9c1501fbd2eb669ccbe4a41e37770191e954e6f0dd3e0a954a0670a91df3917c

Analysis

max time kernel
151s
max time network
155s
platform
windows7_x64
resource
win7
submitted
10-07-2020 05:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Quotation.exe
Size

233KB
MD5

560be75b2b6cfdace7266e5e345f242a
SHA1

0217bcea49f188b04f5d4b2d35c9c2e10be55189
SHA256

9c1501fbd2eb669ccbe4a41e37770191e954e6f0dd3e0a954a0670a91df3917c
SHA512

577e82392b55506580cff192eee0e389f5bc6a3c53939da1aa7fb73985425a2a3d98f6acf2fb6606be1278d6e3a62863a575ea910f27810eb4c7e5d6027b7ed1

Score

6^/10

evasion trojan

Malware Config

Signatures

Suspicious use of FindShellTrayWindow 8 IoCs

Processes:

Explorer.EXE

pid process

1228 Explorer.EXE
1228 Explorer.EXE
1228 Explorer.EXE
1228 Explorer.EXE
1228 Explorer.EXE
1228 Explorer.EXE
1228 Explorer.EXE
1228 Explorer.EXE
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

Explorer.EXE

pid process

1228 Explorer.EXE
1228 Explorer.EXE
1228 Explorer.EXE
1228 Explorer.EXE
1228 Explorer.EXE
1228 Explorer.EXE
1228 Explorer.EXE

pid	process
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE

pid	process
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE
1228	Explorer.EXE

Suspicious behavior: MapViewOfSection 283 IoCs

Processes:

Quotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exehelp.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exe

pid	process
1464	Quotation.exe
1464	Quotation.exe
904	RegAsm.exe
532	Quotation.exe
732	RegAsm.exe
904	RegAsm.exe
904	RegAsm.exe
1676	Quotation.exe
1884	RegAsm.exe
732	RegAsm.exe
732	RegAsm.exe
1032	help.exe
1892	Quotation.exe
1824	RegAsm.exe
1884	RegAsm.exe
1884	RegAsm.exe
1732	Quotation.exe
1652	RegAsm.exe
1032	help.exe
1992	Quotation.exe
1032	help.exe
1056	RegAsm.exe
1652	RegAsm.exe
1652	RegAsm.exe
1824	RegAsm.exe
2008	Quotation.exe
1332	RegAsm.exe
1472	Quotation.exe
576	RegAsm.exe
1332	RegAsm.exe
1332	RegAsm.exe
1056	RegAsm.exe
1028	Quotation.exe
1824	RegAsm.exe
1824	RegAsm.exe
1692	RegAsm.exe
576	RegAsm.exe
576	RegAsm.exe
1056	RegAsm.exe
1056	RegAsm.exe
1816	Quotation.exe
620	RegAsm.exe
1692	RegAsm.exe
1692	RegAsm.exe
1632	Quotation.exe
1112	RegAsm.exe
620	RegAsm.exe
620	RegAsm.exe
1016	Quotation.exe
884	RegAsm.exe
1112	RegAsm.exe
1112	RegAsm.exe
740	Quotation.exe
1036	RegAsm.exe
884	RegAsm.exe
884	RegAsm.exe
1896	Quotation.exe
784	RegAsm.exe
1036	RegAsm.exe
1036	RegAsm.exe
1828	Quotation.exe
1388	RegAsm.exe
784	RegAsm.exe
784	RegAsm.exe

Suspicious use of SetThreadContext 151 IoCs

Processes:

Quotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exehelp.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exe

