Analysis
-
max time kernel
82s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:06
Static task
static1
Behavioral task
behavioral1
Sample
c.c auth,-confirmation #1307654780,pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c.c auth,-confirmation #1307654780,pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
c.c auth,-confirmation #1307654780,pdf.exe
-
Size
389KB
-
MD5
e80514ca1a42e6f28fbd78b561883c2c
-
SHA1
823c8f1ff7d961eb2a910af44d130997c76c01ce
-
SHA256
ac59fc8043fdbad6e5c65e7c9e34aaceffe49290761f5ff6befa5825a781bc27
-
SHA512
7cc4c8a5ef724b8226a06662b7323cf9210637ccff800649bdea56df16e16fd8995926a9f624287c15b02b4678e173d3873ec87694d739a07c105f60da2a2a6b
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.marketinfosales.com - Port:
587 - Username:
[email protected] - Password:
QAZqaz123@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2456-133-0x0000000000400000-0x0000000000452000-memory.dmp family_agenttesla -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation RegAsm.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation c.c auth,-confirmation #1307654780,pdf.exe -
Drops startup file 2 IoCs
Processes:
c.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe c.c auth,-confirmation #1307654780,pdf.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe c.c auth,-confirmation #1307654780,pdf.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
c.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exedescription pid process target process PID 2360 set thread context of 2456 2360 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3172 set thread context of 4136 3172 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3960 set thread context of 4872 3960 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3832 set thread context of 4996 3832 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1384 set thread context of 3444 1384 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4064 set thread context of 4052 4064 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4180 set thread context of 320 4180 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1780 set thread context of 1872 1780 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3408 set thread context of 4756 3408 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 960 set thread context of 2032 960 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 964 set thread context of 2396 964 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4732 set thread context of 3012 4732 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1480 set thread context of 1460 1480 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1756 set thread context of 3212 1756 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1760 set thread context of 3704 1760 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3736 set thread context of 3952 3736 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2136 set thread context of 4200 2136 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 5004 set thread context of 2732 5004 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4632 set thread context of 4860 4632 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1996 set thread context of 4052 1996 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4140 set thread context of 2484 4140 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3480 set thread context of 4344 3480 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1700 set thread context of 4736 1700 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4164 set thread context of 3044 4164 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4248 set thread context of 3120 4248 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1092 set thread context of 3580 1092 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3032 set thread context of 4688 3032 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 456 set thread context of 624 456 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4276 set thread context of 2856 4276 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2500 set thread context of 4684 2500 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3816 set thread context of 2468 3816 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3592 set thread context of 3352 3592 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4740 set thread context of 4660 4740 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4876 set thread context of 4916 4876 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2888 set thread context of 3832 2888 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2572 set thread context of 2180 2572 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1932 set thread context of 4176 1932 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 204 set thread context of 216 204 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 4444 set thread context of 1948 4444 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4760 set thread context of 3424 4760 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4984 set thread context of 2064 4984 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1312 set thread context of 4544 1312 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2836 set thread context of 4248 2836 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3984 set thread context of 784 3984 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4692 set thread context of 4956 4692 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2164 set thread context of 1392 2164 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2228 set thread context of 3496 2228 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1216 set thread context of 2336 1216 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2468 set thread context of 3184 2468 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3352 set thread context of 2844 3352 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1200 set thread context of 4788 1200 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3948 set thread context of 1192 3948 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1688 set thread context of 3844 1688 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4776 set thread context of 1928 4776 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 216 set thread context of 4388 216 RegAsm.exe RegAsm.exe PID 652 set thread context of 1952 652 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3052 set thread context of 5096 3052 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2772 set thread context of 3564 2772 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3476 set thread context of 5084 3476 RegAsm.exe RegAsm.exe PID 964 set thread context of 4688 964 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3664 set thread context of 4956 3664 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 948 set thread context of 4600 948 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1632 set thread context of 5000 1632 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3376 set thread context of 2456 3376 RegAsm.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c.c auth,-confirmation #1307654780,pdf.exepid process 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe 2360 c.c auth,-confirmation #1307654780,pdf.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
c.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exepid process 2360 c.c auth,-confirmation #1307654780,pdf.exe 3172 c.c auth,-confirmation #1307654780,pdf.exe 3960 c.c auth,-confirmation #1307654780,pdf.exe 3832 c.c auth,-confirmation #1307654780,pdf.exe 1384 c.c auth,-confirmation #1307654780,pdf.exe 4064 c.c auth,-confirmation #1307654780,pdf.exe 4180 c.c auth,-confirmation #1307654780,pdf.exe 1780 c.c auth,-confirmation #1307654780,pdf.exe 1780 c.c auth,-confirmation #1307654780,pdf.exe 3408 c.c auth,-confirmation #1307654780,pdf.exe 3408 c.c auth,-confirmation #1307654780,pdf.exe 960 c.c auth,-confirmation #1307654780,pdf.exe 964 c.c auth,-confirmation #1307654780,pdf.exe 964 c.c auth,-confirmation #1307654780,pdf.exe 4732 c.c auth,-confirmation #1307654780,pdf.exe 1480 c.c auth,-confirmation #1307654780,pdf.exe 1756 c.c auth,-confirmation #1307654780,pdf.exe 1760 c.c auth,-confirmation #1307654780,pdf.exe 3736 c.c auth,-confirmation #1307654780,pdf.exe 2136 c.c auth,-confirmation #1307654780,pdf.exe 5004 c.c auth,-confirmation #1307654780,pdf.exe 4632 c.c auth,-confirmation #1307654780,pdf.exe 1996 c.c auth,-confirmation #1307654780,pdf.exe 1996 c.c auth,-confirmation #1307654780,pdf.exe 4140 c.c auth,-confirmation #1307654780,pdf.exe 4140 c.c auth,-confirmation #1307654780,pdf.exe 4140 c.c auth,-confirmation #1307654780,pdf.exe 3480 c.c auth,-confirmation #1307654780,pdf.exe 1700 c.c auth,-confirmation #1307654780,pdf.exe 4164 c.c auth,-confirmation #1307654780,pdf.exe 4248 c.c auth,-confirmation #1307654780,pdf.exe 1092 c.c auth,-confirmation #1307654780,pdf.exe 3032 c.c auth,-confirmation #1307654780,pdf.exe 456 c.c auth,-confirmation #1307654780,pdf.exe 4276 c.c auth,-confirmation #1307654780,pdf.exe 4276 c.c auth,-confirmation #1307654780,pdf.exe 2500 c.c auth,-confirmation #1307654780,pdf.exe 3816 c.c auth,-confirmation #1307654780,pdf.exe 3592 c.c auth,-confirmation #1307654780,pdf.exe 4740 c.c auth,-confirmation #1307654780,pdf.exe 4876 c.c auth,-confirmation #1307654780,pdf.exe 2888 c.c auth,-confirmation #1307654780,pdf.exe 2572 c.c auth,-confirmation #1307654780,pdf.exe 1932 c.c auth,-confirmation #1307654780,pdf.exe 204 c.c auth,-confirmation #1307654780,pdf.exe 4444 c.c auth,-confirmation #1307654780,pdf.exe 4760 c.c auth,-confirmation #1307654780,pdf.exe 4984 c.c auth,-confirmation #1307654780,pdf.exe 1312 c.c auth,-confirmation #1307654780,pdf.exe 1312 c.c auth,-confirmation #1307654780,pdf.exe 2836 c.c auth,-confirmation #1307654780,pdf.exe 3984 c.c auth,-confirmation #1307654780,pdf.exe 3984 c.c auth,-confirmation #1307654780,pdf.exe 3984 c.c auth,-confirmation #1307654780,pdf.exe 4692 c.c auth,-confirmation #1307654780,pdf.exe 2164 c.c auth,-confirmation #1307654780,pdf.exe 2228 c.c auth,-confirmation #1307654780,pdf.exe 1216 c.c auth,-confirmation #1307654780,pdf.exe 2468 c.c auth,-confirmation #1307654780,pdf.exe 3352 c.c auth,-confirmation #1307654780,pdf.exe 3352 c.c auth,-confirmation #1307654780,pdf.exe 1200 c.c auth,-confirmation #1307654780,pdf.exe 3948 c.c auth,-confirmation #1307654780,pdf.exe 1688 c.c auth,-confirmation #1307654780,pdf.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
