Analysis
-
max time kernel
152s -
max time network
14s -
platform
windows7_x64 -
resource
win7 -
submitted
31-07-2020 11:48
Static task
static1
Behavioral task
behavioral1
Sample
5660db4d39e1c2a7887c2b26c2f70f9b.exe
Resource
win7
Behavioral task
behavioral2
Sample
5660db4d39e1c2a7887c2b26c2f70f9b.exe
Resource
win10
General
-
Target
5660db4d39e1c2a7887c2b26c2f70f9b.exe
-
Size
349KB
-
MD5
5660db4d39e1c2a7887c2b26c2f70f9b
-
SHA1
656e494c33580a04d6ad08749a3f90fb7d4bb131
-
SHA256
322246ebcd55123f8d11816a45dde9ef1b0b041ab306fce78af896a04052e6c8
-
SHA512
66b4d49a740ea69f7a19cebcbad81d9851e0750aff4b18da23726555bcf605082ae25edbee251ca4401049e9759ffe5997b86ad290cba1ba7a9ec2b04dd93d3a
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
safaa.bishara@santemoraegypt.com - Password:
chimaroke2020
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 64 IoCs
Processes:
resource yara_rule behavioral1/memory/1112-0-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/1112-1-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1112-2-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/1112-3-0x0000000000400000-0x000000000044A000-memory.dmp family_agenttesla behavioral1/memory/304-6-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1520-12-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1240-17-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1628-22-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1900-27-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2004-32-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1488-37-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/332-42-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1816-47-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1052-52-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1868-57-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1084-62-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1948-67-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/800-72-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/684-77-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1796-82-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2020-87-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1772-92-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1968-97-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1568-102-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1984-107-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1932-112-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1572-117-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1144-122-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/540-127-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1996-132-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1872-137-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1452-142-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1788-147-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1512-152-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1084-157-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1640-162-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1892-167-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/936-172-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1828-177-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1820-182-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1380-187-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1468-192-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/864-197-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1852-202-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1092-207-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1044-212-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1508-217-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1884-222-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1972-227-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1668-232-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1832-237-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/684-242-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/976-247-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/1636-252-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2120-257-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2204-262-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2296-267-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2380-272-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2464-277-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2580-282-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2660-287-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2752-292-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2840-297-0x0000000000445C1E-mapping.dmp family_agenttesla behavioral1/memory/2924-302-0x0000000000445C1E-mapping.dmp family_agenttesla -
Drops startup file 2 IoCs
Processes:
5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe -
Adds Run key to start application 2 TTPs 11 IoCs
Processes:
RegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exeRegAsm.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBWELB = "C:\\Users\\Admin\\AppData\\Roaming\\HBWELB\\HBWELB.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBWELB = "C:\\Users\\Admin\\AppData\\Roaming\\HBWELB\\HBWELB.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBWELB = "C:\\Users\\Admin\\AppData\\Roaming\\HBWELB\\HBWELB.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBWELB = "C:\\Users\\Admin\\AppData\\Roaming\\HBWELB\\HBWELB.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBWELB = "C:\\Users\\Admin\\AppData\\Roaming\\HBWELB\\HBWELB.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBWELB = "C:\\Users\\Admin\\AppData\\Roaming\\HBWELB\\HBWELB.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBWELB = "C:\\Users\\Admin\\AppData\\Roaming\\HBWELB\\HBWELB.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBWELB = "C:\\Users\\Admin\\AppData\\Roaming\\HBWELB\\HBWELB.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBWELB = "C:\\Users\\Admin\\AppData\\Roaming\\HBWELB\\HBWELB.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBWELB = "C:\\Users\\Admin\\AppData\\Roaming\\HBWELB\\HBWELB.exe" RegAsm.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\HBWELB = "C:\\Users\\Admin\\AppData\\Roaming\\HBWELB\\HBWELB.exe" RegAsm.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exedescription pid process target process PID 1196 set thread context of 1112 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1552 set thread context of 304 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1048 set thread context of 1520 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1356 set thread context of 1240 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1772 set thread context of 1628 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1888 set thread context of 1900 1888 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1972 set thread context of 2004 1972 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2032 set thread context of 1488 2032 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 812 set thread context of 332 812 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1500 set thread context of 1816 1500 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1808 set thread context of 1052 1808 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1224 set thread context of 1868 1224 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1604 set thread context of 1084 1604 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1968 set thread context of 1948 1968 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1196 set thread context of 800 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1144 set thread context of 684 1144 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1724 set thread context of 1796 1724 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1220 set thread context of 2020 1220 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1996 set thread context of 1772 1996 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1888 set thread context of 1968 1888 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1468 set thread context of 1568 1468 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1844 set thread context of 1984 1844 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 936 set thread context of 1932 936 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1800 set thread context of 1572 1800 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1716 set thread context of 1144 1716 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2028 set thread context of 540 2028 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 936 set thread context of 1996 936 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1660 set thread context of 1872 1660 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1576 set thread context of 1452 1576 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1632 set thread context of 1788 1632 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1380 set thread context of 1512 1380 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1884 set thread context of 1084 1884 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1636 set thread context of 1640 1636 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1060 set thread context of 1892 1060 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1508 set thread context of 936 1508 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 388 set thread context of 1828 388 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 316 set thread context of 1820 316 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 704 set thread context of 1380 704 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1796 set thread context of 1468 1796 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1924 set thread context of 864 1924 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1548 set thread context of 1852 1548 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2016 set thread context of 1092 2016 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1668 set thread context of 1044 1668 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1564 set thread context of 1508 1564 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1144 set thread context of 1884 1144 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1476 set thread context of 1972 1476 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1560 set thread context of 1668 1560 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1636 set thread context of 1832 1636 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1632 set thread context of 684 1632 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2032 set thread context of 976 2032 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1552 set thread context of 1636 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2092 set thread context of 2120 2092 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2176 set thread context of 2204 2176 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2256 set thread context of 2296 2256 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2352 set thread context of 2380 2352 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2436 set thread context of 2464 2436 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2516 set thread context of 2580 2516 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2632 set thread context of 2660 2632 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2708 set thread context of 2752 2708 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2804 set thread context of 2840 2804 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2896 set thread context of 2924 2896 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2976 set thread context of 3004 2976 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 3052 set thread context of 1812 3052 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 2132 set thread context of 1724 2132 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5660db4d39e1c2a7887c2b26c2f70f9b.exepid process 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exepid process 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1888 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1972 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2032 5660db4d39e1c2a7887c2b26c2f70f9b.exe 812 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1500 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1808 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1224 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1604 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1968 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1144 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1724 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1220 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1996 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1888 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1468 