of 2528	2148	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3060 set thread context of 2576	3060	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 428 set thread context of 3080	428	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3020 set thread context of 1004	3020	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3544 set thread context of 3688	3544	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 4000 set thread context of 3760	4000	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 948 set thread context of 3720	948	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3700 set thread context of 2096	3700	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 648 set thread context of 1988	648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2032 set thread context of 2144	2032	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2292 set thread context of 3652	2292	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3176 set thread context of 3696	3176	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3716 set thread context of 3792	3716	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3776 set thread context of 3052	3776	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1824 set thread context of 432	1824	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1820 set thread context of 3328	1820	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1240 set thread context of 2040	1240	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2448 set thread context of 1680	2448	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1260 set thread context of 4028	1260	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3680 set thread context of 3708	3680	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1444 set thread context of 3892	1444	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3936 set thread context of 3544	3936	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3472 set thread context of 2704	3472	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2492 set thread context of 2804	2492	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 376 set thread context of 1064	376	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3844 set thread context of 2116	3844	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 764 set thread context of 1000	764	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2304 set thread context of 3264	2304	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2524 set thread context of 2112	2524	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1812 set thread context of 3060	1812	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1836 set thread context of 3600	1836	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2704 set thread context of 3020	2704	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 972 set thread context of 848	972	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3776 set thread context of 3720	3776	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3920 set thread context of 3676	3920	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2724 set thread context of 2128	2724	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3668 set thread context of 576	3668	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 528 set thread context of 1828	528	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3680 set thread context of 1648	3680	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3832 set thread context of 2912	3832	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 3856 set thread context of 1252	3856	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2864 set thread context of 2748	2864	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1936 set thread context of 1232	1936	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 1832 set thread context of 1824	1832	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe
PID 2488 set thread context of 2536	2488	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 293 IoCs

Processes:

4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exeRegAsm.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exeRegAsm.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exeRegAsm.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exeRegAsm.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exeRegAsm.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exeRegAsm.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exeRegAsm.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe

description	pid	process
Token: SeDebugPrivilege	1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	2136	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1840	RegAsm.exe
Token: SeDebugPrivilege	2864	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3932	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3708	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	736	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	696	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1456	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1124	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	2032	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1264	RegAsm.exe
Token: SeDebugPrivilege	2116	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3680	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3784	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3772	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1912	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	2992	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3348	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1988	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1060	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1132	RegAsm.exe
Token: SeDebugPrivilege	2148	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3060	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	428	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3020	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3544	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	4000	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	948	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3700	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3688	RegAsm.exe
Token: SeDebugPrivilege	648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	2032	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	2292	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3176	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3716	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3776	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1824	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1820	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1240	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3052	RegAsm.exe
Token: SeDebugPrivilege	2448	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1260	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3680	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1444	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3936	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3472	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	2492	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	376	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3544	RegAsm.exe
Token: SeDebugPrivilege	3844	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	764	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	2304	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	2524	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1812	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	1836	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	2704	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	972	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3600	RegAsm.exe
Token: SeDebugPrivilege	3776	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3920	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	2724	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	3668	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
Token: SeDebugPrivilege	528	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe

Suspicious behavior: EnumeratesProcesses 63697 IoCs

Processes:

4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe

pid	process
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
1648	4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2136

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:2192

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
PID:3684

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:3828

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:3844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
PID:3872

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
5⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
6⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
PID:440

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
7⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:1264

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
8⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
9⤵
PID:1260

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
10⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
PID:2492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
PID:1684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
PID:3776

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
PID:3648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
PID:3892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
PID:3848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
PID:3684

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
13⤵
PID:3852

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
14⤵
PID:428

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
15⤵
PID:1900

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
16⤵
PID:3708

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
17⤵
PID:3472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
17⤵
- Suspicious use of AdjustPrivilegeToken
PID:1132

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
18⤵
PID:2268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
18⤵
PID:2092

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
18⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
19⤵
PID:2192

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
19⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
20⤵
PID:1924

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
20⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2148

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
21⤵
PID:2528

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
21⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
22⤵
PID:2112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
22⤵
PID:2576

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
22⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
23⤵
PID:968

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
23⤵
PID:3768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
23⤵
PID:3652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
23⤵
PID:3080

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
23⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
24⤵
PID:2768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
24⤵
PID:1004

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
24⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
- Suspicious use of AdjustPrivilegeToken
PID:3688

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
25⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
26⤵
PID:3760

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
26⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:948

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
27⤵
PID:1072

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
27⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
27⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
28⤵
PID:2096

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
28⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
29⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
29⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
30⤵
PID:2144

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
30⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
31⤵
PID:3652

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
31⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
32⤵
PID:3696

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
32⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3716

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
33⤵
PID:3016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
33⤵
PID:3792

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
33⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
34⤵
PID:440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
34⤵
- Suspicious use of AdjustPrivilegeToken
PID:3052

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
34⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
35⤵
PID:432

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
35⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
36⤵
PID:848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
36⤵
PID:2120

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
36⤵
PID:3328

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
36⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
37⤵
PID:2040

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
37⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2448

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
38⤵
PID:1680

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
38⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
39⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
39⤵
PID:4028

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
39⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
40⤵
PID:3584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
40⤵
PID:3704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
40⤵
PID:3708

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
40⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1444

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:3892

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
41⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
42⤵
- Suspicious use of AdjustPrivilegeToken
PID:3544

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
42⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
43⤵
PID:2704

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
43⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
44⤵
PID:2804

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
44⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
45⤵
PID:1064

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
45⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3844

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
46⤵
PID:2116

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
46⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
47⤵
PID:1000

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
47⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2304

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
48⤵
PID:3264

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
48⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
49⤵
PID:2112

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
49⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
50⤵
PID:2904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
50⤵
PID:2064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
50⤵
PID:3332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
50⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
50⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
51⤵
- Suspicious use of AdjustPrivilegeToken
PID:3600

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
51⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:2152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:2156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:3020

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
52⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
53⤵
PID:848

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
53⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
54⤵
PID:3720

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
54⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
55⤵
PID:3676

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
55⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
56⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
56⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
57⤵
PID:576

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
57⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
58⤵
PID:2268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
58⤵
PID:1828

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
58⤵
- Suspicious use of SetThreadContext
PID:3680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
59⤵
PID:1648

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
59⤵
- Suspicious use of SetThreadContext
PID:3832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
60⤵
PID:2136

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
60⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
60⤵
- Suspicious use of SetThreadContext
PID:3856

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
61⤵
PID:3724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
61⤵
PID:1252

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
61⤵
- Suspicious use of SetThreadContext
PID:2864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
62⤵
PID:2748

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
62⤵
- Suspicious use of SetThreadContext
PID:1936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
63⤵
PID:1232

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
63⤵
- Suspicious use of SetThreadContext
PID:1832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
64⤵
PID:1824

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
64⤵
- Suspicious use of SetThreadContext
PID:2488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
65⤵
PID:2536

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
65⤵
PID:1924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
66⤵
PID:3780

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
66⤵
PID:440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
67⤵
PID:2124

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
67⤵
PID:2692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
68⤵
PID:1260

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
68⤵
PID:1316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
69⤵
PID:3360

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
69⤵
PID:2208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
70⤵
PID:1928

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
70⤵
PID:760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
71⤵
PID:3020