c.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exeRegAsm.exec.c auth,-confirmation #1307654780,pdf.exedescription pid process Token: SeDebugPrivilege 2360 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 2456 RegAsm.exe Token: SeDebugPrivilege 3172 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4136 RegAsm.exe Token: SeDebugPrivilege 3960 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4872 RegAsm.exe Token: SeDebugPrivilege 3832 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4996 RegAsm.exe Token: SeDebugPrivilege 1384 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 3444 RegAsm.exe Token: SeDebugPrivilege 4064 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4052 RegAsm.exe Token: SeDebugPrivilege 4180 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 320 RegAsm.exe Token: SeDebugPrivilege 1780 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 1872 RegAsm.exe Token: SeDebugPrivilege 3408 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4756 RegAsm.exe Token: SeDebugPrivilege 960 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 2032 RegAsm.exe Token: SeDebugPrivilege 964 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 2396 RegAsm.exe Token: SeDebugPrivilege 4732 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 3012 RegAsm.exe Token: SeDebugPrivilege 1480 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 1460 RegAsm.exe Token: SeDebugPrivilege 1756 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 3212 RegAsm.exe Token: SeDebugPrivilege 3116 RegAsm.exe Token: SeDebugPrivilege 1760 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 3704 RegAsm.exe Token: SeDebugPrivilege 3736 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 3952 RegAsm.exe Token: SeDebugPrivilege 2136 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4200 RegAsm.exe Token: SeDebugPrivilege 5004 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 2732 RegAsm.exe Token: SeDebugPrivilege 4632 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4860 RegAsm.exe Token: SeDebugPrivilege 1996 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4052 RegAsm.exe Token: SeDebugPrivilege 4140 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 2484 RegAsm.exe Token: SeDebugPrivilege 3480 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4344 RegAsm.exe Token: SeDebugPrivilege 1700 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4736 RegAsm.exe Token: SeDebugPrivilege 4164 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 3044 RegAsm.exe Token: SeDebugPrivilege 4248 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 3120 RegAsm.exe Token: SeDebugPrivilege 1092 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 3580 RegAsm.exe Token: SeDebugPrivilege 3032 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4688 RegAsm.exe Token: SeDebugPrivilege 456 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 624 RegAsm.exe Token: SeDebugPrivilege 4276 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 2856 RegAsm.exe Token: SeDebugPrivilege 2500 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 4684 RegAsm.exe Token: SeDebugPrivilege 3816 c.c auth,-confirmation #1307654780,pdf.exe Token: SeDebugPrivilege 2468 RegAsm.exe Token: SeDebugPrivilege 3592 c.c auth,-confirmation #1307654780,pdf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
c.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exec.c auth,-confirmation #1307654780,pdf.exedescription pid process target process PID 2360 wrote to memory of 2456 2360 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2360 wrote to memory of 2456 2360 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2360 wrote to memory of 2456 2360 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2360 wrote to memory of 2456 2360 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 2360 wrote to memory of 3172 2360 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 2360 wrote to memory of 3172 2360 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 2360 wrote to memory of 3172 2360 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 3172 wrote to memory of 4136 3172 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3172 wrote to memory of 4136 3172 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3172 wrote to memory of 4136 3172 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3172 wrote to memory of 4136 3172 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3172 wrote to memory of 3960 3172 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 3172 wrote to memory of 3960 3172 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 3172 wrote to memory of 3960 3172 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 3960 wrote to memory of 4872 3960 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3960 wrote to memory of 4872 3960 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3960 wrote to memory of 4872 3960 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3960 wrote to memory of 4872 3960 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3960 wrote to memory of 3832 3960 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 3960 wrote to memory of 3832 3960 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 3960 wrote to memory of 3832 3960 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 3832 wrote to memory of 4996 3832 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3832 wrote to memory of 4996 3832 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3832 wrote to memory of 4996 3832 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3832 wrote to memory of 4996 3832 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3832 wrote to memory of 1384 3832 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 3832 wrote to memory of 1384 3832 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 3832 wrote to memory of 1384 3832 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 1384 wrote to memory of 3444 1384 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1384 wrote to memory of 3444 1384 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1384 wrote to memory of 3444 1384 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1384 wrote to memory of 3444 1384 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1384 wrote to memory of 4064 1384 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 1384 wrote to memory of 4064 1384 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 1384 wrote to memory of 4064 1384 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 4064 wrote to memory of 4052 4064 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4064 wrote to memory of 4052 4064 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4064 wrote to memory of 4052 4064 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4064 wrote to memory of 4052 4064 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4064 wrote to memory of 4180 4064 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 4064 wrote to memory of 4180 4064 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 4064 wrote to memory of 4180 4064 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 4180 wrote to memory of 320 4180 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4180 wrote to memory of 320 4180 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4180 wrote to memory of 320 4180 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4180 wrote to memory of 320 4180 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 4180 wrote to memory of 1780 4180 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 4180 wrote to memory of 1780 4180 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 4180 wrote to memory of 1780 4180 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 1780 wrote to memory of 3940 1780 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1780 wrote to memory of 3940 1780 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1780 wrote to memory of 3940 1780 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1780 wrote to memory of 1872 1780 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1780 wrote to memory of 1872 1780 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1780 wrote to memory of 1872 1780 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1780 wrote to memory of 1872 1780 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 1780 wrote to memory of 3408 1780 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 1780 wrote to memory of 3408 1780 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 1780 wrote to memory of 3408 1780 c.c auth,-confirmation #1307654780,pdf.exe c.c auth,-confirmation #1307654780,pdf.exe PID 3408 wrote to memory of 4344 3408 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3408 wrote to memory of 4344 3408 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3408 wrote to memory of 4344 3408 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3408 wrote to memory of 4756 3408 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe PID 3408 wrote to memory of 4756 3408 c.c auth,-confirmation #1307654780,pdf.