Analysis

  • max time kernel
    151s
  • max time network
    137s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    07-07-2020 17:18

General

  • Target

    chusmoni.exe

  • Size

    333KB

  • MD5

    43ab1e4d8499507ba762ed516b3c46f5

  • SHA1

    dbb84608528fff3bbe56592d9385c22019cdf663

  • SHA256

    c17b7612a5cd7b21ca202a966406d24d7d42047f13ba6254c5ea284d7d4fc764

  • SHA512

    28572516a323404a3e1f44d9b57487607e0fdb598358f156023a77818128355b159103664ed449e1bf6d3f75aca27a68e9117a2f8d802b578483312bc2e81bb0

Score
5/10

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 831 IoCs
  • Suspicious behavior: MapViewOfSection 73 IoCs
  • Suspicious use of SetThreadContext 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 76 IoCs
  • Suspicious behavior: EnumeratesProcesses 15549 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
    "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    PID:1612
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1072
    • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
      "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      PID:1692
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:1824
        • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
          "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:1880
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:1896
            • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
              "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:1960
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                  PID:1304
                • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                  "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1828
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                      PID:1592
                    • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                      "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1560
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        7⤵
                          PID:2024
                        • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                          "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                          7⤵
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:828
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            8⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1504
                          • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                            "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                            8⤵
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1052
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              9⤵
                                PID:1176
                              • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                9⤵
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1044
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  10⤵
                                    PID:1076
                                  • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                    "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                    10⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1768
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      11⤵
                                        PID:1852
                                      • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                        "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                        11⤵
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:1880
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          12⤵
                                            PID:1964
                                          • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                            "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                            12⤵
                                            • Suspicious behavior: MapViewOfSection
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1836
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              13⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1588
                                            • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                              "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                              13⤵
                                              • Suspicious behavior: MapViewOfSection
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2004
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                14⤵
                                                  PID:1484
                                                • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                  14⤵
                                                  • Suspicious behavior: MapViewOfSection
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:520
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    15⤵
                                                      PID:1612
                                                    • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                      15⤵
                                                      • Suspicious behavior: MapViewOfSection
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:1784
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                        16⤵
                                                          PID:1872
                                                        • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                          16⤵
                                                          • Suspicious behavior: MapViewOfSection
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:740
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            17⤵
                                                              PID:1972
                                                            • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                              17⤵
                                                              • Suspicious behavior: MapViewOfSection
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1448
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                18⤵
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1072
                                                              • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                18⤵
                                                                • Suspicious behavior: MapViewOfSection
                                                                • Suspicious use of SetThreadContext
                                                                • Suspicious use of AdjustPrivilegeToken
                                                                PID:1912
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                  19⤵
                                                                    PID:1304
                                                                  • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                    19⤵
                                                                    • Suspicious behavior: MapViewOfSection
                                                                    • Suspicious use of SetThreadContext
                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                    PID:1156
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      20⤵
                                                                        PID:1380
                                                                      • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                        20⤵
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        • Suspicious use of SetThreadContext
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        PID:1836
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                          21⤵
                                                                            PID:1660
                                                                          • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                            21⤵
                                                                            • Suspicious behavior: MapViewOfSection
                                                                            • Suspicious use of SetThreadContext
                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                            PID:584
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                              22⤵
                                                                                PID:1628
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                22⤵
                                                                                  PID:1604
                                                                                • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                  22⤵
                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                  • Suspicious use of SetThreadContext
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1832
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                    23⤵
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:1932
                                                                                  • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                    23⤵
                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                    • Suspicious use of SetThreadContext
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    PID:1972
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                      24⤵
                                                                                        PID:572
                                                                                      • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                        24⤵
                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                        • Suspicious use of SetThreadContext
                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                        PID:1964
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                          25⤵
                                                                                            PID:620
                                                                                          • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                            25⤵
                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                            • Suspicious use of SetThreadContext
                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                            PID:2012
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                              26⤵
                                                                                                PID:1580
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                26⤵
                                                                                                  PID:2032
                                                                                                • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                  26⤵
                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                  • Suspicious use of SetThreadContext
                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                  PID:1952
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                    27⤵
                                                                                                      PID:1960
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                      27⤵
                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                      • Suspicious use of SetThreadContext
                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                      PID:1836
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                        28⤵
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:584
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                        28⤵
                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                        • Suspicious use of SetThreadContext
                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                        PID:1060
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                          29⤵
                                                                                                            PID:1872
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                            29⤵
                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                            • Suspicious use of SetThreadContext
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1660
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                              30⤵
                                                                                                                PID:876
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                30⤵
                                                                                                                  PID:1956
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                  30⤵
                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                  PID:108
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                    31⤵
                                                                                                                      PID:1524
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                      31⤵
                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                      PID:1028
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                        32⤵
                                                                                                                          PID:1708
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                          32⤵
                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                          PID:2008
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                            33⤵
                                                                                                                              PID:1556
