formbook | e8edf009c1c82f348ad925f7f9a34b4f241d52240c6cb43ab4536c4b363d5322

Analysis

max time kernel
151s
max time network
145s
platform
windows7_x64
resource
win7
submitted
10-07-2020 07:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quotation.exe
Size

267KB
MD5

1f2e931a76dbfac440c933b05a2c8e03
SHA1

5a88cfede5d282779cd290241d00be1012967c1f
SHA256

e8edf009c1c82f348ad925f7f9a34b4f241d52240c6cb43ab4536c4b363d5322
SHA512

36d3fe9e87a96782c6444bdad565c3abee88c17905fe8ab8213b33d2af44c48b4dc2b2582f371e897978893b271161c7d0f8b975057038cdc02f589529e31c9b

Score

10^/10

spyware evasion trojan stealer formbook persistence

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Explorer.EXE

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
System policy modification 1 TTPs 1 IoCs
evasion

Modify Registry
T1112

Processes:

colorcpl.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer colorcpl.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	colorcpl.exe

Adds Run entry to policy start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

colorcpl.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	colorcpl.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\5JMDUFWHU68 = "C:\\Program Files (x86)\\Mvtg4dx\\igfxwnuxv4rh.exe"	colorcpl.exe

Suspicious use of WriteProcessMemory 1123 IoCs

Processes:

Quotation.exeExplorer.EXEQuotation.execolorcpl.exeQuotation.exeQuotation.exe

description	pid	process	target process
PID 1460 wrote to memory of 1608	1460	Quotation.exe	RegAsm.exe
PID 1460 wrote to memory of 1608	1460	Quotation.exe	RegAsm.exe
PID 1460 wrote to memory of 1608	1460	Quotation.exe	RegAsm.exe
PID 1460 wrote to memory of 1608	1460	Quotation.exe	RegAsm.exe
PID 1460 wrote to memory of 1608	1460	Quotation.exe	RegAsm.exe
PID 1460 wrote to memory of 1608	1460	Quotation.exe	RegAsm.exe
PID 1460 wrote to memory of 1608	1460	Quotation.exe	RegAsm.exe
PID 1460 wrote to memory of 1608	1460	Quotation.exe	RegAsm.exe
PID 1460 wrote to memory of 788	1460	Quotation.exe	Quotation.exe
PID 1460 wrote to memory of 788	1460	Quotation.exe	Quotation.exe
PID 1460 wrote to memory of 788	1460	Quotation.exe	Quotation.exe
PID 1460 wrote to memory of 788	1460	Quotation.exe	Quotation.exe
PID 1244 wrote to memory of 1056	1244	Explorer.EXE	colorcpl.exe
PID 1244 wrote to memory of 1056	1244	Explorer.EXE	colorcpl.exe
PID 1244 wrote to memory of 1056	1244	Explorer.EXE	colorcpl.exe
PID 1244 wrote to memory of 1056	1244	Explorer.EXE	colorcpl.exe
PID 788 wrote to memory of 1040	788	Quotation.exe	RegAsm.exe
PID 788 wrote to memory of 1040	788	Quotation.exe	RegAsm.exe
PID 788 wrote to memory of 1040	788	Quotation.exe	RegAsm.exe
PID 788 wrote to memory of 1040	788	Quotation.exe	RegAsm.exe
PID 788 wrote to memory of 1040	788	Quotation.exe	RegAsm.exe
PID 788 wrote to memory of 1040	788	Quotation.exe	RegAsm.exe
PID 788 wrote to memory of 1040	788	Quotation.exe	RegAsm.exe
PID 788 wrote to memory of 1040	788	Quotation.exe	RegAsm.exe
PID 788 wrote to memory of 1684	788	Quotation.exe	Quotation.exe
PID 788 wrote to memory of 1684	788	Quotation.exe	Quotation.exe
PID 788 wrote to memory of 1684	788	Quotation.exe	Quotation.exe
PID 788 wrote to memory of 1684	788	Quotation.exe	Quotation.exe
PID 1056 wrote to memory of 1772	1056	colorcpl.exe	cmd.exe
PID 1056 wrote to memory of 1772	1056	colorcpl.exe	cmd.exe
PID 1056 wrote to memory of 1772	1056	colorcpl.exe	cmd.exe
PID 1056 wrote to memory of 1772	1056	colorcpl.exe	cmd.exe
PID 1684 wrote to memory of 1872	1684	Quotation.exe	RegAsm.exe
PID 1684 wrote to memory of 1872	1684	Quotation.exe	RegAsm.exe
PID 1684 wrote to memory of 1872	1684	Quotation.exe	RegAsm.exe
PID 1684 wrote to memory of 1872	1684	Quotation.exe	RegAsm.exe
PID 1684 wrote to memory of 1872	1684	Quotation.exe	RegAsm.exe
PID 1684 wrote to memory of 1872	1684	Quotation.exe	RegAsm.exe
PID 1684 wrote to memory of 1872	1684	Quotation.exe	RegAsm.exe
PID 1684 wrote to memory of 1872	1684	Quotation.exe	RegAsm.exe
PID 1684 wrote to memory of 1884	1684	Quotation.exe	Quotation.exe
PID 1684 wrote to memory of 1884	1684	Quotation.exe	Quotation.exe
PID 1684 wrote to memory of 1884	1684	Quotation.exe	Quotation.exe
PID 1684 wrote to memory of 1884	1684	Quotation.exe	Quotation.exe
PID 1244 wrote to memory of 1868	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 1868	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 1868	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 1868	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 1868	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 1868	1244	Explorer.EXE	rundll32.exe
PID 1244 wrote to memory of 1868	1244	Explorer.EXE	rundll32.exe
PID 1884 wrote to memory of 1824	1884	Quotation.exe	RegAsm.exe
PID 1884 wrote to memory of 1824	1884	Quotation.exe	RegAsm.exe
PID 1884 wrote to memory of 1824	1884	Quotation.exe	RegAsm.exe
PID 1884 wrote to memory of 1824	1884	Quotation.exe	RegAsm.exe
PID 1884 wrote to memory of 1824	1884	Quotation.exe	RegAsm.exe
PID 1884 wrote to memory of 1824	1884	Quotation.exe	RegAsm.exe
PID 1884 wrote to memory of 1824	1884	Quotation.exe	RegAsm.exe
PID 1884 wrote to memory of 1824	1884	Quotation.exe	RegAsm.exe
PID 1884 wrote to memory of 1756	1884	Quotation.exe	Quotation.exe
PID 1884 wrote to memory of 1756	1884	Quotation.exe	Quotation.exe
PID 1884 wrote to memory of 1756	1884	Quotation.exe	Quotation.exe
PID 1884 wrote to memory of 1756	1884	Quotation.exe	Quotation.exe
PID 1244 wrote to memory of 1588	1244	Explorer.EXE	rundll32.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE
1244 Explorer.EXE
1244 Explorer.EXE
1244 Explorer.EXE

pid	process
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

colorcpl.exe

description	ioc	process
Key created	\Registry\User\S-1-5-21-1131729243-447456001-3632642222-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	colorcpl.exe