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
71⤵
PID:3776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
72⤵
PID:1436

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
72⤵
PID:2112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
73⤵
PID:3472

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
73⤵
PID:1060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
74⤵
PID:2116

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
74⤵
PID:1920

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
74⤵
PID:3016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
75⤵
PID:1532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
75⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
75⤵
PID:2064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
76⤵
PID:3816

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
76⤵
PID:1572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
77⤵
PID:820

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
77⤵
PID:3572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
78⤵
PID:2040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
78⤵
PID:3972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
78⤵
PID:1836

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
78⤵
PID:2912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
79⤵
PID:3176

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
79⤵
PID:656

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
79⤵
PID:1252

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
80⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
80⤵
PID:3936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
81⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
81⤵
PID:428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
82⤵
PID:2868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
82⤵
PID:3776

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
82⤵
PID:1824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
83⤵
PID:3864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
83⤵
PID:3872

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
83⤵
PID:3684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
84⤵
PID:2488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
84⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
84⤵
PID:2724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
85⤵
PID:3828

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
85⤵
PID:3264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
86⤵
PID:432

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
86⤵
PID:3484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
87⤵
PID:1140

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
87⤵
PID:648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
88⤵
PID:3584

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
88⤵
PID:2124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
89⤵
PID:2092

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
89⤵
PID:1920

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
90⤵
PID:3768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
90⤵
PID:3832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
90⤵
PID:3632

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
90⤵
PID:3604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
91⤵
PID:2992

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
91⤵
PID:3452

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
92⤵
PID:3696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
92⤵
PID:3884

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
92⤵
PID:2160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
93⤵
PID:1936

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
93⤵
PID:2064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
94⤵
PID:3620

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
94⤵
PID:1900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
95⤵
PID:3668

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
95⤵
PID:736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
96⤵
PID:1772

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
96⤵
PID:3040

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
96⤵
PID:3584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
97⤵
PID:356

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
97⤵
PID:3796

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
97⤵
PID:1436

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
98⤵
PID:3052

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
98⤵
PID:3708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
99⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
99⤵
PID:492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
100⤵
PID:1832

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
100⤵
PID:1064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
100⤵
PID:3468

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
100⤵
PID:3784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
101⤵
PID:2032

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
101⤵
PID:3816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
102⤵
PID:3872

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
102⤵
PID:1648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
103⤵
PID:2536

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
103⤵
PID:2156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
104⤵
PID:3844

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
104⤵
PID:3632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
105⤵
PID:3296

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
105⤵
PID:4000

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
105⤵
PID:2092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
106⤵
PID:3852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
106⤵
PID:2288

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
106⤵
PID:2800

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
106⤵
PID:3052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
107⤵
PID:3676

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
107⤵
PID:4084

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
107⤵
PID:4076

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
108⤵
PID:1316

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
108⤵
PID:1124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
109⤵
PID:916

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
109⤵
PID:3708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
110⤵
PID:3080

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
110⤵
PID:3788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
111⤵
PID:3872

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
111⤵
PID:2692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
112⤵
PID:1672

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
112⤵
PID:3384

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
112⤵
PID:3404

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
112⤵
PID:3016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
113⤵
PID:3844

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
113⤵
PID:1908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
114⤵
PID:3296

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
114⤵
PID:2136

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
115⤵
PID:732

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
115⤵
PID:1840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
116⤵
PID:3920

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
116⤵
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
117⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
117⤵
PID:3960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
118⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
118⤵
PID:4072

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
119⤵
PID:1000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
119⤵
PID:3904

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
119⤵
PID:1124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
120⤵
PID:3848

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
120⤵
PID:1820

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
120⤵
PID:3708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
121⤵
PID:4000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
121⤵
PID:2488

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
121⤵
PID:3888

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
122⤵
PID:3084

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
122⤵
PID:4028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
123⤵
PID:2800

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
123⤵
PID:2064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
124⤵
PID:3176

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
124⤵
PID:2156

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
125⤵
PID:2780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
125⤵
PID:1316

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
125⤵
PID:2136

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
126⤵
PID:2888

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
126⤵
PID:1840

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
127⤵
PID:524

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
127⤵
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
128⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
128⤵
PID:3472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
129⤵
PID:3820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
129⤵
PID:1936

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
129⤵
PID:3348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
130⤵
PID:3680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
130⤵
PID:1264

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
130⤵
PID:492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
131⤵
PID:652

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
131⤵
PID:3756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
132⤵
PID:3396

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
132⤵
PID:3600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
133⤵
PID:3920

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
133⤵
PID:1140

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
134⤵
PID:1532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
134⤵
PID:2780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
134⤵
PID:1316

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
134⤵
PID:2912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
135⤵
PID:1224

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
135⤵
PID:1900

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
136⤵
PID:3104

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
136⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
137⤵
PID:3904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
137⤵
PID:3684

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
137⤵
PID:3652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
138⤵
PID:3856

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
138⤵
PID:4032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
139⤵
PID:2284

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
139⤵
PID:2748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
140⤵
PID:3708

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
140⤵
PID:2052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
141⤵
PID:2384

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
141⤵
PID:2108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
142⤵
PID:1648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
142⤵
PID:3632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
142⤵
PID:3724

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
142⤵
PID:3756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
143⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
143⤵
PID:3712

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
144⤵
PID:2804

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
144⤵
PID:4076

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
144⤵
PID:3140

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
145⤵
PID:1684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
145⤵
PID:4024

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
145⤵
PID:2032

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
145⤵
PID:1516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
146⤵
PID:1920

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
146⤵
PID:2136

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
147⤵
PID:3620

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
147⤵
PID:576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
148⤵
PID:2112

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
148⤵
PID:3864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
148⤵
PID:3384

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
148⤵
PID:1248

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
149⤵
PID:3768

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
149⤵
PID:1572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
150⤵
PID:2384

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
150⤵
PID:3472

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
150⤵
PID:3264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
151⤵
PID:3716

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
151⤵
PID:3928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
152⤵
PID:3332

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
152⤵
PID:1924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
153⤵
PID:3684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
153⤵
PID:2064

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
153⤵
PID:1908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
154⤵
PID:2912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
154⤵
PID:3872

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
154⤵
PID:648

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
155⤵
PID:2116

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
155⤵
PID:3484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
156⤵
PID:1556

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
156⤵
PID:1076

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
157⤵
PID:4000

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
157⤵
PID:3820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
158⤵
PID:3392

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
158⤵
PID:2580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
159⤵
PID:1832

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
159⤵
PID:3780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
160⤵
PID:1672

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
160⤵
PID:3012

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
161⤵
PID:1572

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
161⤵
PID:3332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
162⤵
PID:3404

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
162⤵
PID:3684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
163⤵
PID:820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
163⤵
PID:3788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
163⤵
PID:3928

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
163⤵
PID:2108

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
164⤵
PID:2268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
164⤵
PID:2704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
164⤵
PID:3704

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
164⤵
PID:524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
165⤵
PID:1908

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
165⤵
PID:3904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
166⤵
PID:648

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
166⤵
PID:3696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
167⤵
PID:1836

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
167⤵
PID:2992

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
167⤵
PID:2488

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
168⤵
PID:3852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
168⤵
PID:1004

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
168⤵
PID:1264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
169⤵
PID:2804

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
169⤵
PID:3936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
170⤵
PID:3104