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1844 5660db4d39e1c2a7887c2b26c2f70f9b.exe 936 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1800 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1716 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1716 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2028 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2028 5660db4d39e1c2a7887c2b26c2f70f9b.exe 936 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1660 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1576 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1632 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1380 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1884 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1636 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1060 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1508 5660db4d39e1c2a7887c2b26c2f70f9b.exe 388 5660db4d39e1c2a7887c2b26c2f70f9b.exe 388 5660db4d39e1c2a7887c2b26c2f70f9b.exe 316 5660db4d39e1c2a7887c2b26c2f70f9b.exe 704 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1796 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1924 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1548 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2016 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1668 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1668 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1564 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1144 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1476 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1560 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1636 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1632 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2032 5660db4d39e1c2a7887c2b26c2f70f9b.exe 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2092 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2176 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2256 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2256 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2352 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2436 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2516 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2632 5660db4d39e1c2a7887c2b26c2f70f9b.exe 2708 5660db4d39e1c2a7887c2b26c2f70f9b.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exeRegAsm.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exeRegAsm.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exedescription pid process Token: SeDebugPrivilege 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1888 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1972 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2032 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 812 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1500 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1808 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1224 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1604 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1968 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1144 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1724 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1220 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1996 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1888 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1468 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1844 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 936 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1800 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1716 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2028 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1112 RegAsm.exe Token: SeDebugPrivilege 936 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1660 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1576 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1632 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1380 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1884 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1636 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1060 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1508 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 388 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 316 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 704 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1796 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1924 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1548 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2016 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1668 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1564 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1144 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1476 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1560 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1636 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1632 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2032 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2092 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2176 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2256 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2352 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2436 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 1996 RegAsm.exe Token: SeDebugPrivilege 2516 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2632 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2708 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2804 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2896 5660db4d39e1c2a7887c2b26c2f70f9b.exe Token: SeDebugPrivilege 2976 5660db4d39e1c2a7887c2b26c2f70f9b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exe5660db4d39e1c2a7887c2b26c2f70f9b.exedescription pid process target process PID 1196 wrote to memory of 1112 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1196 wrote to memory of 1112 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1196 wrote to memory of 1112 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1196 wrote to memory of 1112 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1196 wrote to memory of 1112 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1196 wrote to memory of 1112 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1196 wrote to memory of 1112 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1196 wrote to memory of 1112 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1196 wrote to memory of 1552 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1196 wrote to memory of 1552 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1196 wrote to memory of 1552 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1196 wrote to memory of 1552 1196 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1552 wrote to memory of 304 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1552 wrote to memory of 304 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1552 wrote to memory of 304 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1552 wrote to memory of 304 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1552 wrote to memory of 304 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1552 wrote to memory of 304 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1552 wrote to memory of 304 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1552 wrote to memory of 304 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1552 wrote to memory of 1048 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1552 wrote to memory of 1048 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1552 wrote to memory of 1048 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1552 wrote to memory of 1048 1552 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1048 wrote to memory of 1520 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1048 wrote to memory of 1520 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1048 wrote to memory of 1520 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1048 wrote to memory of 1520 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1048 wrote to memory of 1520 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1048 wrote to memory of 1520 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1048 wrote to memory of 1520 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1048 wrote to memory of 1520 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1048 wrote to memory of 1356 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1048 wrote to memory of 1356 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1048 wrote to memory of 1356 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1048 wrote to memory of 1356 1048 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1356 wrote to memory of 1240 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1356 wrote to memory of 1240 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1356 wrote to memory of 1240 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1356 wrote to memory of 1240 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1356 wrote to memory of 1240 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1356 wrote to memory of 1240 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1356 wrote to memory of 1240 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1356 wrote to memory of 1240 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1356 wrote to memory of 1772 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1356 wrote to memory of 1772 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1356 wrote to memory of 1772 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1356 wrote to memory of 1772 1356 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1772 wrote to memory of 1628 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1772 wrote to memory of 1628 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1772 wrote to memory of 1628 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1772 wrote to memory of 1628 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1772 wrote to memory of 1628 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1772 wrote to memory of 1628 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1772 wrote to memory of 1628 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1772 wrote to memory of 1628 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1772 wrote to memory of 1888 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1772 wrote to memory of 1888 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1772 wrote to memory of 1888 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1772 wrote to memory of 1888 1772 5660db4d39e1c2a7887c2b26c2f70f9b.exe 5660db4d39e1c2a7887c2b26c2f70f9b.exe PID 1888 wrote to memory of 1900 1888 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1888 wrote to memory of 1900 1888 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1888 wrote to memory of 1900 1888 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe PID 1888 wrote to memory of 1900 1888 5660db4d39e1c2a7887c2b26c2f70f9b.