Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:05
Static task
static1
Behavioral task
behavioral1
Sample
IMG74693969444.exe
Resource
win7-20220414-en
General
-
Target
IMG74693969444.exe
-
Size
266KB
-
MD5
5e90e2d465e0f2a3f2495ef59c4b53d1
-
SHA1
f53591409c538d7e4f5b45f42d014d42ad003ad0
-
SHA256
e33ef485c574d639eae34cd252d97aa78c17718190c98a92f7b6dc5a5fc0cd69
-
SHA512
06290efbdb947376db922adc45454ebf048ba9fb217e3ef7b30c6a7dbdf4beec32d0aacdc65c0981930b6c3ec1a4d542f05eb371ff99ca3e28525ad5c47a2e8f
Malware Config
Extracted
nanocore
1.2.2.0
185.244.30.10:3310
e2ebb08f-ebf7-4c0f-84d8-7041f8508ec8
-
activate_away_mode
true
- backup_connection_host
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-05-04T22:26:08.567797536Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
3310
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
e2ebb08f-ebf7-4c0f-84d8-7041f8508ec8
-
mutex_timeout
5000
-
prevent_system_sleep
true
-
primary_connection_host
185.244.30.10
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
IMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation IMG74693969444.exe -
Drops startup file 2 IoCs
Processes:
IMG74693969444.exeIMG74693969444.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe IMG74693969444.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exe IMG74693969444.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Service = "C:\\Program Files (x86)\\WPA Service\\wpasv.exe" RegAsm.exe -
Processes:
RegAsm.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RegAsm.exe -
Suspicious use of SetThreadContext 64 IoCs
Processes:
IMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exedescription pid process target process PID 880 set thread context of 8 880 IMG74693969444.exe RegAsm.exe PID 4876 set thread context of 1812 4876 IMG74693969444.exe RegAsm.exe PID 3012 set thread context of 2792 3012 IMG74693969444.exe RegAsm.exe PID 3828 set thread context of 2244 3828 IMG74693969444.exe RegAsm.exe PID 2368 set thread context of 3900 2368 IMG74693969444.exe RegAsm.exe PID 3100 set thread context of 1952 3100 IMG74693969444.exe RegAsm.exe PID 3972 set thread context of 2668 3972 IMG74693969444.exe RegAsm.exe PID 2924 set thread context of 4748 2924 IMG74693969444.exe RegAsm.exe PID 3716 set thread context of 3956 3716 IMG74693969444.exe RegAsm.exe PID 3600 set thread context of 3804 3600 IMG74693969444.exe RegAsm.exe PID 2264 set thread context of 2452 2264 IMG74693969444.exe RegAsm.exe PID 3812 set thread context of 2356 3812 IMG74693969444.exe RegAsm.exe PID 404 set thread context of 3868 404 IMG74693969444.exe RegAsm.exe PID 3980 set thread context of 2440 3980 IMG74693969444.exe RegAsm.exe PID 3548 set thread context of 3416 3548 IMG74693969444.exe RegAsm.exe PID 1156 set thread context of 2120 1156 IMG74693969444.exe RegAsm.exe PID 3164 set thread context of 1896 3164 IMG74693969444.exe RegAsm.exe PID 3828 set thread context of 1584 3828 IMG74693969444.exe RegAsm.exe PID 2368 set thread context of 2724 2368 IMG74693969444.exe RegAsm.exe PID 4512 set thread context of 2328 4512 IMG74693969444.exe RegAsm.exe PID 444 set thread context of 4544 444 IMG74693969444.exe RegAsm.exe PID 2684 set thread context of 2592 2684 IMG74693969444.exe RegAsm.exe PID 5028 set thread context of 3860 5028 IMG74693969444.exe RegAsm.exe PID 4328 set thread context of 1912 4328 IMG74693969444.exe RegAsm.exe PID 4988 set thread context of 3112 4988 IMG74693969444.exe RegAsm.exe PID 2308 set thread context of 4144 2308 IMG74693969444.exe RegAsm.exe PID 1224 set thread context of 4480 1224 IMG74693969444.exe RegAsm.exe PID 2616 set thread context of 1592 2616 IMG74693969444.exe RegAsm.exe PID 1860 set thread context of 4868 1860 IMG74693969444.exe RegAsm.exe PID 1984 set thread context of 2300 1984 IMG74693969444.exe RegAsm.exe PID 2260 set thread context of 2364 2260 IMG74693969444.exe RegAsm.exe PID 2352 set thread context of 2604 2352 IMG74693969444.exe RegAsm.exe PID 3488 set thread context of 2652 3488 IMG74693969444.exe RegAsm.exe PID 3008 set thread context of 2792 3008 IMG74693969444.exe RegAsm.exe PID 4756 set thread context of 2244 4756 IMG74693969444.exe RegAsm.exe PID 1760 set thread context of 4420 1760 IMG74693969444.exe RegAsm.exe PID 4356 set thread context of 4792 4356 IMG74693969444.exe RegAsm.exe PID 1204 set thread context of 1416 1204 IMG74693969444.exe RegAsm.exe PID 2096 set thread context of 2136 2096 IMG74693969444.exe RegAsm.exe PID 3044 set thread context of 4964 3044 IMG74693969444.exe RegAsm.exe PID 4484 set thread context of 2160 4484 IMG74693969444.exe RegAsm.exe PID 1224 set thread context of 1256 1224 IMG74693969444.exe RegAsm.exe PID 1688 set thread context of 4668 1688 IMG74693969444.exe RegAsm.exe PID 748 set thread context of 1208 748 IMG74693969444.exe RegAsm.exe PID 1984 set thread context of 5068 1984 IMG74693969444.exe RegAsm.exe PID 4880 set thread context of 4340 4880 IMG74693969444.exe RegAsm.exe PID 1360 set thread context of 3948 1360 IMG74693969444.exe RegAsm.exe PID 3256 set thread context of 2860 3256 IMG74693969444.exe RegAsm.exe PID 2544 set thread context of 1592 2544 IMG74693969444.exe RegAsm.exe