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
170⤵
PID:2524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
171⤵
PID:1896

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
171⤵
PID:3868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
172⤵
PID:1772

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
172⤵
PID:3784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
173⤵
PID:432

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
173⤵
PID:3892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
173⤵
PID:1064

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
173⤵
PID:492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
174⤵
PID:2208

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
174⤵
PID:2724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
174⤵
PID:2112

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
174⤵
PID:948

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
175⤵
PID:1516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
175⤵
PID:2304

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
175⤵
PID:3604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
176⤵
PID:1652

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
176⤵
PID:3796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
177⤵
PID:1112

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
177⤵
PID:652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
178⤵
PID:1912

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
178⤵
PID:1524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
179⤵
PID:3596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
179⤵
PID:3544

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
179⤵
PID:3764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
180⤵
PID:3848

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
180⤵
PID:4032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
181⤵
PID:3960

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
181⤵
PID:2536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
182⤵
PID:3888

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
182⤵
PID:3928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
183⤵
PID:60

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
183⤵
PID:4024

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
184⤵
PID:3812

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
184⤵
PID:1516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
185⤵
PID:3684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
185⤵
PID:4084

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
185⤵
PID:3080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
186⤵
PID:524

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
186⤵
PID:2284

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
187⤵
PID:1008

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
187⤵
PID:2452

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
188⤵
PID:2188

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
188⤵
PID:3584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
189⤵
PID:3016

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
189⤵
PID:2784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
190⤵
PID:1232

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
190⤵
PID:3060

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
190⤵
PID:3708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
191⤵
PID:2988

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
191⤵
PID:2748

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
192⤵
PID:1240

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
192⤵
PID:60

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
193⤵
PID:2332

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
193⤵
PID:3972

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
194⤵
PID:736

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
194⤵
PID:3704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
195⤵
PID:3732

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
195⤵
PID:524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
196⤵
PID:740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
196⤵
PID:3756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
196⤵
PID:1124

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
196⤵
PID:760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
197⤵
PID:3632

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
197⤵
PID:4000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
198⤵
PID:576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
198⤵
PID:1820

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
198⤵
PID:1000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:3596

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:3348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:1928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
199⤵
PID:1064

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
199⤵
PID:2268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
200⤵
PID:1224

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
200⤵
PID:2888

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
200⤵
PID:696

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
200⤵
PID:3960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
201⤵
PID:3600

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
201⤵
PID:3708

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
202⤵
PID:2092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
202⤵
PID:3884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
202⤵
PID:3788

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
202⤵
PID:376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
203⤵
PID:1564

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
203⤵
PID:3676

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
204⤵
PID:3852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
204⤵
PID:3604

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
204⤵
PID:2348

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
204⤵
PID:3692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
205⤵
PID:3872

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
205⤵
PID:3060

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
206⤵
PID:732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
206⤵
PID:2492

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
206⤵
PID:4032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
207⤵
PID:3596

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
207⤵
PID:3016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
208⤵
PID:1452

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
208⤵
PID:916

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
209⤵
PID:868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
209⤵
PID:656

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
209⤵
PID:1988

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
209⤵
PID:2268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
210⤵
PID:4064

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
210⤵
PID:2148

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
210⤵
PID:3888

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
211⤵
PID:3908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
211⤵
PID:1564

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
211⤵
PID:820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
212⤵
PID:3700

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
212⤵
PID:2040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
213⤵
PID:3768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
213⤵
PID:1456

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
213⤵
PID:2244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
214⤵
PID:3348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
214⤵
PID:1928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
214⤵
PID:2128

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
214⤵
PID:3828

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
215⤵
PID:1672

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
215⤵
PID:3780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
216⤵
PID:3584

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
216⤵
PID:4032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
217⤵
PID:1444

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
217⤵
PID:528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
218⤵
PID:2784

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
218⤵
PID:3452

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
219⤵
PID:1684

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
219⤵
PID:4028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
220⤵
PID:2268

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
220⤵
PID:3852

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
220⤵
PID:1824

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
221⤵
PID:3196

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
221⤵
PID:864

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
221⤵
PID:3020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
222⤵
PID:2492

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
222⤵
PID:736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
223⤵
PID:3716

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
223⤵
PID:524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
224⤵
PID:3300

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
224⤵
PID:3764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
225⤵
PID:2244

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
225⤵
PID:3264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
226⤵
PID:2780

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
226⤵
PID:3904

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
227⤵
PID:2116

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
227⤵
PID:4000

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
228⤵
PID:3140

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
228⤵
PID:2332

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
229⤵
PID:428

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
229⤵
PID:1924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
230⤵
PID:3296

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
230⤵
PID:2020

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
231⤵
PID:3096

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
231⤵
PID:2492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
232⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
232⤵
PID:356

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
233⤵
PID:1004

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
233⤵
PID:732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
234⤵
PID:376

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
234⤵
PID:1008

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
234⤵
PID:3704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
235⤵
PID:1936

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
235⤵
PID:1524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
236⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
236⤵
PID:2120

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
237⤵
PID:2768

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
237⤵
PID:3608

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
238⤵
PID:1768

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
238⤵
PID:3788

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
238⤵
PID:3816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
239⤵
PID:3016

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
239⤵
PID:2148

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
240⤵
PID:4076

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
240⤵
PID:2580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
241⤵
PID:2988

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
241⤵
PID:2152

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
242⤵
PID:4072

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
242⤵
PID:576

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
242⤵
PID:3424

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
243⤵
PID:2492

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
243⤵
PID:1556

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
244⤵
PID:356

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
244⤵
PID:3040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
245⤵
PID:732

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
245⤵
PID:3676

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
246⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
246⤵
PID:2536

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
247⤵
PID:440

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
247⤵
PID:2092

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
248⤵
PID:3812

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
248⤵
PID:740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
249⤵
PID:2348

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
249⤵
PID:3852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
250⤵
PID:1456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
250⤵
PID:3684

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
250⤵
PID:3052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
251⤵
PID:916

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
251⤵
PID:576

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
252⤵
PID:2864

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
252⤵
PID:3960

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
253⤵
PID:3456

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
253⤵
PID:3680

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
254⤵
PID:3080

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
254⤵
PID:1912

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
255⤵
PID:3396

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
255⤵
PID:3704

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
256⤵
PID:2704

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
256⤵
PID:3612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
257⤵
PID:2768

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
257⤵
PID:696

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
258⤵
PID:3900

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
258⤵
PID:3788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
259⤵
PID:3688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
259⤵
PID:2332

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
259⤵
PID:3780

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
260⤵
PID:3792

C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe
"C:\Users\Admin\AppData\Local\Temp\4fcb2d6dd4e6699e31ef782cdb40bdf65c388311c72952702e8f3024c46c2793.exe"
260⤵
PID:3360

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
261⤵
PID:2988

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
261⤵
PID:3972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\05005B\BEE97C.exe

Download Submit
C:\Users\Admin\AppData\Roaming\05005B\BEE97C.hdb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1231583446-2617009595-2137880041-1000\0f5007522459c86e95ffcc62f32308f1_3e009a64-65d7-465c-9098-f2673dd3f416