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"2⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"4⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"6⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"7⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"12⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"14⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"15⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"16⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"18⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"19⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"20⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"24⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"25⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"26⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"28⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"29⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"30⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"31⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"32⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"33⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"34⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"35⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"36⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"37⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"38⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"39⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"40⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"41⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"42⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"43⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"44⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"45⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"46⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"47⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"48⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"49⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"50⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"51⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"52⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"53⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"54⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"55⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"56⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"57⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"58⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"59⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"60⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"61⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"62⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"63⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"64⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"66⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"68⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"69⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"71⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"72⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"74⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"78⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"79⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"81⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"82⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"83⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"84⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"85⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"87⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"90⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"93⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"96⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"98⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"99⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"100⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"101⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"105⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"106⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"107⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"108⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"109⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"110⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"111⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"112⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"114⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"115⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"116⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"117⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"118⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"119⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"120⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"121⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"124⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"126⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"126⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"127⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"130⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"130⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"131⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"132⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"133⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"133⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"134⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"137⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"138⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"138⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"139⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"140⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"141⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"141⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"142⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"142⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"142⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"143⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"143⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"146⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"146⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"147⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"147⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"148⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"149⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"149⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"149⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"150⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"150⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"151⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"151⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"152⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"152⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"153⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"153⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"154⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"155⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"155⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"156⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"156⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"157⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"158⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"159⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"161⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"161⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"162⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"162⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"163⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"163⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"164⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"164⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"164⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"165⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"165⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"165⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"165⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"166⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"166⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"167⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"167⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"168⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"168⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"169⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"169⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"169⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"169⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"170⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"170⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