Analysis

  • max time kernel
    151s
  • max time network
    145s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    10/07/2020, 07:04

General

  • Target
    Quotation.exe
  • Size 267KB
  • Sample200710-4vbab642da
  • SHA256 e8edf009c1c82f348ad925f7f9a34b4f241d52240c6cb43ab4536c4b363d5322
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • System policy modification 1 TTPs 1 IoCs
  • Adds Run entry to policy start application 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 1123 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Suspicious behavior: EnumeratesProcesses 15514 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Suspicious behavior: MapViewOfSection 276 IoCs
  • Suspicious use of AdjustPrivilegeToken 190 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious use of SetThreadContext 140 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Checks whether UAC is enabled
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1244
    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetThreadContext
      PID:1460
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetThreadContext
        PID:1608
      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetThreadContext
        PID:788
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetThreadContext
          PID:1040
        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetThreadContext
          PID:1684
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            5⤵
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetThreadContext
            PID:1872
          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetThreadContext
            PID:1884
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              6⤵
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetThreadContext
              PID:1824
            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
              6⤵
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetThreadContext
              PID:1756
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                7⤵
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetThreadContext
                PID:1556
                • C:\Windows\SysWOW64\explorer.exe
                  "C:\Windows\SysWOW64\explorer.exe"
                  8⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1820
              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                7⤵
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetThreadContext
                PID:1980
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  8⤵
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetThreadContext
                  PID:2012
                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                  8⤵
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetThreadContext
                  PID:1996
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    9⤵
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetThreadContext
                    PID:240
                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                    9⤵
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetThreadContext
                    PID:1204
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      10⤵
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetThreadContext
                      PID:756
                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                      10⤵
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetThreadContext
                      PID:880
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        11⤵
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetThreadContext
                        PID:1644
                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                        11⤵
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetThreadContext
                        PID:1520
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          12⤵
                            PID:1512
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            12⤵
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of SetThreadContext
                            PID:1564
                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                            12⤵
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of SetThreadContext
                            PID:1412
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              13⤵
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of SetThreadContext
                              PID:1636
                              • C:\Windows\SysWOW64\msiexec.exe
                                "C:\Windows\SysWOW64\msiexec.exe"
                                14⤵
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1516
                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                              13⤵
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of SetThreadContext
                              PID:1120
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                14⤵
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of SetThreadContext
                                PID:2040
                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                14⤵
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of SetThreadContext
                                PID:1752
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  15⤵
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetThreadContext
                                  PID:1424
                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                  15⤵
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of SetThreadContext
                                  PID:1592
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    16⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SetThreadContext
                                    PID:1932
                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                    16⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SetThreadContext
                                    PID:572
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      17⤵
                                        PID:320
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        17⤵
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SetThreadContext
                                        PID:1036
                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                        17⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SetThreadContext
                                        PID:1440
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          18⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of SetThreadContext
                                          PID:1920
                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                          18⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of SetThreadContext
                                          PID:1880
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            19⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SetThreadContext
                                            PID:1408
                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                            19⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of SetThreadContext
                                            PID:1828
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              20⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of SetThreadContext
                                              PID:1956
                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                              20⤵
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of SetThreadContext
                                              PID:800
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                21⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of SetThreadContext
                                                PID:1576
                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                21⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of SetThreadContext
                                                PID:1620
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  22⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of SetThreadContext
                                                  PID:1160
                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                  22⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  • Suspicious use of SetThreadContext
                                                  PID:1560
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    23⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of SetThreadContext
                                                    PID:836
                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                    23⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    • Suspicious use of SetThreadContext
                                                    PID:1752
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                      24⤵
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of SetThreadContext
                                                      PID:1260
                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                      24⤵
                                                      • Suspicious use of SetThreadContext
                                                      PID:1792
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                        25⤵
                                                        • Suspicious use of SetThreadContext
                                                        PID:1480
                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                        25⤵
                                                        • Suspicious use of SetThreadContext
                                                        PID:880
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                          26⤵
                                                          • Suspicious use of SetThreadContext
                                                          PID:1472
                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                          26⤵
                                                          • Suspicious use of SetThreadContext
                                                          PID:1800
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            27⤵
                                                            • Suspicious use of SetThreadContext
                                                            PID:832
                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                            27⤵
                                                            • Suspicious use of SetThreadContext
                                                            PID:1692
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                              28⤵
                                                              • Suspicious use of SetThreadContext
                                                              PID:1120
                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                              28⤵
                                                              • Suspicious use of SetThreadContext
                                                              PID:1520
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                29⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:1164
                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                29⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:564
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                  30⤵
                                                                    PID:2032
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    30⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:880
                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                    30⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:1084
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      31⤵
                                                                        PID:1788
                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                        31⤵
                                                                          PID:1428
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                            32⤵
                                                                              PID:1416
                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                              32⤵
                                                                                PID:1340
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                  33⤵
                                                                                    PID:1444