description	pid	process	target process
PID 1464 set thread context of 904	1464	Quotation.exe	RegAsm.exe
PID 904 set thread context of 1228	904	RegAsm.exe	Explorer.EXE
PID 532 set thread context of 732	532	Quotation.exe	RegAsm.exe
PID 732 set thread context of 1228	732	RegAsm.exe	Explorer.EXE
PID 1676 set thread context of 1884	1676	Quotation.exe	RegAsm.exe
PID 1884 set thread context of 1228	1884	RegAsm.exe	Explorer.EXE
PID 1892 set thread context of 1824	1892	Quotation.exe	RegAsm.exe
PID 1824 set thread context of 1228	1824	RegAsm.exe	Explorer.EXE
PID 1732 set thread context of 1652	1732	Quotation.exe	RegAsm.exe
PID 1652 set thread context of 1228	1652	RegAsm.exe	Explorer.EXE
PID 1032 set thread context of 1228	1032	help.exe	Explorer.EXE
PID 1992 set thread context of 1056	1992	Quotation.exe	RegAsm.exe
PID 1056 set thread context of 1228	1056	RegAsm.exe	Explorer.EXE
PID 1824 set thread context of 1228	1824	RegAsm.exe	Explorer.EXE
PID 2008 set thread context of 1332	2008	Quotation.exe	RegAsm.exe
PID 1332 set thread context of 1228	1332	RegAsm.exe	Explorer.EXE
PID 1472 set thread context of 576	1472	Quotation.exe	RegAsm.exe
PID 576 set thread context of 1228	576	RegAsm.exe	Explorer.EXE
PID 1056 set thread context of 1228	1056	RegAsm.exe	Explorer.EXE
PID 1028 set thread context of 1692	1028	Quotation.exe	RegAsm.exe
PID 1692 set thread context of 1228	1692	RegAsm.exe	Explorer.EXE
PID 1816 set thread context of 620	1816	Quotation.exe	RegAsm.exe
PID 620 set thread context of 1228	620	RegAsm.exe	Explorer.EXE
PID 1632 set thread context of 1112	1632	Quotation.exe	RegAsm.exe
PID 1112 set thread context of 1228	1112	RegAsm.exe	Explorer.EXE
PID 1016 set thread context of 884	1016	Quotation.exe	RegAsm.exe
PID 884 set thread context of 1228	884	RegAsm.exe	Explorer.EXE
PID 740 set thread context of 1036	740	Quotation.exe	RegAsm.exe
PID 1036 set thread context of 1228	1036	RegAsm.exe	Explorer.EXE
PID 1896 set thread context of 784	1896	Quotation.exe	RegAsm.exe
PID 784 set thread context of 1228	784	RegAsm.exe	Explorer.EXE
PID 1828 set thread context of 1388	1828	Quotation.exe	RegAsm.exe
PID 1388 set thread context of 1228	1388	RegAsm.exe	Explorer.EXE
PID 1764 set thread context of 320	1764	Quotation.exe	RegAsm.exe
PID 320 set thread context of 1228	320	RegAsm.exe	Explorer.EXE
PID 548 set thread context of 908	548	Quotation.exe	RegAsm.exe
PID 908 set thread context of 1228	908	RegAsm.exe	Explorer.EXE
PID 1952 set thread context of 1904	1952	Quotation.exe	RegAsm.exe
PID 1904 set thread context of 1228	1904	RegAsm.exe	Explorer.EXE
PID 320 set thread context of 1228	320	RegAsm.exe	Explorer.EXE
PID 1040 set thread context of 1192	1040	Quotation.exe	RegAsm.exe
PID 1192 set thread context of 1228	1192	RegAsm.exe	Explorer.EXE
PID 908 set thread context of 1228	908	RegAsm.exe	Explorer.EXE
PID 1264 set thread context of 1480	1264	Quotation.exe	RegAsm.exe
PID 1480 set thread context of 1228	1480	RegAsm.exe	Explorer.EXE
PID 1932 set thread context of 1580	1932	Quotation.exe	RegAsm.exe
PID 1580 set thread context of 1228	1580	RegAsm.exe	Explorer.EXE
PID 1684 set thread context of 1492	1684	Quotation.exe	RegAsm.exe
PID 1492 set thread context of 1228	1492	RegAsm.exe	Explorer.EXE
PID 1044 set thread context of 1816	1044	Quotation.exe	RegAsm.exe
PID 1816 set thread context of 1228	1816	RegAsm.exe	Explorer.EXE
PID 1580 set thread context of 1228	1580	RegAsm.exe	Explorer.EXE
PID 1484 set thread context of 1564	1484	Quotation.exe	RegAsm.exe
PID 1564 set thread context of 1228	1564	RegAsm.exe	Explorer.EXE
PID 1492 set thread context of 1228	1492	RegAsm.exe	Explorer.EXE
PID 924 set thread context of 2044	924	Quotation.exe	RegAsm.exe
PID 2044 set thread context of 1228	2044	RegAsm.exe	Explorer.EXE
PID 816 set thread context of 296	816	Quotation.exe	RegAsm.exe
PID 296 set thread context of 1228	296	RegAsm.exe	Explorer.EXE
PID 1552 set thread context of 656	1552	Quotation.exe	RegAsm.exe
PID 656 set thread context of 1228	656	RegAsm.exe	Explorer.EXE
PID 2044 set thread context of 1228	2044	RegAsm.exe	Explorer.EXE
PID 324 set thread context of 1896	324	Quotation.exe	RegAsm.exe
PID 1896 set thread context of 1228	1896	RegAsm.exe	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 188 IoCs

Processes:

Quotation.exeRegAsm.exeQuotation.exeRegAsm.exehelp.exeQuotation.exeRegAsm.exeexplorer.exeQuotation.exeRegAsm.exerundll32.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.execmd.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exewuapp.exeQuotation.exeRegAsm.exerundll32.exehelp.exeQuotation.exehelp.exeRegAsm.execontrol.exeQuotation.exeRegAsm.exesvchost.exeQuotation.exeRegAsm.execolorcpl.exeQuotation.exeRegAsm.execmd.exeQuotation.exeRegAsm.exeNETSTAT.EXEQuotation.exeRegAsm.exemstsc.exeQuotation.exeRegAsm.exehelp.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.execscript.exeQuotation.exeRegAsm.exewininit.exeQuotation.exeRegAsm.exemstsc.exewuapp.exesvchost.exeQuotation.exeRegAsm.exe