"171⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"171⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"172⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"172⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"172⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"173⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"173⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"174⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"174⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"175⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"175⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"175⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"175⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"176⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"176⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"177⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"177⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"178⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"178⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"179⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"179⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"179⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"179⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"180⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"180⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"180⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"180⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"180⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"181⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"181⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"182⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"182⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"183⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"183⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"184⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"184⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"184⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"185⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"185⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"186⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"186⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"187⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"187⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"188⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"188⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"189⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"189⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"190⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"190⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"190⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"191⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"191⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"192⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"192⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"193⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"193⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"194⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"194⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"195⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"195⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"196⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"196⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"196⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"197⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"197⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"198⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"198⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"199⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"199⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"200⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"200⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"201⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"201⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"202⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"202⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"203⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"203⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"204⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"204⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"205⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"205⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"205⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"206⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"206⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"207⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"207⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"208⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"208⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"209⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"209⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"210⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"210⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"211⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"211⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"212⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"212⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"213⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"213⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"214⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"214⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"214⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"215⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"215⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"216⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"216⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"217⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"217⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"218⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"218⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"219⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"219⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"220⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"220⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"221⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"221⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"222⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"222⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"222⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"223⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"223⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"223⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"224⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"224⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"224⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"224⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"225⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"225⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"225⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"226⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"226⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"227⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"227⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"228⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"228⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"229⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"229⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"229⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"229⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"230⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"230⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"231⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"231⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"232⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"232⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"233⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"233⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"233⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"234⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"234⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"234⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"235⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"235⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"236⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"236⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"237⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"237⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"238⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"238⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"238⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"239⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"239⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"239⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"240⤵
-
C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"C:\Users\Admin\AppData\Local\Temp\c.c auth,-confirmation #1307654780,pdf.exe"240⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"241⤵