Download Submit
memory/60-749-0x00000000004139DE-mapping.dmp

Download
memory/60-788-0x0000000000000000-mapping.dmp

Download
memory/356-953-0x0000000000000000-mapping.dmp

Download
memory/356-1001-0x00000000004139DE-mapping.dmp

Download
memory/376-178-0x0000000000000000-mapping.dmp

Download
memory/376-830-0x0000000000000000-mapping.dmp

Download
memory/428-939-0x00000000004139DE-mapping.dmp

Download
memory/428-52-0x00000000004139DE-mapping.dmp

Download
memory/428-87-0x0000000000000000-mapping.dmp

Download
memory/428-330-0x0000000000000000-mapping.dmp

Download
memory/432-138-0x00000000004139DE-mapping.dmp

Download
memory/432-349-0x00000000004139DE-mapping.dmp

Download
memory/440-21-0x00000000004139DE-mapping.dmp

Download
memory/440-268-0x0000000000000000-mapping.dmp

Download
memory/440-1013-0x00000000004139DE-mapping.dmp

Download
memory/492-532-0x0000000000000000-mapping.dmp

Download
memory/492-710-0x0000000000000000-mapping.dmp

Download
memory/492-405-0x0000000000000000-mapping.dmp

Download
memory/524-673-0x0000000000000000-mapping.dmp

Download
memory/524-801-0x0000000000000000-mapping.dmp

Download
memory/524-518-0x00000000004139DE-mapping.dmp

Download
memory/524-762-0x00000000004139DE-mapping.dmp

Download
memory/524-916-0x0000000000000000-mapping.dmp

Download
memory/528-891-0x0000000000000000-mapping.dmp

Download
memory/528-231-0x0000000000000000-mapping.dmp

Download
memory/576-603-0x0000000000000000-mapping.dmp

Download
memory/576-229-0x00000000004139DE-mapping.dmp

Download
memory/576-1032-0x0000000000000000-mapping.dmp

Download
memory/576-993-0x00000000004139DE-mapping.dmp

Download
memory/648-631-0x0000000000000000-mapping.dmp

Download
memory/648-112-0x0000000000000000-mapping.dmp

Download
memory/648-355-0x0000000000000000-mapping.dmp

Download
memory/648-679-0x00000000004139DE-mapping.dmp

Download
memory/652-726-0x0000000000000000-mapping.dmp

Download
memory/652-535-0x00000000004139DE-mapping.dmp

Download
memory/656-320-0x00000000004139DE-mapping.dmp

Download
memory/696-23-0x0000000000000000-mapping.dmp

Download
memory/696-819-0x00000000004139DE-mapping.dmp

Download
memory/696-1057-0x0000000000000000-mapping.dmp

Download
memory/732-468-0x00000000004139DE-mapping.dmp

Download
memory/732-1005-0x00000000004139DE-mapping.dmp

Download
memory/732-958-0x0000000000000000-mapping.dmp

Download
memory/736-19-0x0000000000000000-mapping.dmp

Download
memory/736-794-0x00000000004139DE-mapping.dmp

Download
memory/736-912-0x0000000000000000-mapping.dmp

Download
memory/736-388-0x0000000000000000-mapping.dmp

Download
memory/740-1019-0x0000000000000000-mapping.dmp

Download
memory/760-805-0x0000000000000000-mapping.dmp

Download
memory/760-285-0x0000000000000000-mapping.dmp

Download
memory/764-186-0x0000000000000000-mapping.dmp

Download
memory/820-867-0x0000000000000000-mapping.dmp

Download
memory/820-312-0x00000000004139DE-mapping.dmp

Download
memory/848-213-0x00000000004139DE-mapping.dmp

Download
memory/864-906-0x00000000004139DE-mapping.dmp

Download
memory/916-854-0x0000000000000000-mapping.dmp

Download
memory/916-1030-0x00000000004139DE-mapping.dmp

Download
memory/916-444-0x00000000004139DE-mapping.dmp

Download
memory/948-714-0x0000000000000000-mapping.dmp

Download
memory/948-103-0x0000000000000000-mapping.dmp

Download
memory/972-210-0x0000000000000000-mapping.dmp

Download
memory/1000-813-0x0000000000000000-mapping.dmp

Download
memory/1000-188-0x00000000004139DE-mapping.dmp

Download
memory/1004-93-0x00000000004139DE-mapping.dmp

Download
memory/1004-956-0x00000000004139DE-mapping.dmp

Download
memory/1004-687-0x00000000004139DE-mapping.dmp

Download
memory/1008-766-0x00000000004139DE-mapping.dmp

Download
memory/1008-960-0x00000000004139DE-mapping.dmp

Download
memory/1060-75-0x0000000000000000-mapping.dmp

Download
memory/1060-297-0x0000000000000000-mapping.dmp

Download
memory/1064-180-0x00000000004139DE-mapping.dmp

Download
memory/1064-815-0x00000000004139DE-mapping.dmp

Download
memory/1064-708-0x00000000004139DE-mapping.dmp

Download
memory/1076-640-0x0000000000000000-mapping.dmp

Download
memory/1112-724-0x00000000004139DE-mapping.dmp

Download
memory/1124-442-0x0000000000000000-mapping.dmp

Download
memory/1124-31-0x0000000000000000-mapping.dmp

Download
memory/1124-803-0x00000000004139DE-mapping.dmp

Download
memory/1124-487-0x0000000000000000-mapping.dmp

Download
memory/1132-64-0x00000000004139DE-mapping.dmp

Download
memory/1140-353-0x00000000004139DE-mapping.dmp

Download
memory/1140-545-0x0000000000000000-mapping.dmp

Download
memory/1224-551-0x00000000004139DE-mapping.dmp

Download
memory/1232-254-0x00000000004139DE-mapping.dmp

Download
memory/1240-786-0x00000000004139DE-mapping.dmp

Download
memory/1240-145-0x0000000000000000-mapping.dmp

Download
memory/1248-607-0x0000000000000000-mapping.dmp

Download
memory/1252-322-0x0000000000000000-mapping.dmp

Download
memory/1252-246-0x00000000004139DE-mapping.dmp

Download
memory/1260-274-0x00000000004139DE-mapping.dmp

Download
memory/1260-153-0x0000000000000000-mapping.dmp

Download
memory/1260-29-0x00000000004139DE-mapping.dmp

Download
memory/1264-689-0x0000000000000000-mapping.dmp

Download
memory/1264-25-0x00000000004139DE-mapping.dmp

Download
memory/1264-530-0x00000000004139DE-mapping.dmp

Download
memory/1316-440-0x00000000004139DE-mapping.dmp

Download
memory/1316-547-0x00000000004139DE-mapping.dmp

Download
memory/1316-510-0x00000000004139DE-mapping.dmp

Download
memory/1316-276-0x0000000000000000-mapping.dmp

Download
memory/1436-396-0x0000000000000000-mapping.dmp

Download
memory/1436-291-0x00000000004139DE-mapping.dmp

Download
memory/1444-161-0x0000000000000000-mapping.dmp

Download
memory/1444-889-0x00000000004139DE-mapping.dmp

Download
memory/1452-852-0x00000000004139DE-mapping.dmp

Download
memory/1456-27-0x0000000000000000-mapping.dmp

Download
memory/1456-873-0x00000000004139DE-mapping.dmp

Download
memory/1516-594-0x0000000000000000-mapping.dmp

Download
memory/1516-755-0x0000000000000000-mapping.dmp

Download
memory/1524-966-0x0000000000000000-mapping.dmp

Download
memory/1524-731-0x0000000000000000-mapping.dmp

Download
memory/1532-968-0x00000000004139DE-mapping.dmp

Download
memory/1532-477-0x00000000004139DE-mapping.dmp

Download
memory/1532-584-0x00000000004139DE-mapping.dmp

Download
memory/1556-999-0x0000000000000000-mapping.dmp

Download
memory/1556-638-0x00000000004139DE-mapping.dmp

Download
memory/1564-832-0x00000000004139DE-mapping.dmp

Download
memory/1564-865-0x00000000004139DE-mapping.dmp

Download
memory/1572-611-0x0000000000000000-mapping.dmp

Download
memory/1572-310-0x0000000000000000-mapping.dmp

Download
memory/1572-658-0x00000000004139DE-mapping.dmp

Download
memory/1648-237-0x00000000004139DE-mapping.dmp

Download
memory/1648-417-0x0000000000000000-mapping.dmp

Download
memory/1652-720-0x00000000004139DE-mapping.dmp

Download
memory/1652-475-0x0000000000000000-mapping.dmp

Download
memory/1652-520-0x0000000000000000-mapping.dmp

Download
memory/1672-881-0x00000000004139DE-mapping.dmp

Download
memory/1672-654-0x00000000004139DE-mapping.dmp

Download
memory/1680-151-0x00000000004139DE-mapping.dmp

Download
memory/1684-898-0x00000000004139DE-mapping.dmp

Download
memory/1772-704-0x00000000004139DE-mapping.dmp

Download
memory/1812-198-0x0000000000000000-mapping.dmp

Download
memory/1820-489-0x00000000004139DE-mapping.dmp

Download
memory/1820-140-0x0000000000000000-mapping.dmp

Download
memory/1820-811-0x00000000004139DE-mapping.dmp

Download
memory/1824-904-0x0000000000000000-mapping.dmp

Download
memory/1824-136-0x0000000000000000-mapping.dmp

Download
memory/1824-334-0x0000000000000000-mapping.dmp

Download
memory/1824-258-0x00000000004139DE-mapping.dmp

Download
memory/1828-233-0x00000000004139DE-mapping.dmp

Download
memory/1832-650-0x00000000004139DE-mapping.dmp

Download
memory/1832-256-0x0000000000000000-mapping.dmp

Download
memory/1836-202-0x0000000000000000-mapping.dmp

Download
memory/1836-316-0x00000000004139DE-mapping.dmp

Download
memory/1840-516-0x0000000000000000-mapping.dmp

Download
memory/1840-2-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1840-471-0x0000000000000000-mapping.dmp