description	pid	process
Token: SeDebugPrivilege	1464	Quotation.exe
Token: SeDebugPrivilege	904	RegAsm.exe
Token: SeDebugPrivilege	532	Quotation.exe
Token: SeDebugPrivilege	732	RegAsm.exe
Token: SeDebugPrivilege	1032	help.exe
Token: SeDebugPrivilege	1676	Quotation.exe
Token: SeDebugPrivilege	1884	RegAsm.exe
Token: SeDebugPrivilege	1768	explorer.exe
Token: SeDebugPrivilege	1892	Quotation.exe
Token: SeDebugPrivilege	1824	RegAsm.exe
Token: SeDebugPrivilege	1840	rundll32.exe
Token: SeDebugPrivilege	1732	Quotation.exe
Token: SeDebugPrivilege	1652	RegAsm.exe
Token: SeDebugPrivilege	1992	Quotation.exe
Token: SeDebugPrivilege	1056	RegAsm.exe
Token: SeDebugPrivilege	1960	cmd.exe
Token: SeDebugPrivilege	2008	Quotation.exe
Token: SeDebugPrivilege	1332	RegAsm.exe
Token: SeDebugPrivilege	1472	Quotation.exe
Token: SeDebugPrivilege	576	RegAsm.exe
Token: SeDebugPrivilege	1700	wuapp.exe
Token: SeDebugPrivilege	1028	Quotation.exe
Token: SeDebugPrivilege	1692	RegAsm.exe
Token: SeDebugPrivilege	1908	rundll32.exe
Token: SeDebugPrivilege	1600	help.exe
Token: SeDebugPrivilege	1816	Quotation.exe
Token: SeDebugPrivilege	1660	help.exe
Token: SeDebugPrivilege	620	RegAsm.exe
Token: SeDebugPrivilege	1748	control.exe
Token: SeDebugPrivilege	1632	Quotation.exe
Token: SeDebugPrivilege	1112	RegAsm.exe
Token: SeDebugPrivilege	2032	svchost.exe
Token: SeDebugPrivilege	1016	Quotation.exe
Token: SeDebugPrivilege	884	RegAsm.exe
Token: SeDebugPrivilege	1956	colorcpl.exe
Token: SeDebugPrivilege	740	Quotation.exe
Token: SeDebugPrivilege	1036	RegAsm.exe
Token: SeDebugPrivilege	1836	cmd.exe
Token: SeDebugPrivilege	1896	Quotation.exe
Token: SeDebugPrivilege	784	RegAsm.exe
Token: SeDebugPrivilege	1996	NETSTAT.EXE
Token: SeDebugPrivilege	1828	Quotation.exe
Token: SeDebugPrivilege	1388	RegAsm.exe
Token: SeDebugPrivilege	1556	mstsc.exe
Token: SeDebugPrivilege	1764	Quotation.exe
Token: SeDebugPrivilege	320	RegAsm.exe
Token: SeDebugPrivilege	1560	help.exe
Token: SeDebugPrivilege	548	Quotation.exe
Token: SeDebugPrivilege	908	RegAsm.exe
Token: SeDebugPrivilege	1952	Quotation.exe
Token: SeDebugPrivilege	1904	RegAsm.exe
Token: SeDebugPrivilege	1040	Quotation.exe
Token: SeDebugPrivilege	1192	RegAsm.exe
Token: SeDebugPrivilege	292	cscript.exe
Token: SeDebugPrivilege	1264	Quotation.exe
Token: SeDebugPrivilege	1480	RegAsm.exe
Token: SeDebugPrivilege	1016	wininit.exe
Token: SeDebugPrivilege	1932	Quotation.exe
Token: SeDebugPrivilege	1580	RegAsm.exe
Token: SeDebugPrivilege	2036	mstsc.exe
Token: SeDebugPrivilege	816	wuapp.exe
Token: SeDebugPrivilege	1640	svchost.exe
Token: SeDebugPrivilege	1684	Quotation.exe
Token: SeDebugPrivilege	1492	RegAsm.exe

Enumerates system info in registry 2 TTPs 1 IoCs

Query Registry
T1012

System Information Discovery
T1082

Processes:

chkdsk.exe

description ioc process

Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	chkdsk.exe

Suspicious use of WriteProcessMemory 1101 IoCs

Processes:

Quotation.exeExplorer.EXEQuotation.exehelp.exeQuotation.exeQuotation.exe

description	pid	process	target process
PID 1464 wrote to memory of 308	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 308	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 308	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 308	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 308	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 308	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 308	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 904	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 904	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 904	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 904	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 904	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 904	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 904	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 904	1464	Quotation.exe	RegAsm.exe
PID 1464 wrote to memory of 532	1464	Quotation.exe	Quotation.exe
PID 1464 wrote to memory of 532	1464	Quotation.exe	Quotation.exe
PID 1464 wrote to memory of 532	1464	Quotation.exe	Quotation.exe
PID 1464 wrote to memory of 532	1464	Quotation.exe	Quotation.exe
PID 1228 wrote to memory of 1032	1228	Explorer.EXE	help.exe
PID 1228 wrote to memory of 1032	1228	Explorer.EXE	help.exe
PID 1228 wrote to memory of 1032	1228	Explorer.EXE	help.exe
PID 1228 wrote to memory of 1032	1228	Explorer.EXE	help.exe
PID 532 wrote to memory of 732	532	Quotation.exe	RegAsm.exe
PID 532 wrote to memory of 732	532	Quotation.exe	RegAsm.exe
PID 532 wrote to memory of 732	532	Quotation.exe	RegAsm.exe
PID 532 wrote to memory of 732	532	Quotation.exe	RegAsm.exe
PID 532 wrote to memory of 732	532	Quotation.exe	RegAsm.exe
PID 532 wrote to memory of 732	532	Quotation.exe	RegAsm.exe
PID 532 wrote to memory of 732	532	Quotation.exe	RegAsm.exe
PID 532 wrote to memory of 732	532	Quotation.exe	RegAsm.exe
PID 532 wrote to memory of 1676	532	Quotation.exe	Quotation.exe
PID 532 wrote to memory of 1676	532	Quotation.exe	Quotation.exe
PID 532 wrote to memory of 1676	532	Quotation.exe	Quotation.exe
PID 532 wrote to memory of 1676	532	Quotation.exe	Quotation.exe
PID 1228 wrote to memory of 1768	1228	Explorer.EXE	explorer.exe
PID 1228 wrote to memory of 1768	1228	Explorer.EXE	explorer.exe
PID 1228 wrote to memory of 1768	1228	Explorer.EXE	explorer.exe
PID 1228 wrote to memory of 1768	1228	Explorer.EXE	explorer.exe
PID 1032 wrote to memory of 1384	1032	help.exe	cmd.exe
PID 1032 wrote to memory of 1384	1032	help.exe	cmd.exe
PID 1032 wrote to memory of 1384	1032	help.exe	cmd.exe
PID 1032 wrote to memory of 1384	1032	help.exe	cmd.exe
PID 1676 wrote to memory of 1884	1676	Quotation.exe	RegAsm.exe
PID 1676 wrote to memory of 1884	1676	Quotation.exe	RegAsm.exe
PID 1676 wrote to memory of 1884	1676	Quotation.exe	RegAsm.exe
PID 1676 wrote to memory of 1884	1676	Quotation.exe	RegAsm.exe
PID 1676 wrote to memory of 1884	1676	Quotation.exe	RegAsm.exe
PID 1676 wrote to memory of 1884	1676	Quotation.exe	RegAsm.exe
PID 1676 wrote to memory of 1884	1676	Quotation.exe	RegAsm.exe
PID 1676 wrote to memory of 1884	1676	Quotation.exe	RegAsm.exe
PID 1676 wrote to memory of 1892	1676	Quotation.exe	Quotation.exe
PID 1676 wrote to memory of 1892	1676	Quotation.exe	Quotation.exe
PID 1676 wrote to memory of 1892	1676	Quotation.exe	Quotation.exe
PID 1676 wrote to memory of 1892	1676	Quotation.exe	Quotation.exe
PID 1228 wrote to memory of 1840	1228	Explorer.EXE	rundll32.exe
PID 1228 wrote to memory of 1840	1228	Explorer.EXE	rundll32.exe
PID 1228 wrote to memory of 1840	1228	Explorer.EXE	rundll32.exe
PID 1228 wrote to memory of 1840	1228	Explorer.EXE	rundll32.exe
PID 1228 wrote to memory of 1840	1228	Explorer.EXE	rundll32.exe
PID 1228 wrote to memory of 1840	1228	Explorer.EXE	rundll32.exe
PID 1228 wrote to memory of 1840	1228	Explorer.EXE	rundll32.exe
PID 1892 wrote to memory of 1824	1892	Quotation.exe	RegAsm.exe
PID 1892 wrote to memory of 1824	1892	Quotation.exe	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 15410 IoCs

Processes:

Quotation.exe

pid	process
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe
1464	Quotation.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Explorer.EXE

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Checks whether UAC is enabled
PID:1228

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:1464

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:308

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:904

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:732

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1884

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1824

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:1908

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1732

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1652

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1992

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1056

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2008

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1332

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1472

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:576

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:620

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1112

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:884

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:740

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:784

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1828

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1388

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
17⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1764

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
18⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:320

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
19⤵
- Suspicious use of AdjustPrivilegeToken
PID:816

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
18⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:548

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
19⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:908

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
19⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1952

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
20⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1904

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
20⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
21⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
21⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1264

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
22⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
22⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1932

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
23⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1580

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
23⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1684

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
24⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:1492

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
25⤵
PID:1952

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
24⤵
- Suspicious use of SetThreadContext
PID:1044

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
25⤵
- Suspicious use of SetThreadContext
PID:1816

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
25⤵
- Suspicious use of SetThreadContext
PID:1484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
26⤵
- Suspicious use of SetThreadContext
PID:1564

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
26⤵
- Suspicious use of SetThreadContext
PID:924

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
27⤵
- Suspicious use of SetThreadContext
PID:2044

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
28⤵
PID:1924

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
28⤵
PID:1576

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
28⤵
PID:1572

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
27⤵
- Suspicious use of SetThreadContext
PID:816

