Analysis

  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    10/07/2020, 07:04

General

  • Target
    Quotation.exe
  • Size 267KB
  • Sample200710-4vbab642da
  • SHA256 e8edf009c1c82f348ad925f7f9a34b4f241d52240c6cb43ab4536c4b363d5322
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • Drops file in Program Files directory 1 IoCs
  • Adds Run entry to start application 2 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: MapViewOfSection 280 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of WriteProcessMemory 682 IoCs
  • Suspicious use of SetThreadContext 137 IoCs
  • Suspicious use of AdjustPrivilegeToken 190 IoCs
  • Suspicious behavior: EnumeratesProcesses 22820 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • js 6 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2956
    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
      2⤵
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:3928
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:3892
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          3⤵
            PID:3876
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            3⤵
              PID:3872
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              3⤵
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:3880
            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
              3⤵
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of WriteProcessMemory
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:3912
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                4⤵
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:3596
              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                4⤵
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of WriteProcessMemory
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:3484
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  5⤵
                    PID:2972
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    5⤵
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3668
                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                    5⤵
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of WriteProcessMemory
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2568
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      6⤵
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3792
                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                      6⤵
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of WriteProcessMemory
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1000
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        7⤵
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        PID:640
                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                        7⤵
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        PID:360
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          8⤵
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1292
                          • C:\Windows\SysWOW64\rundll32.exe
                            "C:\Windows\SysWOW64\rundll32.exe"
                            9⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2544
                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                          8⤵
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3936
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            9⤵
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1556
                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                            9⤵
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1724
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              10⤵
                                PID:1500
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                10⤵
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2068
                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                10⤵
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                PID:2440
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  11⤵
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2944
                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                  11⤵
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2388
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    12⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3304
                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                    12⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2948
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      13⤵
                                      • Suspicious behavior: MapViewOfSection
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1148
                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                      13⤵
                                      • Suspicious behavior: MapViewOfSection
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3100
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        14⤵
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:908
                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                        14⤵
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        PID:3632
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          15⤵
                                          • Suspicious behavior: MapViewOfSection
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3916
                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                          15⤵
                                          • Suspicious behavior: MapViewOfSection
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:2780
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            16⤵
                                            • Suspicious behavior: MapViewOfSection
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1732
                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                            16⤵
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2964
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              17⤵
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3732
                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                              17⤵
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3204
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                18⤵
                                                • Suspicious use of SetThreadContext
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2692
                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                18⤵
                                                • Suspicious use of SetThreadContext
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:3960
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  19⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:3288
                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                  19⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1012
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    20⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1496
                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                    20⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:496
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                      21⤵
                                                        PID:1652
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                        21⤵
                                                          PID:4064
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                          21⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3100
                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                          21⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1096
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            22⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:564
                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                            22⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3856
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                              23⤵
                                                              • Suspicious use of SetThreadContext
                                                              PID:3764
                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                              23⤵
                                                              • Suspicious use of SetThreadContext
                                                              PID:3800
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                24⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:720
                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                24⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:3428
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                  25⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:1008
                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                  25⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:3300
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    26⤵
                                                                      PID:2108
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      26⤵
                                                                        PID:1644
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                        26⤵
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:688
                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                        26⤵
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:2972
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                          27⤵
                                                                            PID:2116
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                            27⤵
                                                                              PID:1240
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                              27⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:2780
                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                              27⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:1252
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                28⤵
                                                                                  PID:1500
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                  28⤵
                                                                                  • Suspicious use of SetThreadContext
                                                                                  PID:3532
                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                  28⤵
                                                                                  • Suspicious use of SetThreadContext
                                                                                  PID:856
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                    29⤵
                                                                                    • Suspicious use of SetThreadContext
                                                                                    PID:2532
                                                                                    • C:\Windows\SysWOW64\systray.exe
                                                                                      "C:\Windows\SysWOW64\systray.exe"
                                                                                      30⤵
                                                                                        PID:1860
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                      29⤵
                                                                                      • Suspicious use of SetThreadContext
                                                                                      PID:2764
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                        30⤵
                                                                                        • Suspicious use of SetThreadContext
                                                                                        PID:3260
                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                        30⤵
                                                                                        • Suspicious use of SetThreadContext
                                                                                        PID:360
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                          31⤵
                                                                                            PID:3964
                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                            31⤵
                                                                                              PID:936
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                32⤵
                                                                                                  PID:2972
                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                  32⤵
                                                                                                    PID:2540