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                    33⤵
                                                                                      PID:1940
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                        34⤵
                                                                                          PID:1804
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                          34⤵
                                                                                            PID:1888
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                              35⤵
                                                                                                PID:852
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                35⤵
                                                                                                  PID:1496
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                    36⤵
                                                                                                      PID:1532
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                      36⤵
                                                                                                        PID:1864
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                          37⤵
                                                                                                            PID:1596
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                            37⤵
                                                                                                              PID:1880
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                38⤵
                                                                                                                  PID:676
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                  38⤵
                                                                                                                    PID:1372
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                    38⤵
                                                                                                                      PID:1792
                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                        39⤵
                                                                                                                          PID:340
                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                          39⤵
                                                                                                                            PID:1492
                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                              40⤵
                                                                                                                                PID:1940
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                40⤵
                                                                                                                                  PID:1796
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                    41⤵
                                                                                                                                      PID:1980
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                      41⤵
                                                                                                                                        PID:524
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                          42⤵
                                                                                                                                            PID:816
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                            42⤵
                                                                                                                                              PID:1380
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                43⤵
                                                                                                                                                  PID:2044
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                  43⤵
                                                                                                                                                    PID:1452
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                      44⤵
                                                                                                                                                        PID:768
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                        44⤵
                                                                                                                                                          PID:1880
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                            45⤵
                                                                                                                                                              PID:1828
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                              45⤵
                                                                                                                                                                PID:2068
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                  46⤵
                                                                                                                                                                    PID:2124
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                    46⤵
                                                                                                                                                                      PID:2132
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                      46⤵
                                                                                                                                                                        PID:2160
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                          47⤵
                                                                                                                                                                            PID:2216
                                                                                                                                                                            • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                              "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                              48⤵
                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                              PID:2716
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                            47⤵
                                                                                                                                                                              PID:2244
                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                48⤵
                                                                                                                                                                                  PID:2296
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                  48⤵
                                                                                                                                                                                    PID:2324
                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                      49⤵
                                                                                                                                                                                        PID:2368
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                        49⤵
                                                                                                                                                                                          PID:2396
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                            50⤵
                                                                                                                                                                                              PID:2456
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                              50⤵
                                                                                                                                                                                                PID:2484
                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                  51⤵
                                                                                                                                                                                                    PID:2540
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                    51⤵
                                                                                                                                                                                                      PID:2568
                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                        52⤵
                                                                                                                                                                                                          PID:2620
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                          52⤵
                                                                                                                                                                                                            PID:2628
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                            52⤵
                                                                                                                                                                                                              PID:2636
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                              52⤵
                                                                                                                                                                                                                PID:2664
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                  53⤵
                                                                                                                                                                                                                    PID:2824
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                                                      54⤵
                                                                                                                                                                                                                        PID:2172
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                        PID:2860
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                          54⤵
                                                                                                                                                                                                                            PID:2912
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                              PID:2940
                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                55⤵
                                                                                                                                                                                                                                  PID:3020
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                  55⤵
                                                                                                                                                                                                                                    PID:3052
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                        PID:1004
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                        56⤵
                                                                                                                                                                                                                                          PID:1908
                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                              57⤵
                                                                                                                                                                                                                                                PID:1876