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
28⤵
- Suspicious use of SetThreadContext
PID:296

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
28⤵
- Suspicious use of SetThreadContext
PID:1552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
29⤵
- Suspicious use of SetThreadContext
PID:656

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
29⤵
- Suspicious use of SetThreadContext
PID:324

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
30⤵
- Suspicious use of SetThreadContext
PID:1896

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
30⤵
PID:580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
31⤵
PID:1044

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
31⤵
PID:1348

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
32⤵
PID:788

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
32⤵
PID:1784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
33⤵
PID:1356

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
34⤵
PID:1944

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
33⤵
PID:1644

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
34⤵
PID:816

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
34⤵
PID:1944

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
35⤵
PID:1424

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
35⤵
PID:1928

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
36⤵
PID:1220

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
36⤵
PID:1464

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
37⤵
PID:472

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
37⤵
PID:1040

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
38⤵
PID:1340

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
38⤵
PID:1160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
39⤵
PID:1212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
39⤵
PID:1892

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
39⤵
PID:404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
40⤵
PID:568

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
40⤵
PID:1756

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:580

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
41⤵
PID:1812

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
41⤵
PID:1212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
42⤵
PID:1224

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
42⤵
PID:1084

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
43⤵
PID:1664

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
43⤵
PID:1532

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
44⤵
PID:1912

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
44⤵
PID:1028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
45⤵
PID:1684

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
45⤵
PID:1456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
46⤵
PID:1248

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
46⤵
PID:1516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
47⤵
PID:1040

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
47⤵
PID:1784

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
48⤵
PID:1676

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
48⤵
PID:404

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
49⤵
PID:1376

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
49⤵
PID:1456

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
50⤵
PID:1544

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
50⤵
PID:760

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
51⤵
PID:1952

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
51⤵
PID:1732

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
51⤵
PID:1936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
52⤵
PID:2012

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
52⤵
PID:1688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
53⤵
PID:1784

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
53⤵
PID:852

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
54⤵
PID:1456

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
54⤵
PID:1916

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
55⤵
PID:820

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
55⤵
PID:2052

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
55⤵
PID:2080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
56⤵
PID:2264

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
56⤵
PID:2292

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
57⤵
PID:2340

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
57⤵
PID:2368

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
58⤵
PID:2436

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
58⤵
PID:2464

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
59⤵
PID:2524

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
59⤵
PID:2560

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
60⤵
PID:2632

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
60⤵
PID:2640

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
60⤵
PID:2676

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
61⤵
PID:2748

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
61⤵
PID:2776

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
62⤵
PID:2844

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
62⤵
PID:2872

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
63⤵
PID:2928

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
63⤵
PID:2956

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
64⤵
PID:3000

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
64⤵
PID:3028

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
65⤵
PID:1028

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
65⤵
PID:1516

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
66⤵
PID:2252

C:\Users\Admin\AppData\Local\Temp\Quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
66⤵
PID:1552

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1032

C:\Windows\SysWOW64\cmd.exe
/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
3⤵
PID:1384

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1768

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1960

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1112

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:320

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:656

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:472

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1520

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:308

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1512

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1600

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1464

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1876

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1080

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1584

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1356

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1904

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1516

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1836

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1832

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:324

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1636

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1040

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1296

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1896

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1936

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1132

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1872

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Windows\SysWOW64\control.exe
"C:\Windows\SysWOW64\control.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1956

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1584

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1356

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1904

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:1516

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836

C:\Windows\SysWOW64\NETSTAT.EXE
"C:\Windows\SysWOW64\NETSTAT.EXE"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1996

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1560

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:292

C:\Windows\SysWOW64\wininit.exe
"C:\Windows\SysWOW64\wininit.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1016

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Windows\SysWOW64\NAPSTAT.EXE
"C:\Windows\SysWOW64\NAPSTAT.EXE"
2⤵
PID:1788

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
PID:1616

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
PID:1900

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
PID:1148

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
PID:924

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
PID:1888

C:\Windows\SysWOW64\explorer.exe
"C:\Windows\SysWOW64\explorer.exe"
2⤵
PID:1472

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
PID:1500

C:\Windows\SysWOW64\mstsc.exe
"C:\Windows\SysWOW64\mstsc.exe"
2⤵
PID:1876

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
PID:1484

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
PID:1108

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
2⤵
PID:1940

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
PID:548

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
PID:1276

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
PID:1988

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
PID:1432

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1040

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1116

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1944

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1464

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1928

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:1732

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\SysWOW64\cmd.exe"
2⤵
PID:1756

C:\Windows\SysWOW64\NAPSTAT.EXE
"C:\Windows\SysWOW64\NAPSTAT.EXE"
2⤵
PID:1352

C:\Windows\SysWOW64\systray.exe
"C:\Windows\SysWOW64\systray.exe"
2⤵
PID:1464

C:\Windows\SysWOW64\wininit.exe
"C:\Windows\SysWOW64\wininit.exe"
2⤵
PID:1488

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\SysWOW64\netsh.exe"
2⤵
PID:1128