Download
memory/1840-0-0x0000000000400000-0x00000000004A2000-memory.dmp

Filesize
648KB

Download
memory/1840-1-0x00000000004139DE-mapping.dmp

Download
memory/1896-700-0x00000000004139DE-mapping.dmp

Download
memory/1900-553-0x0000000000000000-mapping.dmp

Download
memory/1900-384-0x0000000000000000-mapping.dmp

Download
memory/1900-56-0x00000000004139DE-mapping.dmp

Download
memory/1908-675-0x00000000004139DE-mapping.dmp

Download
memory/1908-462-0x0000000000000000-mapping.dmp

Download
memory/1908-627-0x0000000000000000-mapping.dmp

Download
memory/1912-1044-0x0000000000000000-mapping.dmp

Download
memory/1912-729-0x00000000004139DE-mapping.dmp

Download
memory/1912-58-0x0000000000000000-mapping.dmp

Download
memory/1920-363-0x0000000000000000-mapping.dmp

Download
memory/1920-299-0x00000000004139DE-mapping.dmp

Download
memory/1920-596-0x00000000004139DE-mapping.dmp

Download
memory/1924-623-0x0000000000000000-mapping.dmp

Download
memory/1924-264-0x0000000000000000-mapping.dmp

Download
memory/1924-941-0x0000000000000000-mapping.dmp

Download
memory/1924-77-0x00000000004139DE-mapping.dmp

Download
memory/1928-283-0x00000000004139DE-mapping.dmp

Download
memory/1936-252-0x0000000000000000-mapping.dmp

Download
memory/1936-378-0x00000000004139DE-mapping.dmp

Download
memory/1936-964-0x00000000004139DE-mapping.dmp

Download
memory/1936-526-0x00000000004139DE-mapping.dmp

Download
memory/1988-481-0x00000000004139DE-mapping.dmp

Download
memory/1988-303-0x00000000004139DE-mapping.dmp

Download
memory/1988-70-0x0000000000000000-mapping.dmp

Download
memory/1988-856-0x00000000004139DE-mapping.dmp

Download
memory/1988-114-0x00000000004139DE-mapping.dmp

Download
memory/2020-945-0x0000000000000000-mapping.dmp

Download
memory/2032-37-0x0000000000000000-mapping.dmp

Download
memory/2032-116-0x0000000000000000-mapping.dmp

Download
memory/2032-592-0x00000000004139DE-mapping.dmp

Download
memory/2032-411-0x00000000004139DE-mapping.dmp

Download
memory/2040-871-0x0000000000000000-mapping.dmp

Download
memory/2040-147-0x00000000004139DE-mapping.dmp

Download
memory/2052-574-0x0000000000000000-mapping.dmp

Download
memory/2064-380-0x0000000000000000-mapping.dmp

Download
memory/2064-625-0x00000000004139DE-mapping.dmp

Download
memory/2064-305-0x0000000000000000-mapping.dmp

Download
memory/2064-504-0x0000000000000000-mapping.dmp

Download
memory/2092-429-0x0000000000000000-mapping.dmp

Download
memory/2092-68-0x00000000004139DE-mapping.dmp

Download
memory/2092-361-0x00000000004139DE-mapping.dmp

Download
memory/2092-1015-0x0000000000000000-mapping.dmp

Download
memory/2096-110-0x00000000004139DE-mapping.dmp

Download
memory/2108-578-0x0000000000000000-mapping.dmp

Download
memory/2108-669-0x0000000000000000-mapping.dmp

Download
memory/2112-196-0x00000000004139DE-mapping.dmp

Download
memory/2112-712-0x00000000004139DE-mapping.dmp

Download
memory/2112-293-0x0000000000000000-mapping.dmp

Download
memory/2116-931-0x00000000004139DE-mapping.dmp

Download
memory/2116-633-0x00000000004139DE-mapping.dmp

Download
memory/2116-184-0x00000000004139DE-mapping.dmp

Download
memory/2116-41-0x0000000000000000-mapping.dmp

Download
memory/2120-970-0x0000000000000000-mapping.dmp

Download
memory/2124-270-0x00000000004139DE-mapping.dmp

Download
memory/2124-359-0x0000000000000000-mapping.dmp

Download
memory/2128-877-0x00000000004139DE-mapping.dmp

Download
memory/2128-225-0x00000000004139DE-mapping.dmp

Download
memory/2136-3-0x0000000000000000-mapping.dmp

Download
memory/2136-466-0x0000000000000000-mapping.dmp

Download
memory/2136-512-0x0000000000000000-mapping.dmp

Download
memory/2136-598-0x0000000000000000-mapping.dmp

Download
memory/2144-118-0x00000000004139DE-mapping.dmp

Download
memory/2148-79-0x0000000000000000-mapping.dmp

Download
memory/2148-861-0x00000000004139DE-mapping.dmp

Download
memory/2148-982-0x0000000000000000-mapping.dmp

Download
memory/2152-991-0x0000000000000000-mapping.dmp

Download
memory/2156-421-0x0000000000000000-mapping.dmp

Download
memory/2156-508-0x0000000000000000-mapping.dmp

Download
memory/2160-376-0x0000000000000000-mapping.dmp

Download
memory/2188-770-0x00000000004139DE-mapping.dmp

Download
memory/2192-5-0x00000000004139DE-mapping.dmp

Download
memory/2192-72-0x00000000004139DE-mapping.dmp

Download
memory/2208-402-0x00000000004139DE-mapping.dmp

Download
memory/2208-281-0x0000000000000000-mapping.dmp

Download
memory/2208-324-0x00000000004139DE-mapping.dmp

Download
memory/2244-875-0x0000000000000000-mapping.dmp

Download
memory/2244-922-0x00000000004139DE-mapping.dmp

Download
memory/2268-858-0x0000000000000000-mapping.dmp

Download
memory/2268-817-0x0000000000000000-mapping.dmp

Download
memory/2284-764-0x0000000000000000-mapping.dmp

Download
memory/2284-568-0x00000000004139DE-mapping.dmp

Download
memory/2292-120-0x0000000000000000-mapping.dmp

Download
memory/2304-716-0x00000000004139DE-mapping.dmp

Download
memory/2304-190-0x0000000000000000-mapping.dmp

Download
memory/2332-937-0x0000000000000000-mapping.dmp

Download
memory/2332-790-0x00000000004139DE-mapping.dmp

Download
memory/2332-1063-0x00000000004139DE-mapping.dmp

Download
memory/2348-836-0x00000000004139DE-mapping.dmp

Download
memory/2348-1021-0x00000000004139DE-mapping.dmp

Download
memory/2384-576-0x00000000004139DE-mapping.dmp

Download
memory/2448-149-0x0000000000000000-mapping.dmp