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Suspicious behavior: EnumeratesProcesses 15514 IoCs

Processes:

Quotation.exe

pid	process
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe
1460	Quotation.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chkdsk.exechkdsk.exechkdsk.exechkdsk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious behavior: MapViewOfSection 276 IoCs

Processes:

Quotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.execolorcpl.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exe

pid	process
1460	Quotation.exe
1608	RegAsm.exe
788	Quotation.exe
1040	RegAsm.exe
1608	RegAsm.exe
1608	RegAsm.exe
1684	Quotation.exe
1872	RegAsm.exe
1056	colorcpl.exe
1884	Quotation.exe
1824	RegAsm.exe
1872	RegAsm.exe
1872	RegAsm.exe
1040	RegAsm.exe
1756	Quotation.exe
1556	RegAsm.exe
1824	RegAsm.exe
1824	RegAsm.exe
1056	colorcpl.exe
1980	Quotation.exe
1040	RegAsm.exe
1040	RegAsm.exe
2012	RegAsm.exe
1996	Quotation.exe
240	RegAsm.exe
1556	RegAsm.exe
1204	Quotation.exe
756	RegAsm.exe
240	RegAsm.exe
240	RegAsm.exe
2012	RegAsm.exe
880	Quotation.exe
1644	RegAsm.exe
756	RegAsm.exe
756	RegAsm.exe
1520	Quotation.exe
1520	Quotation.exe
2012	RegAsm.exe
2012	RegAsm.exe
1564	RegAsm.exe
1556	RegAsm.exe
1556	RegAsm.exe
1644	RegAsm.exe
1644	RegAsm.exe
1412	Quotation.exe
1636	RegAsm.exe
1564	RegAsm.exe
1564	RegAsm.exe
1120	Quotation.exe
2040	RegAsm.exe
1752	Quotation.exe
1424	RegAsm.exe
2040	RegAsm.exe
2040	RegAsm.exe
1636	RegAsm.exe
1592	Quotation.exe
1932	RegAsm.exe
1424	RegAsm.exe
1424	RegAsm.exe
572	Quotation.exe
572	Quotation.exe
1036	RegAsm.exe
1932	RegAsm.exe
1932	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 190 IoCs

Processes:

Quotation.exeRegAsm.exeQuotation.exeRegAsm.execolorcpl.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exerundll32.exeQuotation.exeRegAsm.exerundll32.exeQuotation.exeRegAsm.exewlanext.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exemsdt.exeQuotation.exeRegAsm.exeNETSTAT.EXEQuotation.exeRegAsm.exewuapp.exeexplorer.exeipconfig.exeQuotation.exeRegAsm.execmstp.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exesvchost.exeQuotation.exeRegAsm.exewscript.exeQuotation.exeRegAsm.exechkdsk.exeQuotation.exeRegAsm.exewuapp.exemsiexec.exeQuotation.exeRegAsm.execmmon32.exeQuotation.exeRegAsm.execontrol.exeQuotation.exeRegAsm.exesvchost.exeQuotation.exeRegAsm.execmstp.exeQuotation.exeRegAsm.exehelp.exeQuotation.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1460	Quotation.exe
Token: SeDebugPrivilege	1608	RegAsm.exe
Token: SeDebugPrivilege	788	Quotation.exe
Token: SeDebugPrivilege	1040	RegAsm.exe
Token: SeDebugPrivilege	1056	colorcpl.exe
Token: SeDebugPrivilege	1684	Quotation.exe
Token: SeDebugPrivilege	1872	RegAsm.exe
Token: SeDebugPrivilege	1884	Quotation.exe
Token: SeDebugPrivilege	1824	RegAsm.exe
Token: SeDebugPrivilege	1868	rundll32.exe
Token: SeDebugPrivilege	1756	Quotation.exe
Token: SeDebugPrivilege	1556	RegAsm.exe
Token: SeDebugPrivilege	1588	rundll32.exe
Token: SeDebugPrivilege	1980	Quotation.exe
Token: SeDebugPrivilege	2012	RegAsm.exe
Token: SeDebugPrivilege	1740	wlanext.exe
Token: SeDebugPrivilege	1996	Quotation.exe
Token: SeDebugPrivilege	240	RegAsm.exe
Token: SeDebugPrivilege	1204	Quotation.exe
Token: SeDebugPrivilege	756	RegAsm.exe
Token: SeDebugPrivilege	1568	msdt.exe
Token: SeDebugPrivilege	880	Quotation.exe
Token: SeDebugPrivilege	1644	RegAsm.exe
Token: SeDebugPrivilege	544	NETSTAT.EXE
Token: SeDebugPrivilege	1520	Quotation.exe
Token: SeDebugPrivilege	1564	RegAsm.exe
Token: SeDebugPrivilege	1064	wuapp.exe
Token: SeDebugPrivilege	1820	explorer.exe
Token: SeDebugPrivilege	1404	ipconfig.exe
Token: SeDebugPrivilege	1412	Quotation.exe
Token: SeDebugPrivilege	1636	RegAsm.exe
Token: SeDebugPrivilege	788	cmstp.exe
Token: SeDebugPrivilege	1120	Quotation.exe
Token: SeDebugPrivilege	2040	RegAsm.exe
Token: SeDebugPrivilege	1752	Quotation.exe
Token: SeDebugPrivilege	1424	RegAsm.exe
Token: SeDebugPrivilege	1536	svchost.exe
Token: SeDebugPrivilege	1592	Quotation.exe
Token: SeDebugPrivilege	1932	RegAsm.exe
Token: SeDebugPrivilege	752	wscript.exe
Token: SeDebugPrivilege	572	Quotation.exe
Token: SeDebugPrivilege	1036	RegAsm.exe
Token: SeDebugPrivilege	612	chkdsk.exe
Token: SeDebugPrivilege	1440	Quotation.exe
Token: SeDebugPrivilege	1920	RegAsm.exe
Token: SeDebugPrivilege	1152	wuapp.exe
Token: SeDebugPrivilege	1516	msiexec.exe
Token: SeDebugPrivilege	1880	Quotation.exe
Token: SeDebugPrivilege	1408	RegAsm.exe
Token: SeDebugPrivilege	1708	cmmon32.exe
Token: SeDebugPrivilege	1828	Quotation.exe
Token: SeDebugPrivilege	1956	RegAsm.exe
Token: SeDebugPrivilege	1848	control.exe
Token: SeDebugPrivilege	800	Quotation.exe
Token: SeDebugPrivilege	1576	RegAsm.exe
Token: SeDebugPrivilege	1584	svchost.exe
Token: SeDebugPrivilege	1620	Quotation.exe
Token: SeDebugPrivilege	1160	RegAsm.exe
Token: SeDebugPrivilege	1976	cmstp.exe
Token: SeDebugPrivilege	1560	Quotation.exe
Token: SeDebugPrivilege	836	RegAsm.exe
Token: SeDebugPrivilege	1460	help.exe
Token: SeDebugPrivilege	1752	Quotation.exe
Token: SeDebugPrivilege	1260	RegAsm.exe