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
PID:1992

C:\Windows\SysWOW64\cmstp.exe
"C:\Windows\SysWOW64\cmstp.exe"
2⤵
PID:1132

C:\Windows\SysWOW64\colorcpl.exe
"C:\Windows\SysWOW64\colorcpl.exe"
2⤵
PID:1212

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
PID:1752

C:\Windows\SysWOW64\chkdsk.exe
"C:\Windows\SysWOW64\chkdsk.exe"
2⤵
- Enumerates system info in registry
PID:964

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2120

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2128

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2136

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2144

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2152

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2160

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2168

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2176

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2184

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2192

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2200

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2208

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2216

C:\Windows\SysWOW64\autofmt.exe
"C:\Windows\SysWOW64\autofmt.exe"
2⤵
PID:2224

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2232

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2240

C:\Windows\SysWOW64\autochk.exe
"C:\Windows\SysWOW64\autochk.exe"
2⤵
PID:2248

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
PID:2256

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
PID:2332

C:\Windows\SysWOW64\NAPSTAT.EXE
"C:\Windows\SysWOW64\NAPSTAT.EXE"
2⤵
PID:2428

C:\Windows\SysWOW64\wininit.exe
"C:\Windows\SysWOW64\wininit.exe"
2⤵
PID:2504

C:\Windows\SysWOW64\wlanext.exe
"C:\Windows\SysWOW64\wlanext.exe"
2⤵
PID:2532

C:\Windows\SysWOW64\wuapp.exe
"C:\Windows\SysWOW64\wuapp.exe"
2⤵
PID:2600

C:\Windows\SysWOW64\NETSTAT.EXE
"C:\Windows\SysWOW64\NETSTAT.EXE"
2⤵
PID:2652

C:\Windows\SysWOW64\msiexec.exe
"C:\Windows\SysWOW64\msiexec.exe"
2⤵
PID:2716

C:\Windows\SysWOW64\raserver.exe
"C:\Windows\SysWOW64\raserver.exe"
2⤵
PID:2812

C:\Windows\SysWOW64\svchost.exe
"C:\Windows\SysWOW64\svchost.exe"
2⤵
PID:3064

C:\Windows\SysWOW64\wscript.exe
"C:\Windows\SysWOW64\wscript.exe"
2⤵
PID:1852

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2132

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2140

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2148

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2156

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2164

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2172

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2180

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2188

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2196

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2204

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2212

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2220

C:\Windows\SysWOW64\autoconv.exe
"C:\Windows\SysWOW64\autoconv.exe"
2⤵
PID:2228

C:\Windows\SysWOW64\help.exe
"C:\Windows\SysWOW64\help.exe"
2⤵
PID:2244

C:\Windows\SysWOW64\cscript.exe
"C:\Windows\SysWOW64\cscript.exe"
2⤵
PID:1088

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/292-90-0x0000000000000000-mapping.dmp