PID 3628 set thread context of 4744 3628 IMG74693969444.exe RegAsm.exe PID 4008 set thread context of 4208 4008 IMG74693969444.exe RegAsm.exe PID 3088 set thread context of 3380 3088 IMG74693969444.exe RegAsm.exe PID 4004 set thread context of 1516 4004 IMG74693969444.exe RegAsm.exe PID 1988 set thread context of 2724 1988 IMG74693969444.exe RegAsm.exe PID 3364 set thread context of 1332 3364 IMG74693969444.exe RegAsm.exe PID 4592 set thread context of 3884 4592 IMG74693969444.exe RegAsm.exe PID 4848 set thread context of 4016 4848 IMG74693969444.exe RegAsm.exe PID 3772 set thread context of 3260 3772 IMG74693969444.exe RegAsm.exe PID 2676 set thread context of 3708 2676 IMG74693969444.exe RegAsm.exe PID 748 set thread context of 2668 748 IMG74693969444.exe RegAsm.exe PID 1412 set thread context of 4540 1412 IMG74693969444.exe RegAsm.exe PID 1552 set thread context of 1940 1552 IMG74693969444.exe RegAsm.exe PID 5088 set thread context of 3716 5088 IMG74693969444.exe RegAsm.exe PID 4680 set thread context of 3800 4680 IMG74693969444.exe RegAsm.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegAsm.exedescription ioc process File created C:\Program Files (x86)\WPA Service\wpasv.exe RegAsm.exe File opened for modification C:\Program Files (x86)\WPA Service\wpasv.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 3620 schtasks.exe 4512 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
IMG74693969444.exepid process 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegAsm.exepid process 8 RegAsm.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
Processes:
IMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exepid process 880 IMG74693969444.exe 880 IMG74693969444.exe 880 IMG74693969444.exe 4876 IMG74693969444.exe 3012 IMG74693969444.exe 3828 IMG74693969444.exe 2368 IMG74693969444.exe 3100 IMG74693969444.exe 3972 IMG74693969444.exe 3972 IMG74693969444.exe 3972 IMG74693969444.exe 3972 IMG74693969444.exe 3972 IMG74693969444.exe 3972 IMG74693969444.exe 2924 IMG74693969444.exe 2924 IMG74693969444.exe 3716 IMG74693969444.exe 3600 IMG74693969444.exe 2264 IMG74693969444.exe 2264 IMG74693969444.exe 3812 IMG74693969444.exe 404 IMG74693969444.exe 3980 IMG74693969444.exe 3548 IMG74693969444.exe 3548 IMG74693969444.exe 1156 IMG74693969444.exe 3164 IMG74693969444.exe 3828 IMG74693969444.exe 2368 IMG74693969444.exe 4512 IMG74693969444.exe 444 IMG74693969444.exe 444 IMG74693969444.exe 2684 IMG74693969444.exe 5028 IMG74693969444.exe 5028 IMG74693969444.exe 4328 IMG74693969444.exe 4988 IMG74693969444.exe 4988 IMG74693969444.exe 2308 IMG74693969444.exe 1224 IMG74693969444.exe 2616 IMG74693969444.exe 1860 IMG74693969444.exe 1984 IMG74693969444.exe 2260 IMG74693969444.exe 2352 IMG74693969444.exe 3488 IMG74693969444.exe 3008 IMG74693969444.exe 4756 IMG74693969444.exe 1760 IMG74693969444.exe 4356 IMG74693969444.exe 4356 IMG74693969444.exe 1204 IMG74693969444.exe 1204 IMG74693969444.exe 2096 IMG74693969444.exe 3044 IMG74693969444.exe 3044 IMG74693969444.exe 4484 IMG74693969444.exe 4484 IMG74693969444.exe 4484 IMG74693969444.exe 4484 IMG74693969444.exe 1224 IMG74693969444.exe 1224 IMG74693969444.exe 1688 IMG74693969444.exe 748 IMG74693969444.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
IMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeRegAsm.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exedescription pid process Token: SeDebugPrivilege 880 IMG74693969444.exe Token: SeDebugPrivilege 4876 IMG74693969444.exe Token: SeDebugPrivilege 3012 IMG74693969444.exe Token: SeDebugPrivilege 3828 IMG74693969444.exe Token: SeDebugPrivilege 2368 IMG74693969444.exe Token: SeDebugPrivilege 3100 IMG74693969444.exe Token: SeDebugPrivilege 3972 IMG74693969444.exe Token: SeDebugPrivilege 2924 IMG74693969444.exe Token: SeDebugPrivilege 8 RegAsm.exe Token: SeDebugPrivilege 3716 IMG74693969444.exe Token: SeDebugPrivilege 3600 IMG74693969444.exe Token: SeDebugPrivilege 2264 IMG74693969444.exe Token: SeDebugPrivilege 3812 IMG74693969444.exe Token: SeDebugPrivilege 404 IMG74693969444.exe Token: SeDebugPrivilege 3980 IMG74693969444.exe Token: SeDebugPrivilege 3548 IMG74693969444.exe Token: SeDebugPrivilege 1156 IMG74693969444.exe Token: SeDebugPrivilege 3164 IMG74693969444.exe Token: SeDebugPrivilege 3828 IMG74693969444.exe Token: SeDebugPrivilege 2368 IMG74693969444.exe Token: SeDebugPrivilege 4512 IMG74693969444.exe Token: SeDebugPrivilege 444 IMG74693969444.exe Token: SeDebugPrivilege 2684 IMG74693969444.exe Token: SeDebugPrivilege 5028 IMG74693969444.exe Token: SeDebugPrivilege 4328 IMG74693969444.exe Token: SeDebugPrivilege 4988 IMG74693969444.exe Token: SeDebugPrivilege 2308 IMG74693969444.exe Token: SeDebugPrivilege 1224 IMG74693969444.exe Token: SeDebugPrivilege 2616 IMG74693969444.exe Token: SeDebugPrivilege 1860 IMG74693969444.exe Token: SeDebugPrivilege 1984 IMG74693969444.exe Token: SeDebugPrivilege 2260 IMG74693969444.exe Token: SeDebugPrivilege 2352 IMG74693969444.exe Token: SeDebugPrivilege 3488 IMG74693969444.exe Token: SeDebugPrivilege 3008 IMG74693969444.exe Token: SeDebugPrivilege 4756 IMG74693969444.exe Token: SeDebugPrivilege 1760 IMG74693969444.exe