Suspicious use of SendNotifyMessage 4 IoCs

Processes:

Explorer.EXE

pid process

1244 Explorer.EXE
1244 Explorer.EXE
1244 Explorer.EXE
1244 Explorer.EXE
Drops file in Program Files directory 1 IoCs

Processes:

colorcpl.exe

description ioc process

File opened for modification C:\Program Files (x86)\Mvtg4dx\igfxwnuxv4rh.exe colorcpl.exe

pid	process
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE
1244	Explorer.EXE

description	ioc	process
File opened for modification	C:\Program Files (x86)\Mvtg4dx\igfxwnuxv4rh.exe	colorcpl.exe

Suspicious use of SetThreadContext 140 IoCs

Processes:

Quotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.execolorcpl.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exe

description	pid	process	target process
PID 1460 set thread context of 1608	1460	Quotation.exe	RegAsm.exe
PID 1608 set thread context of 1244	1608	RegAsm.exe	Explorer.EXE
PID 788 set thread context of 1040	788	Quotation.exe	RegAsm.exe
PID 1040 set thread context of 1244	1040	RegAsm.exe	Explorer.EXE
PID 1684 set thread context of 1872	1684	Quotation.exe	RegAsm.exe
PID 1872 set thread context of 1244	1872	RegAsm.exe	Explorer.EXE
PID 1884 set thread context of 1824	1884	Quotation.exe	RegAsm.exe
PID 1824 set thread context of 1244	1824	RegAsm.exe	Explorer.EXE
PID 1040 set thread context of 1244	1040	RegAsm.exe	Explorer.EXE
PID 1756 set thread context of 1556	1756	Quotation.exe	RegAsm.exe
PID 1556 set thread context of 1244	1556	RegAsm.exe	Explorer.EXE
PID 1056 set thread context of 1244	1056	colorcpl.exe	Explorer.EXE
PID 1980 set thread context of 2012	1980	Quotation.exe	RegAsm.exe
PID 2012 set thread context of 1244	2012	RegAsm.exe	Explorer.EXE
PID 1996 set thread context of 240	1996	Quotation.exe	RegAsm.exe
PID 240 set thread context of 1244	240	RegAsm.exe	Explorer.EXE
PID 1556 set thread context of 1244	1556	RegAsm.exe	Explorer.EXE
PID 1204 set thread context of 756	1204	Quotation.exe	RegAsm.exe
PID 756 set thread context of 1244	756	RegAsm.exe	Explorer.EXE
PID 2012 set thread context of 1244	2012	RegAsm.exe	Explorer.EXE
PID 880 set thread context of 1644	880	Quotation.exe	RegAsm.exe
PID 1644 set thread context of 1244	1644	RegAsm.exe	Explorer.EXE
PID 1520 set thread context of 1564	1520	Quotation.exe	RegAsm.exe
PID 1564 set thread context of 1244	1564	RegAsm.exe	Explorer.EXE
PID 1412 set thread context of 1636	1412	Quotation.exe	RegAsm.exe
PID 1636 set thread context of 1244	1636	RegAsm.exe	Explorer.EXE
PID 1120 set thread context of 2040	1120	Quotation.exe	RegAsm.exe
PID 2040 set thread context of 1244	2040	RegAsm.exe	Explorer.EXE
PID 1752 set thread context of 1424	1752	Quotation.exe	RegAsm.exe
PID 1424 set thread context of 1244	1424	RegAsm.exe	Explorer.EXE
PID 1636 set thread context of 1244	1636	RegAsm.exe	Explorer.EXE
PID 1592 set thread context of 1932	1592	Quotation.exe	RegAsm.exe
PID 1932 set thread context of 1244	1932	RegAsm.exe	Explorer.EXE
PID 572 set thread context of 1036	572	Quotation.exe	RegAsm.exe
PID 1036 set thread context of 1244	1036	RegAsm.exe	Explorer.EXE
PID 1440 set thread context of 1920	1440	Quotation.exe	RegAsm.exe
PID 1920 set thread context of 1244	1920	RegAsm.exe	Explorer.EXE
PID 1880 set thread context of 1408	1880	Quotation.exe	RegAsm.exe
PID 1408 set thread context of 1244	1408	RegAsm.exe	Explorer.EXE
PID 1828 set thread context of 1956	1828	Quotation.exe	RegAsm.exe
PID 1956 set thread context of 1244	1956	RegAsm.exe	Explorer.EXE
PID 800 set thread context of 1576	800	Quotation.exe	RegAsm.exe
PID 1576 set thread context of 1244	1576	RegAsm.exe	Explorer.EXE
PID 1620 set thread context of 1160	1620	Quotation.exe	RegAsm.exe
PID 1160 set thread context of 1244	1160	RegAsm.exe	Explorer.EXE
PID 1560 set thread context of 836	1560	Quotation.exe	RegAsm.exe
PID 836 set thread context of 1244	836	RegAsm.exe	Explorer.EXE
PID 1752 set thread context of 1260	1752	Quotation.exe	RegAsm.exe
PID 1260 set thread context of 1244	1260	RegAsm.exe	Explorer.EXE
PID 1792 set thread context of 1480	1792	Quotation.exe	RegAsm.exe
PID 1480 set thread context of 1244	1480	RegAsm.exe	Explorer.EXE
PID 880 set thread context of 1472	880	Quotation.exe	RegAsm.exe
PID 1472 set thread context of 1244	1472	RegAsm.exe	Explorer.EXE
PID 1800 set thread context of 832	1800	Quotation.exe	RegAsm.exe
PID 832 set thread context of 1244	832	RegAsm.exe	Explorer.EXE
PID 1480 set thread context of 1244	1480	RegAsm.exe	Explorer.EXE
PID 1692 set thread context of 1120	1692	Quotation.exe	RegAsm.exe
PID 1120 set thread context of 1244	1120	RegAsm.exe	Explorer.EXE
PID 1520 set thread context of 1164	1520	Quotation.exe	RegAsm.exe
PID 1164 set thread context of 1244	1164	RegAsm.exe	Explorer.EXE
PID 564 set thread context of 880	564	Quotation.exe	RegAsm.exe
PID 880 set thread context of 1244	880	RegAsm.exe	Explorer.EXE
PID 1120 set thread context of 1244	1120	RegAsm.exe	Explorer.EXE
PID 1084 set thread context of 1788	1084	Quotation.exe	RegAsm.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1244