                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                      33⤵
                                                                                                        PID:3420
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                        33⤵
                                                                                                          PID:1644
                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                            34⤵
                                                                                                              PID:500
                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                              34⤵
                                                                                                                PID:644
                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                  35⤵
                                                                                                                    PID:1564
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                    35⤵
                                                                                                                      PID:1360
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                      35⤵
                                                                                                                        PID:1252
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                          36⤵
                                                                                                                            PID:1000
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                            36⤵
                                                                                                                              PID:1640
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                              36⤵
                                                                                                                                PID:804
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                  37⤵
                                                                                                                                    PID:3956
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                    37⤵
                                                                                                                                      PID:4080
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                        38⤵
                                                                                                                                          PID:2012
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                          38⤵
                                                                                                                                            PID:3120
                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                              39⤵
                                                                                                                                                PID:3896
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                39⤵
                                                                                                                                                  PID:852
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                  39⤵
                                                                                                                                                    PID:1500
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                      40⤵
                                                                                                                                                        PID:3908
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                        40⤵
                                                                                                                                                          PID:3784
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                            41⤵
                                                                                                                                                              PID:1212
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                              41⤵
                                                                                                                                                                PID:2296
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                  42⤵
                                                                                                                                                                    PID:1208
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                    42⤵
                                                                                                                                                                      PID:3832
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                      42⤵
                                                                                                                                                                        PID:3852
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                        42⤵
                                                                                                                                                                          PID:1788
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                            43⤵
                                                                                                                                                                              PID:3120
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                              43⤵
                                                                                                                                                                                PID:3896
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                  44⤵
                                                                                                                                                                                    PID:1168
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                    44⤵
                                                                                                                                                                                      PID:636
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                        45⤵
                                                                                                                                                                                          PID:2708
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                          45⤵
                                                                                                                                                                                            PID:3656
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                              46⤵
                                                                                                                                                                                                PID:1564
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                46⤵
                                                                                                                                                                                                  PID:2544
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                      PID:3892
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                        PID:1540
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                        47⤵
                                                                                                                                                                                                          PID:1500
                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                              PID:1288
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                              48⤵
                                                                                                                                                                                                                PID:1428
                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                                    PID:4064
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                    49⤵
                                                                                                                                                                                                                      PID:1696
                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                          PID:804
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                          50⤵
                                                                                                                                                                                                                            PID:2784
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                              51⤵
                                                                                                                                                                                                                                PID:2056
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                51⤵
                                                                                                                                                                                                                                  PID:1960
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                      PID:3524
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                      52⤵
                                                                                                                                                                                                                                        PID:1820
                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                                                            PID:2648
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                            53⤵
                                                                                                                                                                                                                                              PID:2544
                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                  PID:1696
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                  54⤵
                                                                                                                                                                                                                                                    PID:936
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                                        PID:812
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\cmd.exe"
                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                            PID:2996
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                                            PID:2032
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                                PID:4012
                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                                  PID:1940
                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                  56⤵
                                                                                                                                                                                                                                                                    PID:2136
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                    56⤵
                                                                                                                                                                                                                                                                      PID:2484
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                      56⤵
                                                                                                                                                                                                                                                                        PID:560
                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                                            PID:644
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                            57⤵
                                                                                                                                                                                                                                                                              PID:768
                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                                  PID:2932