Download
memory/2452-768-0x0000000000000000-mapping.dmp

Download
memory/2488-685-0x0000000000000000-mapping.dmp

Download
memory/2488-260-0x0000000000000000-mapping.dmp

Download
memory/2488-493-0x00000000004139DE-mapping.dmp

Download
memory/2492-910-0x00000000004139DE-mapping.dmp

Download
memory/2492-844-0x00000000004139DE-mapping.dmp

Download
memory/2492-173-0x0000000000000000-mapping.dmp

Download
memory/2492-997-0x00000000004139DE-mapping.dmp

Download
memory/2492-949-0x0000000000000000-mapping.dmp

Download
memory/2524-697-0x0000000000000000-mapping.dmp

Download
memory/2524-194-0x0000000000000000-mapping.dmp

Download
memory/2528-81-0x00000000004139DE-mapping.dmp

Download
memory/2536-262-0x00000000004139DE-mapping.dmp

Download
memory/2536-419-0x00000000004139DE-mapping.dmp

Download
memory/2536-743-0x0000000000000000-mapping.dmp

Download
memory/2536-1011-0x0000000000000000-mapping.dmp

Download
memory/2576-85-0x00000000004139DE-mapping.dmp

Download
memory/2580-986-0x0000000000000000-mapping.dmp

Download
memory/2580-648-0x0000000000000000-mapping.dmp

Download
memory/2692-272-0x0000000000000000-mapping.dmp

Download
memory/2692-454-0x0000000000000000-mapping.dmp

Download
memory/2704-1050-0x00000000004139DE-mapping.dmp

Download
memory/2704-171-0x00000000004139DE-mapping.dmp

Download
memory/2704-206-0x0000000000000000-mapping.dmp

Download
memory/2724-223-0x0000000000000000-mapping.dmp

Download
memory/2724-343-0x0000000000000000-mapping.dmp

Download
memory/2748-570-0x0000000000000000-mapping.dmp

Download
memory/2748-784-0x0000000000000000-mapping.dmp

Download
memory/2748-250-0x00000000004139DE-mapping.dmp

Download
memory/2768-1055-0x00000000004139DE-mapping.dmp

Download
memory/2768-972-0x00000000004139DE-mapping.dmp

Download
memory/2780-927-0x00000000004139DE-mapping.dmp

Download
memory/2784-557-0x0000000000000000-mapping.dmp

Download
memory/2784-893-0x00000000004139DE-mapping.dmp

Download
memory/2784-776-0x0000000000000000-mapping.dmp

Download
memory/2800-431-0x00000000004139DE-mapping.dmp

Download
memory/2800-502-0x00000000004139DE-mapping.dmp

Download
memory/2804-176-0x00000000004139DE-mapping.dmp

Download
memory/2804-691-0x00000000004139DE-mapping.dmp

Download
memory/2864-522-0x00000000004139DE-mapping.dmp

Download
memory/2864-7-0x0000000000000000-mapping.dmp

Download
memory/2864-248-0x0000000000000000-mapping.dmp

Download
memory/2864-328-0x00000000004139DE-mapping.dmp

Download
memory/2864-1034-0x00000000004139DE-mapping.dmp

Download
memory/2864-951-0x00000000004139DE-mapping.dmp

Download
memory/2888-514-0x00000000004139DE-mapping.dmp

Download
memory/2912-549-0x0000000000000000-mapping.dmp

Download
memory/2912-318-0x0000000000000000-mapping.dmp

Download
memory/2912-241-0x00000000004139DE-mapping.dmp

Download
memory/2912-1009-0x00000000004139DE-mapping.dmp

Download
memory/2988-989-0x00000000004139DE-mapping.dmp

Download
memory/2988-782-0x00000000004139DE-mapping.dmp

Download
memory/2992-369-0x00000000004139DE-mapping.dmp

Download
memory/2992-62-0x0000000000000000-mapping.dmp

Download
memory/2992-683-0x00000000004139DE-mapping.dmp

Download
memory/3012-656-0x0000000000000000-mapping.dmp

Download
memory/3016-774-0x00000000004139DE-mapping.dmp

Download
memory/3016-301-0x0000000000000000-mapping.dmp

Download
memory/3016-458-0x0000000000000000-mapping.dmp

Download
memory/3016-980-0x00000000004139DE-mapping.dmp

Download
memory/3016-850-0x0000000000000000-mapping.dmp

Download
memory/3020-908-0x0000000000000000-mapping.dmp

Download
memory/3020-91-0x0000000000000000-mapping.dmp

Download
memory/3020-208-0x00000000004139DE-mapping.dmp

Download
memory/3020-287-0x00000000004139DE-mapping.dmp

Download
memory/3040-390-0x00000000004139DE-mapping.dmp

Download
memory/3040-1003-0x0000000000000000-mapping.dmp

Download
memory/3052-134-0x00000000004139DE-mapping.dmp

Download
memory/3052-398-0x00000000004139DE-mapping.dmp

Download
memory/3052-1028-0x0000000000000000-mapping.dmp

Download
memory/3052-433-0x0000000000000000-mapping.dmp

Download
memory/3060-778-0x00000000004139DE-mapping.dmp

Download
memory/3060-842-0x0000000000000000-mapping.dmp

Download
memory/3060-17-0x00000000004139DE-mapping.dmp

Download
memory/3060-341-0x00000000004139DE-mapping.dmp

Download
memory/3060-83-0x0000000000000000-mapping.dmp

Download
memory/3060-200-0x00000000004139DE-mapping.dmp

Download
memory/3080-448-0x00000000004139DE-mapping.dmp

Download
memory/3080-89-0x00000000004139DE-mapping.dmp

Download
memory/3080-759-0x0000000000000000-mapping.dmp

Download
memory/3080-1042-0x00000000004139DE-mapping.dmp

Download
memory/3084-497-0x00000000004139DE-mapping.dmp

Download
memory/3096-947-0x00000000004139DE-mapping.dmp

Download
memory/3104-695-0x00000000004139DE-mapping.dmp

Download
memory/3104-555-0x00000000004139DE-mapping.dmp

Download
memory/3140-590-0x0000000000000000-mapping.dmp

Download
memory/3140-935-0x00000000004139DE-mapping.dmp

Download
memory/3176-124-0x0000000000000000-mapping.dmp

Download
memory/3176-506-0x00000000004139DE-mapping.dmp

Download
memory/3264-347-0x0000000000000000-mapping.dmp

Download
memory/3264-925-0x0000000000000000-mapping.dmp

Download
memory/3264-615-0x0000000000000000-mapping.dmp

Download
memory/3264-192-0x00000000004139DE-mapping.dmp

Download
memory/3296-464-0x00000000004139DE-mapping.dmp