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1460

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1608

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
3⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:788

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1040

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
4⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1872

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
5⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1884

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1824

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1556

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
8⤵
- Suspicious use of AdjustPrivilegeToken
PID:1820

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:2012

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1996

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:240

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1204

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:756

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1644

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
PID:1512

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1564

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1412

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1636

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
14⤵
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1120

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:2040

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1424

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1592

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1932

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:572

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
17⤵
PID:320

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1036

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
17⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1440

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1920

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
18⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1408

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
19⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1828

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1956

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
20⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1576

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
21⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1620

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1160

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
22⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:836

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
23⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
24⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetThreadContext
PID:1260

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
24⤵
- Suspicious use of SetThreadContext
PID:1792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
- Suspicious use of SetThreadContext
PID:1480

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
25⤵
- Suspicious use of SetThreadContext
PID:880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
26⤵
- Suspicious use of SetThreadContext
PID:1472

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
26⤵
- Suspicious use of SetThreadContext
PID:1800

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
27⤵
- Suspicious use of SetThreadContext
PID:832

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
27⤵
- Suspicious use of SetThreadContext
PID:1692

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
28⤵
- Suspicious use of SetThreadContext
PID:1120

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
28⤵
- Suspicious use of SetThreadContext
PID:1520

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
29⤵
- Suspicious use of SetThreadContext
PID:1164

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
29⤵
- Suspicious use of SetThreadContext
PID:564

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
30⤵
PID:2032

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
30⤵
- Suspicious use of SetThreadContext
PID:880

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
30⤵
- Suspicious use of SetThreadContext
PID:1084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
31⤵
PID:1788

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
31⤵
PID:1428

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
32⤵
PID:1416

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
32⤵
PID:1340

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
33⤵
PID:1444

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
33⤵
PID:1940

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
34⤵
PID:1804

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
34⤵
PID:1888

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
35⤵
PID:852

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
35⤵
PID:1496

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
36⤵
PID:1532

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
36⤵
PID:1864

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
37⤵
PID:1596

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
37⤵
PID:1880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
38⤵
PID:676

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
38⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
38⤵
PID:1792

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
39⤵
PID:340

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
39⤵
PID:1492

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
40⤵
PID:1940

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
40⤵
PID:1796

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:1980

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
41⤵
PID:524

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
42⤵
PID:816

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
42⤵
PID:1380

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
43⤵
PID:2044

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
43⤵
PID:1452

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
44⤵
PID:768

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
44⤵
PID:1880

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
45⤵
PID:1828

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
45⤵
PID:2068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
46⤵
PID:2124

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
46⤵
PID:2132

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
46⤵
PID:2160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
47⤵
PID:2216

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
48⤵
- Enumerates system info in registry
PID:2716

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
47⤵
PID:2244

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
48⤵
PID:2296

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
48⤵
PID:2324

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
49⤵
PID:2368

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
49⤵
PID:2396

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
50⤵
PID:2456

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
50⤵
PID:2484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
51⤵
PID:2540

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
51⤵
PID:2568

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:2620

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:2628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:2636

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
52⤵
PID:2664

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
53⤵
PID:2824

C:\Windows\SysWOW64\NETSTAT.EXE
"C:\Windows\SysWOW64\NETSTAT.EXE"
54⤵
PID:2172

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
53⤵
PID:2860

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
54⤵
PID:2912

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
54⤵
PID:2940

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
55⤵
PID:3020

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
55⤵
PID:3052

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
56⤵
PID:1004

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
56⤵
PID:1908

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
57⤵
PID:2208

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
57⤵
PID:1876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
58⤵
PID:2136

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
58⤵
PID:2096

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
59⤵
PID:2276

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
59⤵
PID:2300

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
60⤵
PID:2384

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
60⤵
PID:2528

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
61⤵
PID:2472

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
61⤵
PID:2400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
62⤵
PID:2708

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
62⤵
PID:2736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
63⤵
PID:2900

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
63⤵
PID:2584

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
64⤵
PID:3016

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
64⤵
PID:2668

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
65⤵
PID:1776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
65⤵
PID:2988

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
65⤵
PID:2876

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
66⤵
PID:1272

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
66⤵
PID:2212

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1148

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1060

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1044

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- System policy modification
- Adds Run entry to policy start application
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
- Suspicious use of SetThreadContext
PID:1056

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1772

C:\Program Files\Mozilla Firefox\Firefox.exe
"C:\Program Files\Mozilla Firefox\Firefox.exe"
3⤵
PID:1944

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1868

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1740

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1568

C:\Windows\SysWOW64\NETSTAT.EXE
"C:\Windows\SysWOW64\NETSTAT.EXE"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:544