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                  58⤵
                                                                                                                                                                                                                                                                                    PID:1740
                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                                        PID:1860
                                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                        59⤵
                                                                                                                                                                                                                                                                                          PID:2032
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                          59⤵
                                                                                                                                                                                                                                                                                            PID:2272
                                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                              60⤵
                                                                                                                                                                                                                                                                                                PID:2296
                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                60⤵
                                                                                                                                                                                                                                                                                                  PID:1772
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                                  60⤵
                                                                                                                                                                                                                                                                                                    PID:2764
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                      61⤵
                                                                                                                                                                                                                                                                                                        PID:4104
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                                        61⤵
                                                                                                                                                                                                                                                                                                          PID:4152
                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                            62⤵
                                                                                                                                                                                                                                                                                                              PID:4196
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                                              62⤵
                                                                                                                                                                                                                                                                                                                PID:4244
                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                  63⤵
                                                                                                                                                                                                                                                                                                                    PID:4296
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                                                    63⤵
                                                                                                                                                                                                                                                                                                                      PID:4344
                                                                                                                                                                                          • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                            "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Drops file in Program Files directory
                                                                                                                                                                                            • Adds Run entry to start application
                                                                                                                                                                                            • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                                            • Suspicious use of SetThreadContext
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:740
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:2516
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2480
                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\Firefox.exe
                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:1512
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:3796
                                                                                                                                                                                                • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:956
                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:3312
                                                                                                                                                                                                • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:1144
                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:1536
                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:2696
                                                                                                                                                                                                • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Enumerates system info in registry
                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                  PID:4068
                                                                                                                                                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:564
                                                                                                                                                                                                  • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                    "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:652
                                                                                                                                                                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1788
                                                                                                                                                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:4036
                                                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:720
                                                                                                                                                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3120
                                                                                                                                                                                                            • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:768
                                                                                                                                                                                                              • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                PID:788
                                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3608
                                                                                                                                                                                                                • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1508
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1352
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1648
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:3260
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:3228
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:1036
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:3952
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:2036
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mstsc.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\mstsc.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:3488
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:3948
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:3500
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                            "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:476
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1840
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:4036
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:808
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:3912
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:2260
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:3676
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1736
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:3852
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2568
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                PID:3888
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:3856
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1012
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:2600
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:2840
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:2288
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:3900
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1368
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:3704
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:2796
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\mstsc.exe
                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\mstsc.exe"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:3848
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:3496
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:2108
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1240
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:3832
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:2524
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:744
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1376
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:2608
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:4048
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:1500
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:1352
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:2988
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3672
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:1712
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1644
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:2436
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1960
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:3132
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:1116
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:560
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1796
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:3860
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:416
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:1116
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:560
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:1796
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:3860
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:416
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\mstsc.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\mstsc.exe"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:1116
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:4188
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:4376