Download
memory/3296-943-0x00000000004139DE-mapping.dmp

Download
memory/3300-918-0x00000000004139DE-mapping.dmp

Download
memory/3328-142-0x00000000004139DE-mapping.dmp

Download
memory/3332-621-0x00000000004139DE-mapping.dmp

Download
memory/3332-660-0x0000000000000000-mapping.dmp

Download
memory/3348-528-0x0000000000000000-mapping.dmp

Download
memory/3348-66-0x0000000000000000-mapping.dmp

Download
memory/3360-279-0x00000000004139DE-mapping.dmp

Download
memory/3360-1069-0x0000000000000000-mapping.dmp

Download
memory/3384-605-0x00000000004139DE-mapping.dmp

Download
memory/3392-646-0x00000000004139DE-mapping.dmp

Download
memory/3396-1046-0x00000000004139DE-mapping.dmp

Download
memory/3396-539-0x00000000004139DE-mapping.dmp

Download
memory/3404-456-0x00000000004139DE-mapping.dmp

Download
memory/3404-662-0x00000000004139DE-mapping.dmp

Download
memory/3424-995-0x0000000000000000-mapping.dmp

Download
memory/3452-371-0x0000000000000000-mapping.dmp

Download
memory/3452-896-0x0000000000000000-mapping.dmp

Download
memory/3456-1038-0x00000000004139DE-mapping.dmp

Download
memory/3468-407-0x00000000004139DE-mapping.dmp

Download
memory/3472-295-0x00000000004139DE-mapping.dmp

Download
memory/3472-524-0x0000000000000000-mapping.dmp

Download
memory/3472-169-0x0000000000000000-mapping.dmp

Download
memory/3472-613-0x00000000004139DE-mapping.dmp

Download
memory/3484-351-0x0000000000000000-mapping.dmp

Download
memory/3484-636-0x0000000000000000-mapping.dmp

Download
memory/3544-733-0x00000000004139DE-mapping.dmp

Download
memory/3544-95-0x0000000000000000-mapping.dmp

Download
memory/3544-167-0x00000000004139DE-mapping.dmp

Download
memory/3572-314-0x0000000000000000-mapping.dmp

Download
memory/3584-772-0x0000000000000000-mapping.dmp

Download
memory/3584-357-0x00000000004139DE-mapping.dmp

Download
memory/3584-885-0x00000000004139DE-mapping.dmp

Download
memory/3584-392-0x0000000000000000-mapping.dmp

Download
memory/3596-848-0x00000000004139DE-mapping.dmp

Download
memory/3600-541-0x0000000000000000-mapping.dmp

Download
memory/3600-204-0x00000000004139DE-mapping.dmp

Download
memory/3600-823-0x00000000004139DE-mapping.dmp

Download
memory/3604-367-0x0000000000000000-mapping.dmp

Download
memory/3604-718-0x0000000000000000-mapping.dmp

Download
memory/3608-974-0x0000000000000000-mapping.dmp

Download
memory/3612-1052-0x0000000000000000-mapping.dmp

Download
memory/3620-601-0x00000000004139DE-mapping.dmp

Download
memory/3620-382-0x00000000004139DE-mapping.dmp

Download
memory/3632-425-0x0000000000000000-mapping.dmp

Download
memory/3632-807-0x00000000004139DE-mapping.dmp

Download
memory/3632-365-0x00000000004139DE-mapping.dmp

Download
memory/3652-122-0x00000000004139DE-mapping.dmp

Download
memory/3652-561-0x0000000000000000-mapping.dmp

Download
memory/3668-386-0x00000000004139DE-mapping.dmp

Download
memory/3668-227-0x0000000000000000-mapping.dmp

Download
memory/3676-834-0x0000000000000000-mapping.dmp

Download
memory/3676-221-0x00000000004139DE-mapping.dmp

Download
memory/3676-1007-0x0000000000000000-mapping.dmp

Download
memory/3680-45-0x0000000000000000-mapping.dmp

Download
memory/3680-157-0x0000000000000000-mapping.dmp

Download
memory/3680-235-0x0000000000000000-mapping.dmp

Download
memory/3680-1040-0x0000000000000000-mapping.dmp

Download
memory/3684-559-0x00000000004139DE-mapping.dmp

Download
memory/3684-338-0x0000000000000000-mapping.dmp

Download
memory/3684-1026-0x00000000004139DE-mapping.dmp

Download
memory/3684-664-0x0000000000000000-mapping.dmp

Download
memory/3684-9-0x00000000004139DE-mapping.dmp

Download
memory/3684-43-0x00000000004139DE-mapping.dmp

Download
memory/3688-97-0x00000000004139DE-mapping.dmp

Download
memory/3692-838-0x0000000000000000-mapping.dmp

Download
memory/3696-681-0x0000000000000000-mapping.dmp

Download
memory/3696-126-0x00000000004139DE-mapping.dmp

Download
memory/3700-869-0x00000000004139DE-mapping.dmp

Download
memory/3700-108-0x0000000000000000-mapping.dmp

Download
memory/3704-797-0x0000000000000000-mapping.dmp

Download
memory/3704-671-0x00000000004139DE-mapping.dmp

Download
memory/3704-962-0x0000000000000000-mapping.dmp

Download
memory/3704-1048-0x0000000000000000-mapping.dmp

Download
memory/3708-400-0x0000000000000000-mapping.dmp

Download
memory/3708-60-0x00000000004139DE-mapping.dmp

Download
memory/3708-159-0x00000000004139DE-mapping.dmp

Download
memory/3708-572-0x00000000004139DE-mapping.dmp

Download
memory/3708-15-0x0000000000000000-mapping.dmp

Download
memory/3708-780-0x0000000000000000-mapping.dmp

Download
memory/3708-446-0x0000000000000000-mapping.dmp

Download
memory/3708-825-0x0000000000000000-mapping.dmp

Download
memory/3708-491-0x0000000000000000-mapping.dmp

Download
memory/3712-586-0x0000000000000000-mapping.dmp

Download
memory/3716-128-0x0000000000000000-mapping.dmp

Download
memory/3716-617-0x00000000004139DE-mapping.dmp

Download
memory/3716-914-0x00000000004139DE-mapping.dmp

Download
memory/3720-217-0x00000000004139DE-mapping.dmp

Download
memory/3720-35-0x00000000004139DE-mapping.dmp

Download
memory/3720-105-0x00000000004139DE-mapping.dmp

Download
memory/3724-580-0x00000000004139DE-mapping.dmp

Download
memory/3732-799-0x00000000004139DE-mapping.dmp

Download
memory/3756-582-0x0000000000000000-mapping.dmp

Download
memory/3756-537-0x0000000000000000-mapping.dmp