                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                    PID:2136
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                    58⤵
                                                                                                                                                                                                                                                      PID:2096
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                                          PID:2276
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                            PID:2300
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                PID:2384
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                                                  PID:2528
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                    61⤵
                                                                                                                                                                                                                                                                      PID:2472
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                                                                        PID:2400
                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                          62⤵
                                                                                                                                                                                                                                                                            PID:2708
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                              PID:2736
                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                63⤵
                                                                                                                                                                                                                                                                                  PID:2900
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                    PID:2584
                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                      64⤵
                                                                                                                                                                                                                                                                                        PID:3016
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                        64⤵
                                                                                                                                                                                                                                                                                          PID:2668
                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                            65⤵
                                                                                                                                                                                                                                                                                              PID:1776
                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                              65⤵
                                                                                                                                                                                                                                                                                                PID:2988
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                                65⤵
                                                                                                                                                                                                                                                                                                  PID:2876
                                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                    66⤵
                                                                                                                                                                                                                                                                                                      PID:1272
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                                      66⤵
                                                                                                                                                                                                                                                                                                        PID:2212
                                                                                                                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1148
                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1060
                                                                                                                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1044
                                                                                                                                                                            • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                              "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                              • System policy modification
                                                                                                                                                                              • Adds Run entry to policy start application
                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                              • Modifies Internet Explorer settings
                                                                                                                                                                              • Suspicious behavior: MapViewOfSection
                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                              • Suspicious use of SetThreadContext
                                                                                                                                                                              PID:1056
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1772
                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\Firefox.exe
                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1944
                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1868
                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1588
                                                                                                                                                                                • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1740
                                                                                                                                                                                • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1568
                                                                                                                                                                                • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                  "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:544
                                                                                                                                                                                • C:\Windows\SysWOW64\wuapp.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\wuapp.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1064
                                                                                                                                                                                • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1404
                                                                                                                                                                                • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:788
                                                                                                                                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1536
                                                                                                                                                                                • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:752
                                                                                                                                                                                • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:612
                                                                                                                                                                                • C:\Windows\SysWOW64\wuapp.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\wuapp.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1152
                                                                                                                                                                                • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1708
                                                                                                                                                                                • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1848
                                                                                                                                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1584
                                                                                                                                                                                • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                  PID:1976
                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1288
                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:572
                                                                                                                                                                                    • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                      "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:1460
                                                                                                                                                                                    • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                      "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1144
                                                                                                                                                                                      • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                                                        "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:1376
                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                          "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1560
                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1752
                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1980
                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1072
                                                                                                                                                                                                • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1084
                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1416
                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:572
                                                                                                                                                                                                      • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                        "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1620
                                                                                                                                                                                                        • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                          "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:436
                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:564
                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1188
                                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1532