                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                    memory/476-137-0x0000000001640000-0x000000000165E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/476-136-0x0000000001640000-0x000000000165E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/740-11-0x00000000013A0000-0x00000000013AB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/740-36-0x00000000042A0000-0x000000000439D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/740-12-0x00000000013A0000-0x00000000013AB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/744-302-0x0000000000150000-0x0000000000169000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/744-301-0x0000000000150000-0x0000000000169000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/788-70-0x00000000010A0000-0x00000000010B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/788-69-0x00000000010A0000-0x00000000010B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/808-151-0x00000000002C0000-0x00000000002E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/808-152-0x00000000002C0000-0x00000000002E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/956-23-0x00000000002C0000-0x00000000002C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/956-24-0x00000000002C0000-0x00000000002C7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1012-206-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1012-207-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1036-81-0x0000000000120000-0x0000000000126000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1036-82-0x0000000000120000-0x0000000000126000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1116-388-0x0000000000F10000-0x000000000120C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1116-387-0x0000000000F10000-0x000000000120C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1144-39-0x0000000000D30000-0x000000000116F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1144-38-0x0000000000D30000-0x000000000116F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1240-285-0x0000000000120000-0x0000000000126000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1240-286-0x0000000000120000-0x0000000000126000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1352-339-0x0000000000FE0000-0x0000000001000000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1352-340-0x0000000000FE0000-0x0000000001000000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1368-243-0x0000000000F60000-0x0000000000F6C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1368-242-0x0000000000F60000-0x0000000000F6C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1376-307-0x0000000000F60000-0x0000000000F6C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1376-308-0x0000000000F60000-0x0000000000F6C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1500-336-0x0000000000D30000-0x000000000116F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1500-335-0x0000000000D30000-0x000000000116F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1512-128-0x00007FF610330000-0x00007FF6103C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1512-127-0x00007FF610330000-0x00007FF6103C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1512-126-0x00007FF610330000-0x00007FF6103C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1536-48-0x00000000002C0000-0x00000000002E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1536-47-0x00000000002C0000-0x00000000002E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1644-365-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1644-366-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1712-356-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1712-355-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1840-142-0x0000000000F60000-0x0000000000F6C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1840-143-0x0000000000F60000-0x0000000000F6C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1860-213-0x0000000000120000-0x0000000000126000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1860-214-0x0000000000120000-0x0000000000126000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1960-379-0x0000000000D90000-0x0000000000DAF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/1960-378-0x0000000000D90000-0x0000000000DAF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2036-95-0x0000000000FE0000-0x0000000001000000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2036-94-0x0000000000FE0000-0x0000000001000000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2108-278-0x0000000000EA0000-0x0000000000EB3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2108-279-0x0000000000EA0000-0x0000000000EB3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2260-168-0x0000000000F50000-0x00000000010C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2260-167-0x0000000000F50000-0x00000000010C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2288-233-0x00000000010A0000-0x00000000010B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2288-232-0x00000000010A0000-0x00000000010B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2436-372-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2436-371-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2524-296-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2524-295-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2544-66-0x0000000000EA0000-0x0000000000EB3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2544-67-0x0000000000EA0000-0x0000000000EB3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2568-190-0x0000000000FF0000-0x0000000000FFC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2568-189-0x0000000000FF0000-0x0000000000FFC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2600-216-0x00000000002C0000-0x00000000002E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2600-217-0x00000000002C0000-0x00000000002E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2608-313-0x0000000000F60000-0x0000000000F6C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2608-314-0x0000000000F60000-0x0000000000F6C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2696-55-0x00000000002C0000-0x00000000002E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2696-54-0x00000000002C0000-0x00000000002E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2796-260-0x0000000000CE0000-0x0000000000CEB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2796-259-0x0000000000CE0000-0x0000000000CEB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2840-226-0x00000000013A0000-0x00000000013AB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2840-227-0x00000000013A0000-0x00000000013AB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-86-0x000000000AF10000-0x000000000B077000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-28-0x0000000001070000-0x000000000114A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-392-0x000000000EA70000-0x000000000EB80000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-280-0x000000000D170000-0x000000000D310000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-221-0x000000000C240000-0x000000000C3E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-376-0x000000000E740000-0x000000000E8D0000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-267-0x000000000CC90000-0x000000000CE3C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-105-0x0000000006DF0000-0x0000000006F69000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-318-0x000000000D990000-0x000000000DA60000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-363-0x000000000D600000-0x000000000D751000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-240-0x000000000C720000-0x000000000C8AD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-114-0x0000000007240000-0x000000000734F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-191-0x000000000BC70000-0x000000000BDFA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-211-0x000000000C0A0000-0x000000000C23C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-162-0x0000000006590000-0x0000000006646000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-35-0x00000000099E0000-0x0000000009B6D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-247-0x000000000C8B0000-0x000000000CA34000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-322-0x000000000DB80000-0x000000000DC89000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-172-0x0000000009220000-0x00000000092DC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-353-0x000000000E1A0000-0x000000000E2E5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-204-0x000000000BF30000-0x000000000C09B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-337-0x000000000DEE0000-0x000000000DFE1000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-18-0x0000000007490000-0x00000000075B5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-292-0x000000000D4B0000-0x000000000D5FC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-257-0x000000000CB70000-0x000000000CC8B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-187-0x0000000009750000-0x000000000980D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-326-0x000000000DC90000-0x000000000DDD4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-330-0x000000000DDE0000-0x000000000DED5000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-13-0x0000000009840000-0x00000000099D7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2956-9-0x00000000055B0000-0x00000000056CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2988-345-0x0000000000E50000-0x0000000000E77000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2988-346-0x0000000000E50000-0x0000000000E77000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2996-385-0x0000000000D90000-0x0000000000DE9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/2996-384-0x0000000000D90000-0x0000000000DE9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3040-120-0x00000000010C0000-0x00000000010CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3040-119-0x00000000010C0000-0x00000000010CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3228-76-0x0000000000EA0000-0x0000000000EB3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3228-75-0x0000000000EA0000-0x0000000000EB3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3312-31-0x00000000002C0000-0x00000000002E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3312-30-0x00000000002C0000-0x00000000002E7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3488-101-0x0000000000F10000-0x000000000120C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3488-100-0x0000000000F10000-0x000000000120C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3496-270-0x0000000000FE0000-0x0000000001000000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3496-269-0x0000000000FE0000-0x0000000001000000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3500-130-0x00000000010A0000-0x00000000010B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3500-131-0x00000000010A0000-0x00000000010B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3672-349-0x00000000010A0000-0x00000000010B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3672-348-0x00000000010A0000-0x00000000010B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3676-182-0x0000000000FE0000-0x0000000001000000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3676-177-0x0000000000FE0000-0x0000000001000000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3704-253-0x00000000010A0000-0x00000000010B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3704-252-0x00000000010A0000-0x00000000010B2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3796-21-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3796-20-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3832-291-0x0000000000EA0000-0x0000000000EB3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3832-293-0x0000000000EA0000-0x0000000000EB3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3848-266-0x0000000000F10000-0x000000000120C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3848-265-0x0000000000F10000-0x000000000120C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3856-200-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3856-199-0x00000000001D0000-0x00000000001E6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3880-0-0x0000000000400000-0x000000000042D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3888-197-0x00000000010C0000-0x00000000010CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3888-196-0x00000000010C0000-0x00000000010CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3900-238-0x0000000001640000-0x000000000165E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3900-239-0x0000000001640000-0x000000000165E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3912-157-0x0000000000F50000-0x00000000010C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3912-158-0x0000000000F50000-0x00000000010C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3948-107-0x0000000000F50000-0x00000000010C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3948-108-0x0000000000F50000-0x00000000010C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3952-89-0x0000000000D90000-0x0000000000DAF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/3952-88-0x0000000000D90000-0x0000000000DAF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/4036-145-0x0000000001640000-0x000000000165E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/4036-146-0x0000000001640000-0x000000000165E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/4048-329-0x00000000013A0000-0x00000000013AB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/4048-328-0x00000000013A0000-0x00000000013AB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/4068-60-0x00000000010C0000-0x00000000010CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/4068-61-0x00000000010C0000-0x00000000010CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/4188-397-0x0000000000F50000-0x00000000010C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                    memory/4188-398-0x0000000000F50000-0x00000000010C3000-memory.dmp