Download
memory/292-91-0x0000000000860000-0x0000000000882000-memory.dmp

Filesize
136KB

Download
memory/296-125-0x000000000041E2C0-mapping.dmp

Download
memory/320-77-0x000000000041E2C0-mapping.dmp

Download
memory/324-130-0x0000000000000000-mapping.dmp

Download
memory/404-187-0x0000000000000000-mapping.dmp

Download
memory/404-239-0x0000000000000000-mapping.dmp

Download
memory/472-172-0x000000000041E2C0-mapping.dmp

Download
memory/532-2-0x0000000000000000-mapping.dmp

Download
memory/548-206-0x0000000000000000-mapping.dmp

Download
memory/548-78-0x0000000000000000-mapping.dmp

Download
memory/548-207-0x0000000000E30000-0x0000000000E38000-memory.dmp

Filesize
32KB

Download
memory/568-194-0x000000000041E2C0-mapping.dmp

Download
memory/576-33-0x000000000041E2C0-mapping.dmp

Download
memory/580-137-0x0000000000000000-mapping.dmp

Download
memory/620-47-0x000000000041E2C0-mapping.dmp

Download
memory/656-129-0x000000000041E2C0-mapping.dmp

Download
memory/732-4-0x000000000041E2C0-mapping.dmp

Download
memory/740-58-0x0000000000000000-mapping.dmp

Download
memory/760-251-0x0000000000000000-mapping.dmp

Download
memory/784-67-0x000000000041E2C0-mapping.dmp

Download
memory/788-148-0x000000000041E2C0-mapping.dmp

Download
memory/816-103-0x0000000000F00000-0x0000000000F0B000-memory.dmp

Filesize
44KB

Download
memory/816-158-0x000000000041E2C0-mapping.dmp

Download
memory/816-121-0x0000000000000000-mapping.dmp

Download
memory/816-102-0x0000000000000000-mapping.dmp

Download
memory/852-266-0x0000000000000000-mapping.dmp

Download
memory/884-57-0x000000000041E2C0-mapping.dmp

Download
memory/904-1-0x000000000041E2C0-mapping.dmp

Download
memory/904-0-0x0000000000400000-0x000000000042D000-memory.dmp

Filesize
180KB

Download
memory/908-82-0x000000000041E2C0-mapping.dmp

Download
memory/924-116-0x0000000000000000-mapping.dmp

Download
memory/924-146-0x0000000000340000-0x000000000034B000-memory.dmp

Filesize
44KB

Download
memory/924-145-0x0000000000000000-mapping.dmp

Download
memory/964-267-0x0000000000000000-mapping.dmp

Download
memory/964-268-0x00000000005A0000-0x00000000005A7000-memory.dmp

Filesize
28KB

Download
memory/1016-95-0x0000000000000000-mapping.dmp

Download
memory/1016-53-0x0000000000000000-mapping.dmp

Download
memory/1016-96-0x0000000000D80000-0x0000000000D9A000-memory.dmp

Filesize
104KB

Download
memory/1028-328-0x000000000041E2C0-mapping.dmp

Download
memory/1028-218-0x0000000000000000-mapping.dmp

Download
memory/1028-34-0x0000000000000000-mapping.dmp

Download
memory/1032-7-0x00000000009C0000-0x00000000009C6000-memory.dmp

Filesize
24KB

Download
memory/1032-23-0x00000000018B0000-0x0000000001A32000-memory.dmp

Filesize
1.5MB

Download
memory/1032-6-0x0000000000000000-mapping.dmp

Download
memory/1036-62-0x000000000041E2C0-mapping.dmp

Download
memory/1040-173-0x0000000000000000-mapping.dmp

Download
memory/1040-86-0x0000000000000000-mapping.dmp

Download
memory/1040-232-0x000000000041E2C0-mapping.dmp

Download
memory/1044-108-0x0000000000000000-mapping.dmp

Download
memory/1044-142-0x000000000041E2C0-mapping.dmp

Download
memory/1056-25-0x000000000041E2C0-mapping.dmp

Download
memory/1084-205-0x0000000000000000-mapping.dmp

Download
memory/1108-191-0x0000000000000000-mapping.dmp

Download
memory/1108-192-0x0000000000110000-0x0000000000128000-memory.dmp

Filesize
96KB

Download
memory/1112-52-0x000000000041E2C0-mapping.dmp

Download
memory/1128-245-0x0000000000000000-mapping.dmp

Download
memory/1128-246-0x0000000001300000-0x000000000131B000-memory.dmp

Filesize
108KB

Download
memory/1132-253-0x00000000006C0000-0x00000000006D8000-memory.dmp

Filesize
96KB

Download
memory/1132-252-0x0000000000000000-mapping.dmp

Download
memory/1148-139-0x0000000000000000-mapping.dmp

Download
memory/1148-140-0x0000000000490000-0x00000000004A8000-memory.dmp

Filesize
96KB

Download
memory/1160-177-0x0000000000000000-mapping.dmp

Download
memory/1192-88-0x000000000041E2C0-mapping.dmp

Download
memory/1212-201-0x0000000000000000-mapping.dmp

Download
memory/1212-258-0x0000000000820000-0x0000000000838000-memory.dmp

Filesize
96KB

Download
memory/1212-257-0x0000000000000000-mapping.dmp

Download
memory/1220-165-0x000000000041E2C0-mapping.dmp

Download
memory/1224-204-0x000000000041E2C0-mapping.dmp

Download
memory/1228-22-0x0000000007270000-0x0000000007340000-memory.dmp

Filesize
832KB

Download
memory/1228-113-0x0000000009C20000-0x0000000009D78000-memory.dmp

Filesize
1.3MB

Download
memory/1228-294-0x000000000D510000-0x000000000D686000-memory.dmp

Filesize
1.5MB

Download
memory/1228-302-0x000000000D780000-0x000000000D928000-memory.dmp

Filesize
1.7MB

Download
memory/1228-190-0x000000000B530000-0x000000000B625000-memory.dmp

Filesize
980KB

Download
memory/1228-317-0x000000000DA30000-0x000000000DB68000-memory.dmp

Filesize
1.2MB

Download