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1404

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:788

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:752

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:612

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1152

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1708

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:1288

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:572

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
PID:1144

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
PID:1376

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
PID:1560

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
PID:1752

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1980

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1072

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1084

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1416

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:572

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1620

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:436

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:564

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1188

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1532

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1132

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1864

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:940

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
PID:748

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
PID:1916

C:\Windows\SysWOW64\wininit.exe
"C:\Windows\SysWOW64\wininit.exe"
2⤵
PID:1928

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
PID:436

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
PID:1060

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
PID:1132

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
PID:1620

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
PID:1656

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
PID:1692

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
2⤵
PID:1936

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
PID:1256

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
PID:1864

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Enumerates system info in registry
PID:2032

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
PID:1860

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
PID:1684

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
PID:1436

C:\Windows\SysWOW64\msdt.exe
"C:\Windows\SysWOW64\msdt.exe"
2⤵
PID:940

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
PID:1340

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
PID:2104

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
PID:2196

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
PID:2360

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
PID:2432

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
PID:2612

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\SysWOW64\ipconfig.exe"
2⤵
PID:2700

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2744

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2752

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2760

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2768

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2776

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2784

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2792

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2800

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2808

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2816

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
PID:2836

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
PID:2996

C:\Windows\SysWOW64\NAPSTAT.EXE
"C:\Windows\SysWOW64\NAPSTAT.EXE"
2⤵
PID:1188

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
PID:2056

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
PID:2252

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
PID:688

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
PID:2264

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Enumerates system info in registry
PID:2344

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
PID:2656

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2768

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2776

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2784

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2792

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2800

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2808

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2816

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2740

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2620

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2628

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2496

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2504

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2564

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2484

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
PID:2844

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
PID:2992

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
PID:2928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\972B4OAV\972logim.jpeg