Token: SeDebugPrivilege 4356 IMG74693969444.exe Token: SeDebugPrivilege 1204 IMG74693969444.exe Token: SeDebugPrivilege 2096 IMG74693969444.exe Token: SeDebugPrivilege 3044 IMG74693969444.exe Token: SeDebugPrivilege 4484 IMG74693969444.exe Token: SeDebugPrivilege 1224 IMG74693969444.exe Token: SeDebugPrivilege 1688 IMG74693969444.exe Token: SeDebugPrivilege 748 IMG74693969444.exe Token: SeDebugPrivilege 1984 IMG74693969444.exe Token: SeDebugPrivilege 4880 IMG74693969444.exe Token: SeDebugPrivilege 1360 IMG74693969444.exe Token: SeDebugPrivilege 3256 IMG74693969444.exe Token: SeDebugPrivilege 2544 IMG74693969444.exe Token: SeDebugPrivilege 3628 IMG74693969444.exe Token: SeDebugPrivilege 4008 IMG74693969444.exe Token: SeDebugPrivilege 3088 IMG74693969444.exe Token: SeDebugPrivilege 4004 IMG74693969444.exe Token: SeDebugPrivilege 1988 IMG74693969444.exe Token: SeDebugPrivilege 3364 IMG74693969444.exe Token: SeDebugPrivilege 4592 IMG74693969444.exe Token: SeDebugPrivilege 4848 IMG74693969444.exe Token: SeDebugPrivilege 3772 IMG74693969444.exe Token: SeDebugPrivilege 2676 IMG74693969444.exe Token: SeDebugPrivilege 748 IMG74693969444.exe Token: SeDebugPrivilege 1412 IMG74693969444.exe Token: SeDebugPrivilege 1552 IMG74693969444.exe Token: SeDebugPrivilege 5088 IMG74693969444.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
IMG74693969444.exeIMG74693969444.exeRegAsm.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exeIMG74693969444.exedescription pid process target process PID 880 wrote to memory of 5032 880 IMG74693969444.exe RegAsm.exe PID 880 wrote to memory of 5032 880 IMG74693969444.exe RegAsm.exe PID 880 wrote to memory of 5032 880 IMG74693969444.exe RegAsm.exe PID 880 wrote to memory of 2732 880 IMG74693969444.exe RegAsm.exe PID 880 wrote to memory of 2732 880 IMG74693969444.exe RegAsm.exe PID 880 wrote to memory of 2732 880 IMG74693969444.exe RegAsm.exe PID 880 wrote to memory of 8 880 IMG74693969444.exe RegAsm.exe PID 880 wrote to memory of 8 880 IMG74693969444.exe RegAsm.exe PID 880 wrote to memory of 8 880 IMG74693969444.exe RegAsm.exe PID 880 wrote to memory of 8 880 IMG74693969444.exe RegAsm.exe PID 880 wrote to memory of 4876 880 IMG74693969444.exe IMG74693969444.exe PID 880 wrote to memory of 4876 880 IMG74693969444.exe IMG74693969444.exe PID 880 wrote to memory of 4876 880 IMG74693969444.exe IMG74693969444.exe PID 4876 wrote to memory of 1812 4876 IMG74693969444.exe RegAsm.exe PID 4876 wrote to memory of 1812 4876 IMG74693969444.exe RegAsm.exe PID 4876 wrote to memory of 1812 4876 IMG74693969444.exe RegAsm.exe PID 4876 wrote to memory of 1812 4876 IMG74693969444.exe RegAsm.exe PID 4876 wrote to memory of 3012 4876 IMG74693969444.exe IMG74693969444.exe PID 4876 wrote to memory of 3012 4876 IMG74693969444.exe IMG74693969444.exe PID 4876 wrote to memory of 3012 4876 IMG74693969444.exe IMG74693969444.exe PID 8 wrote to memory of 3620 8 RegAsm.exe schtasks.exe PID 8 wrote to memory of 3620 8 RegAsm.exe schtasks.exe PID 8 wrote to memory of 3620 8 RegAsm.exe schtasks.exe PID 3012 wrote to memory of 2792 3012 IMG74693969444.exe RegAsm.exe PID 3012 wrote to memory of 2792 3012 IMG74693969444.exe RegAsm.exe PID 3012 wrote to memory of 2792 3012 IMG74693969444.exe RegAsm.exe PID 3012 wrote to memory of 2792 3012 IMG74693969444.exe RegAsm.exe PID 3012 wrote to memory of 3828 3012 IMG74693969444.exe IMG74693969444.exe PID 3012 wrote to memory of 3828 3012 IMG74693969444.exe IMG74693969444.exe PID 3012 wrote to memory of 3828 3012 IMG74693969444.exe IMG74693969444.exe PID 3828 wrote to memory of 2244 3828 IMG74693969444.exe RegAsm.exe PID 3828 wrote to memory of 2244 3828 IMG74693969444.exe RegAsm.exe PID 3828 wrote to memory of 2244 3828 IMG74693969444.exe RegAsm.exe PID 3828 wrote to memory of 2244 3828 IMG74693969444.exe RegAsm.exe PID 3828 wrote to memory of 2368 3828 IMG74693969444.exe IMG74693969444.exe PID 3828 wrote to memory of 2368 3828 IMG74693969444.exe IMG74693969444.exe PID 3828 wrote to memory of 2368 3828 IMG74693969444.exe IMG74693969444.exe PID 2368 wrote to memory of 3900 2368 IMG74693969444.exe RegAsm.exe PID 2368 wrote to memory of 3900 2368 IMG74693969444.exe RegAsm.exe PID 2368 wrote to memory of 3900 2368 IMG74693969444.exe RegAsm.exe PID 2368 wrote to memory of 3900 2368 IMG74693969444.exe RegAsm.exe PID 2368 wrote to memory of 3100 2368 IMG74693969444.exe IMG74693969444.exe PID 2368 wrote to memory of 3100 2368 IMG74693969444.exe IMG74693969444.exe PID 2368 wrote to memory of 3100 2368 IMG74693969444.exe IMG74693969444.exe PID 3100 wrote to memory of 1952 3100 IMG74693969444.exe RegAsm.exe PID 3100 wrote to memory of 1952 3100 IMG74693969444.exe RegAsm.exe PID 3100 wrote to memory of 1952 3100 IMG74693969444.exe RegAsm.exe PID 3100 wrote to memory of 1952 3100 IMG74693969444.exe RegAsm.exe PID 3100 wrote to memory of 3972 3100 IMG74693969444.exe IMG74693969444.exe PID 3100 wrote to memory of 3972 3100 IMG74693969444.exe IMG74693969444.exe PID 3100 wrote to memory of 3972 3100 IMG74693969444.exe IMG74693969444.exe PID 3972 wrote to memory of 3876 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 3876 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 3876 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 372 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 372 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 372 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 992 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 992 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 992 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 2260 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 2260 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 2260 3972 IMG74693969444.exe RegAsm.exe PID 3972 wrote to memory of 2300 3972 IMG74693969444.