Download
memory/3760-101-0x00000000004139DE-mapping.dmp

Download
memory/3764-920-0x0000000000000000-mapping.dmp

Download
memory/3764-735-0x0000000000000000-mapping.dmp

Download
memory/3768-609-0x00000000004139DE-mapping.dmp

Download
memory/3772-54-0x0000000000000000-mapping.dmp

Download
memory/3776-332-0x00000000004139DE-mapping.dmp

Download
memory/3776-289-0x0000000000000000-mapping.dmp

Download
memory/3776-215-0x0000000000000000-mapping.dmp

Download
memory/3776-132-0x0000000000000000-mapping.dmp

Download
memory/3776-39-0x00000000004139DE-mapping.dmp

Download
memory/3780-883-0x0000000000000000-mapping.dmp

Download
memory/3780-266-0x00000000004139DE-mapping.dmp

Download
memory/3780-1065-0x0000000000000000-mapping.dmp

Download
memory/3780-652-0x0000000000000000-mapping.dmp

Download
memory/3784-706-0x0000000000000000-mapping.dmp

Download
memory/3784-409-0x0000000000000000-mapping.dmp

Download
memory/3784-50-0x0000000000000000-mapping.dmp

Download
memory/3788-450-0x0000000000000000-mapping.dmp

Download
memory/3788-1061-0x0000000000000000-mapping.dmp

Download
memory/3788-828-0x00000000004139DE-mapping.dmp

Download
memory/3788-976-0x00000000004139DE-mapping.dmp

Download
memory/3792-1067-0x00000000004139DE-mapping.dmp

Download
memory/3792-130-0x00000000004139DE-mapping.dmp

Download
memory/3796-394-0x00000000004139DE-mapping.dmp

Download
memory/3796-722-0x0000000000000000-mapping.dmp

Download
memory/3812-753-0x00000000004139DE-mapping.dmp

Download
memory/3812-1017-0x00000000004139DE-mapping.dmp

Download
memory/3816-413-0x0000000000000000-mapping.dmp

Download
memory/3816-308-0x00000000004139DE-mapping.dmp

Download
memory/3816-978-0x0000000000000000-mapping.dmp

Download
memory/3820-644-0x0000000000000000-mapping.dmp

Download
memory/3828-345-0x00000000004139DE-mapping.dmp

Download
memory/3828-879-0x0000000000000000-mapping.dmp

Download
memory/3832-239-0x0000000000000000-mapping.dmp

Download
memory/3844-182-0x0000000000000000-mapping.dmp

Download
memory/3844-423-0x00000000004139DE-mapping.dmp

Download
memory/3844-460-0x00000000004139DE-mapping.dmp

Download
memory/3848-737-0x00000000004139DE-mapping.dmp

Download
memory/3852-1024-0x0000000000000000-mapping.dmp

Download
memory/3852-902-0x00000000004139DE-mapping.dmp

Download
memory/3852-48-0x00000000004139DE-mapping.dmp

Download
memory/3856-243-0x0000000000000000-mapping.dmp

Download
memory/3856-563-0x00000000004139DE-mapping.dmp

Download
memory/3868-702-0x0000000000000000-mapping.dmp

Download
memory/3872-452-0x00000000004139DE-mapping.dmp

Download
memory/3872-840-0x00000000004139DE-mapping.dmp

Download
memory/3872-13-0x00000000004139DE-mapping.dmp

Download
memory/3872-415-0x00000000004139DE-mapping.dmp

Download
memory/3872-336-0x00000000004139DE-mapping.dmp

Download
memory/3872-629-0x00000000004139DE-mapping.dmp

Download
memory/3884-374-0x00000000004139DE-mapping.dmp

Download
memory/3888-863-0x0000000000000000-mapping.dmp

Download
memory/3888-495-0x0000000000000000-mapping.dmp

Download
memory/3888-745-0x00000000004139DE-mapping.dmp

Download
memory/3892-163-0x00000000004139DE-mapping.dmp

Download
memory/3900-1059-0x00000000004139DE-mapping.dmp

Download
memory/3904-485-0x00000000004139DE-mapping.dmp

Download
memory/3904-929-0x0000000000000000-mapping.dmp

Download
memory/3904-677-0x0000000000000000-mapping.dmp

Download
memory/3920-473-0x00000000004139DE-mapping.dmp

Download
memory/3920-219-0x0000000000000000-mapping.dmp

Download
memory/3920-543-0x00000000004139DE-mapping.dmp

Download
memory/3928-667-0x00000000004139DE-mapping.dmp

Download
memory/3928-747-0x0000000000000000-mapping.dmp

Download
memory/3928-619-0x0000000000000000-mapping.dmp

Download
memory/3932-11-0x0000000000000000-mapping.dmp

Download
memory/3936-165-0x0000000000000000-mapping.dmp

Download
memory/3936-326-0x0000000000000000-mapping.dmp

Download
memory/3936-693-0x0000000000000000-mapping.dmp

Download
memory/3960-1036-0x0000000000000000-mapping.dmp

Download
memory/3960-479-0x0000000000000000-mapping.dmp

Download
memory/3960-821-0x0000000000000000-mapping.dmp

Download
memory/3960-741-0x00000000004139DE-mapping.dmp

Download
memory/3972-1071-0x00000000004139DE-mapping.dmp

Download
memory/3972-792-0x0000000000000000-mapping.dmp

Download
memory/4000-933-0x0000000000000000-mapping.dmp

Download
memory/4000-642-0x00000000004139DE-mapping.dmp

Download
memory/4000-427-0x00000000004139DE-mapping.dmp

Download
memory/4000-99-0x0000000000000000-mapping.dmp

Download
memory/4000-809-0x0000000000000000-mapping.dmp

Download
memory/4024-751-0x0000000000000000-mapping.dmp

Download
memory/4028-900-0x0000000000000000-mapping.dmp

Download
memory/4028-500-0x0000000000000000-mapping.dmp

Download
memory/4028-155-0x00000000004139DE-mapping.dmp

Download
memory/4032-846-0x0000000000000000-mapping.dmp

Download
memory/4032-739-0x0000000000000000-mapping.dmp

Download
memory/4032-565-0x0000000000000000-mapping.dmp

Download
memory/4032-887-0x0000000000000000-mapping.dmp

Download
memory/4072-483-0x0000000000000000-mapping.dmp

Download
memory/4076-438-0x0000000000000000-mapping.dmp

Download
memory/4076-984-0x00000000004139DE-mapping.dmp

Download
memory/4076-588-0x00000000004139DE-mapping.dmp

Download
memory/4084-757-0x00000000004139DE-mapping.dmp

Download
memory/4084-435-0x00000000004139DE-mapping.dmp

Download