                                                                                                                                                                                                                • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1132
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1864
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:940
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                        "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:748
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1916
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wininit.exe
                                                                                                                                                                                                                            "C:\Windows\SysWOW64\wininit.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1928
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:436
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1060
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1132
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\mstsc.exe
                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\mstsc.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1620
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1656
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1692
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1936
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1256
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1864
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                PID:2032
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1860
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1684
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1436
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:940
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1340
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:2104
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:2196
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:2360
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:2432
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:2612
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:2700
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:2744
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:2752
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:2760
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:2768
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:2776
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:2784
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:2792
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:2800
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:2808
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:2816
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:2836
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:2996
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\NAPSTAT.EXE
                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\NAPSTAT.EXE"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1188
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:2056
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:2252
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:688
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\cmd.exe"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:2264
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                        PID:2344
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:2656
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:2768
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:2776
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:2784
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:2792
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:2800
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:2808
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:2816
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:2740
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:2620
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:2628
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:2496
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:2504
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:2564
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:2484
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:2844
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:2992
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:2928

                                                                                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                                                                                              memory/436-166-0x0000000000EA0000-0x0000000000EB6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/544-42-0x0000000000190000-0x0000000000199000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/612-75-0x0000000000590000-0x0000000000597000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/688-315-0x00000000000E0000-0x00000000000ED000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/748-146-0x00000000004D0000-0x00000000004E4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/752-70-0x0000000000570000-0x0000000000596000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/788-56-0x0000000000FB0000-0x0000000000FC8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/940-233-0x00000000007C0000-0x00000000008B4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1056-109-0x00000000032E0000-0x00000000033AF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1056-7-0x0000000000C30000-0x0000000000C48000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1056-86-0x0000000076030000-0x000000007603C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1056-87-0x0000000075220000-0x000000007533D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1056-23-0x0000000002F30000-0x00000000030C2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1060-168-0x0000000000940000-0x0000000000962000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1064-47-0x0000000000910000-0x000000000091B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1132-173-0x00000000000C0000-0x00000000000D4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1144-123-0x0000000000560000-0x0000000000565000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1152-82-0x0000000000330000-0x000000000033B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1188-296-0x0000000000500000-0x0000000000546000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-300-0x000000000CE60000-0x000000000CFE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-203-0x000000000B1C0000-0x000000000B283000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-231-0x000000000BA00000-0x000000000BB95000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-12-0x00000000076C0000-0x00000000077E0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-306-0x000000000CFF0000-0x000000000D19C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-349-0x000000000D920000-0x000000000DA05000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-68-0x0000000007400000-0x00000000074D5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-289-0x000000000C900000-0x000000000CA30000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-283-0x0000000006EC7000-0x0000000006ECB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-274-0x000000000C510000-0x000000000C69A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-207-0x000000000B290000-0x000000000B417000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-260-0x000000000C240000-0x000000000C305000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-266-0x000000000C310000-0x000000000C436000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-187-0x000000000ACA0000-0x000000000AD5F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-215-0x000000000B5D0000-0x000000000B6FA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-154-0x000000000A390000-0x000000000A446000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-103-0x0000000009750000-0x000000000987B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1244-35-0x0000000006EC7000-0x0000000006ECB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1256-202-0x0000000000240000-0x0000000000258000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1340-238-0x0000000000390000-0x00000000003B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1376-128-0x0000000000D90000-0x0000000000DAC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1404-51-0x0000000000890000-0x000000000089A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1436-227-0x0000000000DB0000-0x0000000000DBD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1460-118-0x0000000000EF0000-0x0000000000EF6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1516-80-0x00000000001B0000-0x00000000001C4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1536-64-0x0000000000470000-0x0000000000478000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1560-136-0x0000000000BF0000-0x0000000000C12000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1568-37-0x00000000004A0000-0x0000000000594000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1584-105-0x0000000000280000-0x0000000000288000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1608-0-0x0000000000400000-0x000000000042D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1620-178-0x0000000000900000-0x0000000000A04000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1656-183-0x0000000000170000-0x000000000017A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1684-225-0x0000000000F20000-0x0000000000F46000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1692-189-0x00000000001E0000-0x00000000001ED000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1708-89-0x0000000000FE0000-0x0000000000FED000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1740-28-0x0000000000DF0000-0x0000000000E06000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1752-141-0x0000000000AA0000-0x0000000000AAE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1820-49-0x0000000000D30000-0x0000000000FB1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1848-99-0x0000000000640000-0x000000000065F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1860-220-0x0000000000B30000-0x0000000000B36000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1864-212-0x0000000000980000-0x0000000000985000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1868-17-0x0000000000890000-0x000000000089E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1916-156-0x0000000000710000-0x0000000000715000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1928-161-0x0000000000060000-0x000000000007A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1936-194-0x0000000000380000-0x0000000000601000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1944-111-0x000000013FE90000-0x000000013FF23000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/1976-113-0x0000000000A60000-0x0000000000A78000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2032-214-0x00000000000D0000-0x00000000000D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2056-302-0x0000000000E20000-0x0000000000E26000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2104-243-0x0000000000900000-0x0000000000926000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2172-310-0x00000000009C0000-0x00000000009C9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2196-248-0x0000000000430000-0x0000000000438000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2252-308-0x00000000009B0000-0x00000000009C6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2264-320-0x0000000049D70000-0x0000000049DBC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2344-325-0x0000000000780000-0x0000000000787000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2360-256-0x00000000005A0000-0x00000000005A5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2432-262-0x0000000000370000-0x000000000037E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2612-271-0x0000000000D20000-0x0000000000D42000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2656-330-0x0000000000710000-0x0000000000724000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2700-279-0x0000000000560000-0x000000000056A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2716-273-0x0000000000B80000-0x0000000000B87000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2836-285-0x0000000000900000-0x0000000000914000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2844-335-0x0000000000B20000-0x0000000000B3B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2928-345-0x00000000003B0000-0x00000000003B8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2992-340-0x0000000000940000-0x0000000000956000-memory.dmp

                                                                                                                                                                                                                                                                                                                                              memory/2996-291-0x0000000000430000-0x000000000044F000-memory.dmp