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                              33⤵
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1936
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                              33⤵
                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                              PID:1640
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                34⤵
                                                                                                                                  PID:1892
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                  34⤵
                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                  PID:1612
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                    35⤵
                                                                                                                                      PID:1828
                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                      35⤵
                                                                                                                                        PID:1840
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                        35⤵
                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:1856
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                          36⤵
                                                                                                                                            PID:1280
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                            36⤵
                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            PID:1980
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                              37⤵
                                                                                                                                                PID:1540
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                37⤵
                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                PID:1956
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                  38⤵
                                                                                                                                                    PID:1488
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                    38⤵
                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                    PID:1068
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                      39⤵
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:1848
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                      39⤵
                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      PID:1204
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                        40⤵
                                                                                                                                                          PID:1056
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                          40⤵
                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:1052
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                            41⤵
                                                                                                                                                              PID:1424
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                              41⤵
                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                              PID:1304
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                42⤵
                                                                                                                                                                  PID:1924
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                  42⤵
                                                                                                                                                                    PID:828
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                    42⤵
                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                    PID:1336
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                      43⤵
                                                                                                                                                                        PID:584
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                        43⤵
                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                        PID:1040
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                          44⤵
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:1632
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                          44⤵
                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                          PID:436
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                            45⤵
                                                                                                                                                                              PID:1152
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                              45⤵
                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              PID:532
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                46⤵
                                                                                                                                                                                  PID:2000
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                  46⤵
                                                                                                                                                                                  • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                  • Suspicious use of SetThreadContext
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1988
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                    47⤵
                                                                                                                                                                                      PID:1832
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                      47⤵
                                                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:1612
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                        48⤵
                                                                                                                                                                                          PID:1576
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                          48⤵
                                                                                                                                                                                          • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                          • Suspicious use of SetThreadContext
                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                          PID:1600
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                            49⤵
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:1088
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                            49⤵
                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:268
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                              50⤵
                                                                                                                                                                                                PID:1644
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                50⤵
                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                PID:1956
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                    PID:1940
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                    • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                    PID:1932
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                        PID:892
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:532
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                            PID:1912
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                            PID:1516
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                PID:1832
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:1944
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                    PID:1280
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                    55⤵
                                                                                                                                                                                                                      PID:572
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                        PID:1772
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                        PID:1904
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                            PID:1484
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                            PID:1304
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                PID:432
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                                57⤵
                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                PID:464
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                    PID:1164
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                    PID:1840
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                        PID:1936
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                        PID:1932
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                          60⤵
                                                                                                                                                                                                                                            PID:340
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                                            60⤵
                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                            PID:532
                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                              61⤵
                                                                                                                                                                                                                                                PID:572
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                                                61⤵
                                                                                                                                                                                                                                                • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                PID:1020
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                    PID:740
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                                                    62⤵
                                                                                                                                                                                                                                                    • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                    PID:1784
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                        PID:1460
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                        PID:1956
                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                          64⤵
                                                                                                                                                                                                                                                            PID:1848
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                                                                                            PID:364
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                PID:1420
                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                  PID:1304
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\chusmoni.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\chusmoni.exe"
                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                    PID:1508

                                                                                                                                  Network

                                                                                                                                  MITRE ATT&CK Matrix

                                                                                                                                  Replay Monitor

                                                                                                                                  Loading Replay Monitor...

                                                                                                                                  Downloads

                                                                                                                                  • memory/1072-0-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    304KB

                                                                                                                                  • memory/1072-3-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    304KB

                                                                                                                                  • memory/1072-2-0x0000000000400000-0x000000000044C000-memory.dmp

                                                                                                                                    Filesize

                                                                                                                                    304KB