Download Submit
C:\Users\Admin\AppData\Roaming\972B4OAV\972logrf.ini

Download Submit
C:\Users\Admin\AppData\Roaming\972B4OAV\972logri.ini

Download Submit
C:\Users\Admin\AppData\Roaming\972B4OAV\972logrv.ini

Download Submit
memory/240-30-0x000000000041E2C0-mapping.dmp

Download
memory/340-199-0x000000000041E2C0-mapping.dmp

Download
memory/436-165-0x0000000000000000-mapping.dmp

Download
memory/436-166-0x0000000000EA0000-0x0000000000EB6000-memory.dmp

Filesize
88KB

Download
memory/524-210-0x0000000000000000-mapping.dmp

Download
memory/544-41-0x0000000000000000-mapping.dmp

Download
memory/544-42-0x0000000000190000-0x0000000000199000-memory.dmp

Filesize
36KB

Download
memory/564-144-0x0000000000000000-mapping.dmp

Download
memory/572-67-0x0000000000000000-mapping.dmp

Download
memory/612-74-0x0000000000000000-mapping.dmp

Download
memory/612-75-0x0000000000590000-0x0000000000597000-memory.dmp

Filesize
28KB

Download
memory/688-314-0x0000000000000000-mapping.dmp

Download
memory/688-315-0x00000000000E0000-0x00000000000ED000-memory.dmp

Filesize
52KB

Download
memory/748-145-0x0000000000000000-mapping.dmp

Download
memory/748-146-0x00000000004D0000-0x00000000004E4000-memory.dmp

Filesize
80KB

Download
memory/752-70-0x0000000000570000-0x0000000000596000-memory.dmp

Filesize
152KB

Download
memory/752-69-0x0000000000000000-mapping.dmp

Download
memory/756-33-0x000000000041E2C0-mapping.dmp

Download
memory/768-229-0x000000000041E2C0-mapping.dmp

Download
memory/788-55-0x0000000000000000-mapping.dmp

Download
memory/788-56-0x0000000000FB0000-0x0000000000FC8000-memory.dmp

Filesize
96KB

Download
memory/788-2-0x0000000000000000-mapping.dmp

Download
memory/800-97-0x0000000000000000-mapping.dmp

Download
memory/816-217-0x000000000041E2C0-mapping.dmp

Download
memory/832-133-0x000000000041E2C0-mapping.dmp

Download
memory/836-115-0x000000000041E2C0-mapping.dmp

Download
memory/852-180-0x000000000041E2C0-mapping.dmp

Download
memory/880-152-0x000000000041E2C0-mapping.dmp

Download
memory/880-126-0x0000000000000000-mapping.dmp

Download
memory/880-34-0x0000000000000000-mapping.dmp

Download
memory/940-232-0x0000000000000000-mapping.dmp

Download
memory/940-233-0x00000000007C0000-0x00000000008B4000-memory.dmp

Filesize
976KB

Download
memory/1004-293-0x000000000041E2C0-mapping.dmp

Download
memory/1036-72-0x000000000041E2C0-mapping.dmp

Download
memory/1040-4-0x000000000041E2C0-mapping.dmp

Download
memory/1056-109-0x00000000032E0000-0x00000000033AF000-memory.dmp

Filesize
828KB

Download
memory/1056-6-0x0000000000000000-mapping.dmp

Download
memory/1056-7-0x0000000000C30000-0x0000000000C48000-memory.dmp

Filesize
96KB

Download
memory/1056-86-0x0000000076030000-0x000000007603C000-memory.dmp

Filesize
48KB

Download
memory/1056-87-0x0000000075220000-0x000000007533D000-memory.dmp

Filesize
1.1MB

Download
memory/1056-23-0x0000000002F30000-0x00000000030C2000-memory.dmp

Filesize
1.6MB

Download
memory/1060-167-0x0000000000000000-mapping.dmp

Download
memory/1060-168-0x0000000000940000-0x0000000000962000-memory.dmp

Filesize
136KB

Download
memory/1064-46-0x0000000000000000-mapping.dmp

Download
memory/1064-47-0x0000000000910000-0x000000000091B000-memory.dmp

Filesize
44KB

Download
memory/1084-153-0x0000000000000000-mapping.dmp

Download
memory/1120-138-0x000000000041E2C0-mapping.dmp

Download
memory/1120-54-0x0000000000000000-mapping.dmp

Download
memory/1132-172-0x0000000000000000-mapping.dmp

Download
memory/1132-173-0x00000000000C0000-0x00000000000D4000-memory.dmp

Filesize
80KB

Download
memory/1144-123-0x0000000000560000-0x0000000000565000-memory.dmp

Filesize
20KB

Download
memory/1144-122-0x0000000000000000-mapping.dmp

Download
memory/1152-82-0x0000000000330000-0x000000000033B000-memory.dmp

Filesize
44KB

Download
memory/1152-81-0x0000000000000000-mapping.dmp

Download
memory/1160-107-0x000000000041E2C0-mapping.dmp

Download
memory/1164-143-0x000000000041E2C0-mapping.dmp

Download
memory/1188-296-0x0000000000500000-0x0000000000546000-memory.dmp

Filesize
280KB

Download
memory/1188-295-0x0000000000000000-mapping.dmp

Download
memory/1204-31-0x0000000000000000-mapping.dmp

Download
memory/1244-300-0x000000000CE60000-0x000000000CFE1000-memory.dmp

Filesize
1.5MB

Download
memory/1244-203-0x000000000B1C0000-0x000000000B283000-memory.dmp

Filesize
780KB

Download
memory/1244-231-0x000000000BA00000-0x000000000BB95000-memory.dmp

Filesize
1.6MB

Download
memory/1244-12-0x00000000076C0000-0x00000000077E0000-memory.dmp

Filesize
1.1MB

Download
memory/1244-306-0x000000000CFF0000-0x000000000D19C000-memory.dmp

Filesize
1.7MB

Download
memory/1244-349-0x000000000D920000-0x000000000DA05000-memory.dmp

Filesize
916KB

Download
memory/1244-68-0x0000000007400000-0x00000000074D5000-memory.dmp

Filesize
852KB

Download
memory/1244-289-0x000000000C900000-0x000000000CA30000-memory.dmp

Filesize
1.2MB

Download
memory/1244-283-0x0000000006EC7000-0x0000000006ECB000-memory.dmp

Filesize
16KB

Download
memory/1244-274-0x000000000C510000-0x000000000C69A000-memory.dmp

Filesize
1.5MB

Download
memory/1244-207-0x000000000B290000-0x000000000B417000-memory.dmp

Filesize
1.5MB

Download
memory/1244-260-0x000000000C240000-0x000000000C305000-memory.dmp

Filesize
788KB

Download
memory/1244-266-0x000000000C310000-0x000000000C436000-memory.dmp

Filesize
1.1MB

Download
memory/1244-187-0x000000000ACA0000-0x000000000AD5F000-memory.dmp

Filesize
764KB

Download
memory/1244-215-0x000000000B5D0000-0x000000000B6FA000-memory.dmp

Filesize
1.2MB

Download
memory/1244-154-0x000000000A390000-0x000000000A446000-memory.dmp

Filesize
728KB

Download
memory/1244-103-0x0000000009750000-0x000000000987B000-memory.dmp

Filesize
1.2MB

Download
memory/1244-35-0x0000000006EC7000-0x0000000006ECB000-memory.dmp

Filesize
16KB

Download
memory/1256-202-0x0000000000240000-0x0000000000258000-memory.dmp

Filesize
96KB

Download
memory/1256-201-0x0000000000000000-mapping.dmp

Download
memory/1260-120-0x000000000041E2C0-mapping.dmp

Download
memory/1272-347-0x000000000041E2C0-mapping.dmp

Download
memory/1340-238-0x0000000000390000-0x00000000003B2000-memory.dmp

Filesize
136KB

Download
memory/1340-164-0x0000000000000000-mapping.dmp

Download
memory/1340-237-0x0000000000000000-mapping.dmp

Download
memory/1372-196-0x000000000041E2C0-mapping.dmp

Download
memory/1376-127-0x0000000000000000-mapping.dmp

Download
memory/1376-128-0x0000000000D90000-0x0000000000DAC000-memory.dmp

Filesize
112KB

Download
memory/1380-218-0x0000000000000000-mapping.dmp

Download
memory/1404-50-0x0000000000000000-mapping.dmp

Download
memory/1404-51-0x0000000000890000-0x000000000089A000-memory.dmp

Filesize
40KB

Download
memory/1408-84-0x000000000041E2C0-mapping.dmp

Download
memory/1412-45-0x0000000000000000-mapping.dmp

Download
memory/1416-163-0x000000000041E2C0-mapping.dmp

Download
memory/1424-61-0x000000000041E2C0-mapping.dmp

Download
memory/1428-159-0x0000000000000000-mapping.dmp

Download
memory/1436-227-0x0000000000DB0000-0x0000000000DBD000-memory.dmp

Filesize
52KB

Download
memory/1436-226-0x0000000000000000-mapping.dmp

Download
memory/1440-73-0x0000000000000000-mapping.dmp

Download
memory/1444-170-0x000000000041E2C0-mapping.dmp

Download
memory/1452-223-0x0000000000000000-mapping.dmp

Download
memory/1460-118-0x0000000000EF0000-0x0000000000EF6000-memory.dmp

Filesize
24KB

Download
memory/1460-117-0x0000000000000000-mapping.dmp

Download
memory/1472-130-0x000000000041E2C0-mapping.dmp

Download
memory/1480-125-0x000000000041E2C0-mapping.dmp

Download
memory/1492-200-0x0000000000000000-mapping.dmp

Download
memory/1496-181-0x0000000000000000-mapping.dmp

Download
memory/1516-79-0x0000000000000000-mapping.dmp

Download
memory/1516-80-0x00000000001B0000-0x00000000001C4000-memory.dmp

Filesize
80KB

Download
memory/1520-139-0x0000000000000000-mapping.dmp

Download
memory/1520-40-0x0000000000000000-mapping.dmp

Download
memory/1532-185-0x000000000041E2C0-mapping.dmp

Download
memory/1536-63-0x0000000000000000-mapping.dmp

Download
memory/1536-64-0x0000000000470000-0x0000000000478000-memory.dmp

Filesize
32KB

Download
memory/1556-19-0x000000000041E2C0-mapping.dmp

Download
memory/1560-108-0x0000000000000000-mapping.dmp

Download
memory/1560-136-0x0000000000BF0000-0x0000000000C12000-memory.dmp

Filesize
136KB

Download
memory/1560-135-0x0000000000000000-mapping.dmp

Download
memory/1564-44-0x000000000041E2C0-mapping.dmp

Download
memory/1568-37-0x00000000004A0000-0x0000000000594000-memory.dmp

Filesize
976KB

Download
memory/1568-36-0x0000000000000000-mapping.dmp

Download
memory/1576-101-0x000000000041E2C0-mapping.dmp

Download
memory/1584-104-0x0000000000000000-mapping.dmp

Download
memory/1584-105-0x0000000000280000-0x0000000000288000-memory.dmp

Filesize
32KB

Download
memory/1588-21-0x0000000000000000-mapping.dmp

Download
memory/1592-62-0x0000000000000000-mapping.dmp

Download
memory/1596-191-0x000000000041E2C0-mapping.dmp

Download
memory/1608-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/1608-1-0x000000000041E2C0-mapping.dmp