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"4⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"6⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"14⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"15⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"16⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"18⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"24⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"25⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"26⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"28⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"29⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"30⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"31⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"32⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"33⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"34⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"35⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"36⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"37⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"38⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"39⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"40⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"41⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"42⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"43⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"44⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"45⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"46⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"47⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"48⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"49⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"50⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"51⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"52⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"53⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"54⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"55⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"56⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"57⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"58⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"62⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"63⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"64⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"66⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"68⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"71⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"74⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"78⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"83⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"84⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"85⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"93⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"98⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"99⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"105⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"106⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"107⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"108⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"109⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"110⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"114⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"115⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"118⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"120⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"121⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"124⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"126⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"126⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"127⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"130⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"130⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"131⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"132⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"133⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"133⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"138⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"138⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"139⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"141⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"141⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"142⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"142⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"143⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"143⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"146⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"146⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"147⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"147⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"148⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"149⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"149⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"150⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"150⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"151⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"151⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"152⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"152⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"153⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"153⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"154⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"155⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"155⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"156⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"156⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"157⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"158⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"159⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"161⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"161⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"162⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"162⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"162⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"163⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"163⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"164⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"164⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"165⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"165⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"166⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"166⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"167⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"167⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"168⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"168⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"169⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"169⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"170⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"170⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"171⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"171⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"172⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"172⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"173⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"173⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"174⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"174⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"175⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"175⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"176⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"176⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"177⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"178⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"178⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"178⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"179⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"179⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"180⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"180⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"181⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"181⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"181⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"182⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"182⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"183⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"184⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"184⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"185⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"186⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"187⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"187⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"188⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"188⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"189⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"190⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"190⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"191⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"191⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"192⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"192⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"192⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"193⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"194⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"195⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"195⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"196⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"196⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"197⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"197⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"198⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"198⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"199⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"200⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"200⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"201⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"202⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"203⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"203⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"205⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"205⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"206⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"206⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"207⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"207⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"208⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"209⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"209⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"210⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"210⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"211⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"211⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"212⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"212⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"213⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"213⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"214⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"214⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"215⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"215⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"216⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"216⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"217⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"217⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"218⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"218⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"219⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"219⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"220⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"220⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"222⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"222⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"223⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"223⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"224⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"224⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"225⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"225⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"226⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"226⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"227⤵
- Adds Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"227⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"228⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"228⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"229⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"229⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"229⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"230⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"230⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"231⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"231⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"231⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"233⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"233⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"234⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"234⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"235⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"235⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"236⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"236⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"237⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"237⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"237⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"238⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"238⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"239⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"239⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"240⤵
-
C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"C:\Users\Admin\AppData\Local\Temp\5660db4d39e1c2a7887c2b26c2f70f9b.exe"240⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"241⤵