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5EE9.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6FA3.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"2⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"4⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"5⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"6⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"8⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"9⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"10⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"12⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"14⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"15⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"16⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"18⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"23⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"24⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"25⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"26⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"28⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"29⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"30⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"31⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"32⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"33⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"34⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"35⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"36⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"37⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"38⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"39⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"40⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"41⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"42⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"43⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"44⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"45⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"46⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"47⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"48⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"49⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"50⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"51⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"52⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"53⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"54⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"55⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"56⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"57⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"58⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"59⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"60⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"61⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"62⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"63⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"64⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"66⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"67⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"67⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"68⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"68⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"69⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"69⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"70⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"70⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"71⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"71⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"72⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"72⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"73⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"73⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"74⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"74⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"75⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"75⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"76⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"76⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"77⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"77⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"78⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"78⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"79⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"79⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"80⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"80⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"81⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"81⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"82⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"82⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"83⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"83⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"84⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"84⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"85⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"85⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"86⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"86⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"87⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"87⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"88⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"88⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"89⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"89⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"90⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"90⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"91⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"91⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"92⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"92⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"93⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"93⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"94⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"94⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"95⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"95⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"96⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"96⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"97⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"97⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"98⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"98⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"99⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"99⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"100⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"100⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"101⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"101⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"102⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"102⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"103⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"103⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"104⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"104⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"105⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"105⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"106⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"106⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"107⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"107⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"108⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"108⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"109⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"109⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"110⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"110⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"111⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"111⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"112⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"112⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"113⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"113⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"114⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"114⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"115⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"115⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"116⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"116⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"117⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"117⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"118⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"118⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"119⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"119⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"120⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"120⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"121⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"121⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"122⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"122⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