Download
memory/1620-102-0x0000000000000000-mapping.dmp

Download
memory/1620-177-0x0000000000000000-mapping.dmp

Download
memory/1620-178-0x0000000000900000-0x0000000000A04000-memory.dmp

Filesize
1.0MB

Download
memory/1636-53-0x000000000041E2C0-mapping.dmp

Download
memory/1644-39-0x000000000041E2C0-mapping.dmp

Download
memory/1656-183-0x0000000000170000-0x000000000017A000-memory.dmp

Filesize
40KB

Download
memory/1656-182-0x0000000000000000-mapping.dmp

Download
memory/1684-224-0x0000000000000000-mapping.dmp

Download
memory/1684-225-0x0000000000F20000-0x0000000000F46000-memory.dmp

Filesize
152KB

Download
memory/1684-5-0x0000000000000000-mapping.dmp

Download
memory/1692-188-0x0000000000000000-mapping.dmp

Download
memory/1692-189-0x00000000001E0000-0x00000000001ED000-memory.dmp

Filesize
52KB

Download
memory/1692-134-0x0000000000000000-mapping.dmp

Download
memory/1708-88-0x0000000000000000-mapping.dmp

Download
memory/1708-89-0x0000000000FE0000-0x0000000000FED000-memory.dmp

Filesize
52KB

Download
memory/1740-28-0x0000000000DF0000-0x0000000000E06000-memory.dmp

Filesize
88KB

Download
memory/1740-27-0x0000000000000000-mapping.dmp

Download
memory/1752-59-0x0000000000000000-mapping.dmp

Download
memory/1752-116-0x0000000000000000-mapping.dmp

Download
memory/1752-141-0x0000000000AA0000-0x0000000000AAE000-memory.dmp

Filesize
56KB

Download
memory/1752-140-0x0000000000000000-mapping.dmp

Download
memory/1756-15-0x0000000000000000-mapping.dmp

Download
memory/1772-8-0x0000000000000000-mapping.dmp

Download
memory/1788-158-0x000000000041E2C0-mapping.dmp

Download
memory/1792-121-0x0000000000000000-mapping.dmp

Download
memory/1792-197-0x0000000000000000-mapping.dmp

Download
memory/1796-206-0x0000000000000000-mapping.dmp

Download
memory/1800-131-0x0000000000000000-mapping.dmp

Download
memory/1804-175-0x000000000041E2C0-mapping.dmp

Download
memory/1820-48-0x0000000000000000-mapping.dmp

Download
memory/1820-49-0x0000000000D30000-0x0000000000FB1000-memory.dmp

Filesize
2.5MB

Download
memory/1824-14-0x000000000041E2C0-mapping.dmp

Download
memory/1828-85-0x0000000000000000-mapping.dmp

Download
memory/1828-235-0x000000000041E2C0-mapping.dmp

Download
memory/1848-98-0x0000000000000000-mapping.dmp

Download
memory/1848-99-0x0000000000640000-0x000000000065F000-memory.dmp

Filesize
124KB

Download
memory/1860-220-0x0000000000B30000-0x0000000000B36000-memory.dmp

Filesize
24KB

Download
memory/1860-219-0x0000000000000000-mapping.dmp

Download
memory/1864-211-0x0000000000000000-mapping.dmp

Download
memory/1864-212-0x0000000000980000-0x0000000000985000-memory.dmp

Filesize
20KB

Download
memory/1864-186-0x0000000000000000-mapping.dmp

Download
memory/1868-16-0x0000000000000000-mapping.dmp

Download
memory/1868-17-0x0000000000890000-0x000000000089E000-memory.dmp

Filesize
56KB

Download
memory/1872-10-0x000000000041E2C0-mapping.dmp

Download
memory/1876-299-0x0000000000000000-mapping.dmp

Download
memory/1880-78-0x0000000000000000-mapping.dmp

Download
memory/1880-230-0x0000000000000000-mapping.dmp

Download
memory/1880-192-0x0000000000000000-mapping.dmp

Download
memory/1884-11-0x0000000000000000-mapping.dmp

Download
memory/1888-176-0x0000000000000000-mapping.dmp

Download
memory/1908-294-0x0000000000000000-mapping.dmp

Download
memory/1916-155-0x0000000000000000-mapping.dmp

Download
memory/1916-156-0x0000000000710000-0x0000000000715000-memory.dmp

Filesize
20KB

Download
memory/1920-77-0x000000000041E2C0-mapping.dmp

Download
memory/1928-160-0x0000000000000000-mapping.dmp

Download
memory/1928-161-0x0000000000060000-0x000000000007A000-memory.dmp

Filesize
104KB

Download
memory/1932-66-0x000000000041E2C0-mapping.dmp

Download
memory/1936-193-0x0000000000000000-mapping.dmp

Download
memory/1936-194-0x0000000000380000-0x0000000000601000-memory.dmp

Filesize
2.5MB

Download
memory/1940-205-0x000000000041E2C0-mapping.dmp

Download
memory/1940-171-0x0000000000000000-mapping.dmp

Download
memory/1944-111-0x000000013FE90000-0x000000013FF23000-memory.dmp

Filesize
588KB

Download
memory/1944-110-0x0000000000000000-mapping.dmp

Download
memory/1956-96-0x000000000041E2C0-mapping.dmp

Download
memory/1976-112-0x0000000000000000-mapping.dmp

Download
memory/1976-113-0x0000000000A60000-0x0000000000A78000-memory.dmp

Filesize
96KB

Download
memory/1980-20-0x0000000000000000-mapping.dmp

Download
memory/1980-209-0x000000000041E2C0-mapping.dmp

Download
memory/1996-26-0x0000000000000000-mapping.dmp

Download
memory/2012-25-0x000000000041E2C0-mapping.dmp

Download
memory/2032-214-0x00000000000D0000-0x00000000000D7000-memory.dmp

Filesize
28KB

Download
memory/2032-213-0x0000000000000000-mapping.dmp

Download
memory/2040-58-0x000000000041E2C0-mapping.dmp

Download
memory/2044-222-0x000000000041E2C0-mapping.dmp

Download
memory/2056-301-0x0000000000000000-mapping.dmp

Download
memory/2056-302-0x0000000000E20000-0x0000000000E26000-memory.dmp

Filesize
24KB

Download
memory/2068-236-0x0000000000000000-mapping.dmp

Download
memory/2096-305-0x0000000000000000-mapping.dmp

Download
memory/2104-242-0x0000000000000000-mapping.dmp

Download
memory/2104-243-0x0000000000900000-0x0000000000926000-memory.dmp

Filesize
152KB

Download
memory/2132-240-0x000000000041E2C0-mapping.dmp

Download
memory/2136-304-0x000000000041E2C0-mapping.dmp

Download
memory/2160-241-0x0000000000000000-mapping.dmp

Download
memory/2172-310-0x00000000009C0000-0x00000000009C9000-memory.dmp

Filesize
36KB

Download
memory/2172-309-0x0000000000000000-mapping.dmp

Download
memory/2196-248-0x0000000000430000-0x0000000000438000-memory.dmp

Filesize
32KB

Download
memory/2196-247-0x0000000000000000-mapping.dmp

Download
memory/2208-298-0x000000000041E2C0-mapping.dmp

Download
memory/2212-348-0x0000000000000000-mapping.dmp

Download
memory/2216-245-0x000000000041E2C0-mapping.dmp

Download
memory/2244-246-0x0000000000000000-mapping.dmp

Download
memory/2252-307-0x0000000000000000-mapping.dmp

Download
memory/2252-308-0x00000000009B0000-0x00000000009C6000-memory.dmp

Filesize
88KB

Download
memory/2264-319-0x0000000000000000-mapping.dmp

Download
memory/2264-320-0x0000000049D70000-0x0000000049DBC000-memory.dmp

Filesize
304KB

Download
memory/2276-312-0x000000000041E2C0-mapping.dmp

Download
memory/2296-250-0x000000000041E2C0-mapping.dmp

Download
memory/2300-313-0x0000000000000000-mapping.dmp

Download
memory/2324-251-0x0000000000000000-mapping.dmp

Download
memory/2344-325-0x0000000000780000-0x0000000000787000-memory.dmp

Filesize
28KB

Download
memory/2344-324-0x0000000000000000-mapping.dmp

Download
memory/2360-256-0x00000000005A0000-0x00000000005A5000-memory.dmp

Filesize
20KB

Download
memory/2360-255-0x0000000000000000-mapping.dmp

Download
memory/2368-253-0x000000000041E2C0-mapping.dmp

Download
memory/2384-317-0x000000000041E2C0-mapping.dmp

Download
memory/2396-254-0x0000000000000000-mapping.dmp

Download
memory/2400-323-0x0000000000000000-mapping.dmp

Download
memory/2432-262-0x0000000000370000-0x000000000037E000-memory.dmp

Filesize
56KB

Download
memory/2432-261-0x0000000000000000-mapping.dmp

Download
memory/2456-258-0x000000000041E2C0-mapping.dmp

Download
memory/2472-322-0x000000000041E2C0-mapping.dmp

Download
memory/2484-259-0x0000000000000000-mapping.dmp

Download
memory/2528-318-0x0000000000000000-mapping.dmp

Download
memory/2540-264-0x000000000041E2C0-mapping.dmp

Download
memory/2568-265-0x0000000000000000-mapping.dmp

Download
memory/2584-333-0x0000000000000000-mapping.dmp

Download
memory/2612-270-0x0000000000000000-mapping.dmp

Download
memory/2612-271-0x0000000000D20000-0x0000000000D42000-memory.dmp

Filesize
136KB

Download
memory/2636-268-0x000000000041E2C0-mapping.dmp

Download
memory/2656-330-0x0000000000710000-0x0000000000724000-memory.dmp

Filesize
80KB

Download
memory/2656-329-0x0000000000000000-mapping.dmp

Download
memory/2664-269-0x0000000000000000-mapping.dmp

Download
memory/2668-338-0x0000000000000000-mapping.dmp

Download
memory/2700-278-0x0000000000000000-mapping.dmp

Download
memory/2700-279-0x0000000000560000-0x000000000056A000-memory.dmp

Filesize
40KB

Download
memory/2708-327-0x000000000041E2C0-mapping.dmp

Download
memory/2716-273-0x0000000000B80000-0x0000000000B87000-memory.dmp

Filesize
28KB

Download
memory/2716-272-0x0000000000000000-mapping.dmp

Download
memory/2736-328-0x0000000000000000-mapping.dmp

Download
memory/2824-276-0x000000000041E2C0-mapping.dmp

Download
memory/2836-284-0x0000000000000000-mapping.dmp

Download
memory/2836-285-0x0000000000900000-0x0000000000914000-memory.dmp

Filesize
80KB

Download
memory/2844-334-0x0000000000000000-mapping.dmp

Download
memory/2844-335-0x0000000000B20000-0x0000000000B3B000-memory.dmp

Filesize
108KB

Download
memory/2860-277-0x0000000000000000-mapping.dmp

Download
memory/2876-343-0x0000000000000000-mapping.dmp

Download
memory/2900-332-0x000000000041E2C0-mapping.dmp

Download
memory/2912-281-0x000000000041E2C0-mapping.dmp

Download
memory/2928-345-0x00000000003B0000-0x00000000003B8000-memory.dmp

Filesize
32KB

Download
memory/2928-344-0x0000000000000000-mapping.dmp

Download
memory/2940-282-0x0000000000000000-mapping.dmp

Download
memory/2988-342-0x000000000041E2C0-mapping.dmp

Download
memory/2992-339-0x0000000000000000-mapping.dmp

Download
memory/2992-340-0x0000000000940000-0x0000000000956000-memory.dmp

Filesize
88KB

Download
memory/2996-290-0x0000000000000000-mapping.dmp

Download
memory/2996-291-0x0000000000430000-0x000000000044F000-memory.dmp

Filesize
124KB

Download
memory/3016-337-0x000000000041E2C0-mapping.dmp

Download
memory/3020-287-0x000000000041E2C0-mapping.dmp

Download
memory/3052-288-0x0000000000000000-mapping.dmp

Download