"123⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"123⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"124⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"124⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"125⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"125⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"126⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"126⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"126⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"127⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"127⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"128⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"128⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"129⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"129⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"130⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"130⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"131⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"131⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"132⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"132⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"133⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"133⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"134⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"134⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"135⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"135⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"136⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"136⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"137⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"137⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"138⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"138⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"139⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"139⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"140⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"140⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"141⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"141⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"142⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"142⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"143⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"143⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"144⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"144⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"145⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"145⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"146⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"146⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"147⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"147⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"148⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"148⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"149⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"149⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"150⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"150⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"150⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"151⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"151⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"151⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"152⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"152⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"153⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"153⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"154⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"154⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"155⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"155⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"155⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"156⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"156⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"157⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"157⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"158⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"158⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"159⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"159⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"160⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"160⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"161⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"161⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"162⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"162⤵
- Checks computer location settings
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"163⤵
-
C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"C:\Users\Admin\AppData\Local\Temp\IMG74693969444.exe"163⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"164⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.logFilesize
1KB
MD584e77a587d94307c0ac1357eb4d3d46f
SHA183cc900f9401f43d181207d64c5adba7a85edc1e
SHA256e16024b092a026a9dc00df69d4b9bbcab7b2dc178dc5291fc308a1abc9304a99
SHA512aefb5c62200b3ed97718d20a89990954d4d8acdc0a6a73c5a420f1bba619cb79e70c2cd0a579b9f52dc6b09e1de2cea6cd6cac4376cfee92d94e2c01d310f691
-
C:\Users\Admin\AppData\Local\Temp\tmp5EE9.tmpFilesize
1KB
MD548ef7fa9033389ad7929d7a6b9d10298
SHA19db6cb7325c8bdf66a15f7b5f34703709a45aeb6
SHA2560c1b5f67eeb276d1d4205b138ce32bc6149924e02281a2db8e4623a700e88f15
SHA512ac8bd104ecbacc9bccce9e087f67e5b18072d59367ccd31d4e66132b6baaea520cba5b9b59464483d86abf74826b382c402f12e9a586c99bda8c78a0de33944e
-
C:\Users\Admin\AppData\Local\Temp\tmp6FA3.tmpFilesize
1KB
MD521de6c3a6440d917bdbb4b491191d9b2
SHA1c63c300affe7147910dc4544d2d5f3029bf321a6
SHA25623af17733a3882cdd82a5bbc321d896b2430dc1bb4b4ac034d129cde5027afc4
SHA512dcd1c464ed36593b990e072940ab415804ef8076743015fff4939211e30e436beb7ce6af3072769abe0214f737cedb210d2b45e6e90da20dac54c3945b11575f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HJdyTuap.exeFilesize
268KB
MD544540892e2dbc3f7303c15c3d1689ecf
SHA1c45e3eb984a69a0607d3e30e01009185a405c47f
SHA256f165aaaa891aac8a10cd6ae8ca9ae07a901daec1f4a97122466b65c7212aaeec
SHA512e7e8b79995e41c29e3d5e0348c720a72fa45aa2f0b656173b295984e550ef54c424787a8ce77ce0b7d0327ac62a2853053f5d3307672f1827fa77b37d4cff01e
-
memory/8-133-0x0000000000000000-mapping.dmp
-
memory/8-134-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/8-135-0x00000000054E0000-0x0000000005A84000-memory.dmpFilesize
5.6MB
-
memory/8-136-0x0000000004E80000-0x0000000004F12000-memory.dmpFilesize
584KB
-
memory/8-137-0x0000000004FD0000-0x000000000506C000-memory.dmpFilesize
624KB
-
memory/8-139-0x0000000004E70000-0x0000000004E7A000-memory.dmpFilesize
40KB
-
memory/404-167-0x0000000000000000-mapping.dmp
-
memory/444-183-0x0000000000000000-mapping.dmp
-
memory/880-130-0x0000000000A80000-0x0000000000ACA000-memory.dmpFilesize
296KB
-
memory/880-132-0x0000000005B40000-0x0000000005B43000-memory.dmpFilesize
12KB
-
memory/880-131-0x0000000005530000-0x0000000005533000-memory.dmpFilesize
12KB
-
memory/1156-173-0x0000000000000000-mapping.dmp
-
memory/1224-195-0x0000000000000000-mapping.dmp
-
memory/1584-178-0x0000000000000000-mapping.dmp
-
memory/1592-198-0x0000000000000000-mapping.dmp
-
memory/1812-140-0x0000000000000000-mapping.dmp
-
memory/1860-199-0x0000000000000000-mapping.dmp
-
memory/1896-176-0x0000000000000000-mapping.dmp
-
memory/1912-190-0x0000000000000000-mapping.dmp
-
memory/1952-150-0x0000000000000000-mapping.dmp
-
memory/1984-201-0x0000000000000000-mapping.dmp
-
memory/2120-174-0x0000000000000000-mapping.dmp
-
memory/2244-146-0x0000000000000000-mapping.dmp
-
memory/2260-203-0x0000000000000000-mapping.dmp
-
memory/2264-163-0x0000000000000000-mapping.dmp
-
memory/2300-202-0x0000000000000000-mapping.dmp
-
memory/2308-193-0x0000000000000000-mapping.dmp
-
memory/2328-182-0x0000000000000000-mapping.dmp
-
memory/2352-205-0x0000000000000000-mapping.dmp
-
memory/2356-166-0x0000000000000000-mapping.dmp
-
memory/2364-204-0x0000000000000000-mapping.dmp
-
memory/2368-147-0x0000000000000000-mapping.dmp
-
memory/2368-179-0x0000000000000000-mapping.dmp
-
memory/2440-170-0x0000000000000000-mapping.dmp
-
memory/2452-164-0x0000000000000000-mapping.dmp
-
memory/2592-186-0x0000000000000000-mapping.dmp
-
memory/2616-197-0x0000000000000000-mapping.dmp
-
memory/2668-152-0x0000000000000000-mapping.dmp
-
memory/2684-185-0x0000000000000000-mapping.dmp
-
memory/2724-180-0x0000000000000000-mapping.dmp
-
memory/2792-144-0x0000000000000000-mapping.dmp
-
memory/2924-154-0x0000000000000000-mapping.dmp
-
memory/3012-141-0x0000000000000000-mapping.dmp
-
memory/3100-149-0x0000000000000000-mapping.dmp
-
memory/3112-192-0x0000000000000000-mapping.dmp
-
memory/3164-175-0x0000000000000000-mapping.dmp
-
memory/3416-172-0x0000000000000000-mapping.dmp
-
memory/3548-171-0x0000000000000000-mapping.dmp
-
memory/3600-161-0x0000000000000000-mapping.dmp
-
memory/3620-142-0x0000000000000000-mapping.dmp
-
memory/3716-158-0x0000000000000000-mapping.dmp
-
memory/3804-162-0x0000000000000000-mapping.dmp
-
memory/3812-165-0x0000000000000000-mapping.dmp
-
memory/3828-145-0x0000000000000000-mapping.dmp
-
memory/3828-177-0x0000000000000000-mapping.dmp
-
memory/3860-188-0x0000000000000000-mapping.dmp
-
memory/3868-168-0x0000000000000000-mapping.dmp
-
memory/3900-148-0x0000000000000000-mapping.dmp
-
memory/3956-159-0x0000000000000000-mapping.dmp
-
memory/3972-151-0x0000000000000000-mapping.dmp
-
memory/3980-169-0x0000000000000000-mapping.dmp
-
memory/4144-194-0x0000000000000000-mapping.dmp
-
memory/4328-189-0x0000000000000000-mapping.dmp
-
memory/4480-196-0x0000000000000000-mapping.dmp
-
memory/4512-181-0x0000000000000000-mapping.dmp
-
memory/4512-155-0x0000000000000000-mapping.dmp
-
memory/4544-184-0x0000000000000000-mapping.dmp
-
memory/4748-157-0x0000000000000000-mapping.dmp
-
memory/4868-200-0x0000000000000000-mapping.dmp
-
memory/4876-138-0x0000000000000000-mapping.dmp
-
memory/4988-191-0x0000000000000000-mapping.dmp
-
memory/5028-187-0x0000000000000000-mapping.dmp