memory/1228-290-0x000000000D430000-0x000000000D503000-memory.dmp

Filesize
844KB

Download
memory/1228-197-0x000000000B630000-0x000000000B785000-memory.dmp

Filesize
1.3MB

Download
memory/1228-184-0x000000000B440000-0x000000000B52F000-memory.dmp

Filesize
956KB

Download
memory/1228-284-0x000000000D210000-0x000000000D2C4000-memory.dmp

Filesize
720KB

Download
memory/1228-138-0x000000000A3F0000-0x000000000A581000-memory.dmp

Filesize
1.6MB

Download
memory/1228-174-0x000000000B100000-0x000000000B238000-memory.dmp

Filesize
1.2MB

Download
memory/1228-275-0x000000000CC00000-0x000000000CD71000-memory.dmp

Filesize
1.4MB

Download
memory/1228-202-0x000000000B8F0000-0x000000000BA7F000-memory.dmp

Filesize
1.6MB

Download
memory/1228-144-0x000000000A590000-0x000000000A73C000-memory.dmp

Filesize
1.7MB

Download
memory/1228-323-0x000000000DB70000-0x000000000DC6A000-memory.dmp

Filesize
1000KB

Download
memory/1228-171-0x000000000AF90000-0x000000000B0F7000-memory.dmp

Filesize
1.4MB

Download
memory/1228-236-0x000000000BFE0000-0x000000000C0F4000-memory.dmp

Filesize
1.1MB

Download
memory/1228-109-0x0000000005E40000-0x0000000005F10000-memory.dmp

Filesize
832KB

Download
memory/1228-211-0x000000000BB40000-0x000000000BC24000-memory.dmp

Filesize
912KB

Download
memory/1228-167-0x000000000AE30000-0x000000000AF8F000-memory.dmp

Filesize
1.4MB

Download
memory/1228-163-0x000000000AC60000-0x000000000AD31000-memory.dmp

Filesize
836KB

Download
memory/1248-229-0x000000000041E2C0-mapping.dmp

Download
memory/1264-89-0x0000000000000000-mapping.dmp

Download
memory/1276-212-0x0000000000000000-mapping.dmp

Download
memory/1332-30-0x000000000041E2C0-mapping.dmp

Download
memory/1340-176-0x000000000041E2C0-mapping.dmp

Download
memory/1348-143-0x0000000000000000-mapping.dmp

Download
memory/1352-227-0x0000000000A90000-0x0000000000AD6000-memory.dmp

Filesize
280KB

Download
memory/1352-226-0x0000000000000000-mapping.dmp

Download
memory/1356-155-0x000000000041E2C0-mapping.dmp

Download
memory/1376-243-0x000000000041E2C0-mapping.dmp

Download
memory/1384-8-0x0000000000000000-mapping.dmp

Download
memory/1388-72-0x000000000041E2C0-mapping.dmp

Download
memory/1424-161-0x000000000041E2C0-mapping.dmp

Download
memory/1432-219-0x0000000000000000-mapping.dmp

Download
memory/1456-244-0x0000000000000000-mapping.dmp

Download
memory/1456-225-0x0000000000000000-mapping.dmp

Download
memory/1456-270-0x000000000041E2C0-mapping.dmp

Download
memory/1464-235-0x0000000000330000-0x0000000000335000-memory.dmp

Filesize
20KB

Download
memory/1464-166-0x0000000000000000-mapping.dmp

Download
memory/1464-234-0x0000000000000000-mapping.dmp

Download
memory/1472-168-0x0000000000000000-mapping.dmp

Download
memory/1472-169-0x0000000000970000-0x0000000000BF1000-memory.dmp

Filesize
2.5MB

Download
memory/1472-31-0x0000000000000000-mapping.dmp

Download
memory/1480-93-0x000000000041E2C0-mapping.dmp

Download
memory/1484-112-0x0000000000000000-mapping.dmp

Download
memory/1484-188-0x0000000000000000-mapping.dmp

Download
memory/1484-189-0x00000000008A0000-0x00000000008B4000-memory.dmp

Filesize
80KB

Download
memory/1488-241-0x0000000000F90000-0x0000000000FAA000-memory.dmp

Filesize
104KB

Download
memory/1488-240-0x0000000000000000-mapping.dmp

Download
memory/1492-107-0x000000000041E2C0-mapping.dmp

Download
memory/1500-179-0x0000000000BF0000-0x0000000000BFD000-memory.dmp

Filesize
52KB

Download
memory/1500-178-0x0000000000000000-mapping.dmp

Download
memory/1516-329-0x0000000000000000-mapping.dmp

Download
memory/1516-230-0x0000000000000000-mapping.dmp

Download
memory/1532-210-0x0000000000000000-mapping.dmp

Download
memory/1544-250-0x000000000041E2C0-mapping.dmp

Download
memory/1552-334-0x0000000000000000-mapping.dmp

Download
memory/1552-126-0x0000000000000000-mapping.dmp

Download
memory/1556-74-0x0000000000000000-mapping.dmp

Download
memory/1556-75-0x0000000000090000-0x0000000000194000-memory.dmp

Filesize
1.0MB

Download
memory/1560-80-0x00000000009C0000-0x00000000009C6000-memory.dmp

Filesize
24KB

Download
memory/1560-79-0x0000000000000000-mapping.dmp

Download
memory/1564-115-0x000000000041E2C0-mapping.dmp

Download
memory/1572-153-0x000000004A260000-0x000000004A2AC000-memory.dmp

Filesize
304KB

Download
memory/1572-152-0x0000000000000000-mapping.dmp

Download
memory/1580-98-0x000000000041E2C0-mapping.dmp

Download
memory/1600-42-0x0000000000000000-mapping.dmp

Download
memory/1616-122-0x0000000000000000-mapping.dmp

Download
memory/1616-123-0x0000000000850000-0x0000000000864000-memory.dmp

Filesize
80KB

Download
memory/1632-48-0x0000000000000000-mapping.dmp

Download
memory/1640-104-0x0000000000000000-mapping.dmp

Download
memory/1640-105-0x00000000004A0000-0x00000000004A8000-memory.dmp

Filesize
32KB

Download
memory/1644-156-0x0000000000000000-mapping.dmp

Download
memory/1652-20-0x000000000041E2C0-mapping.dmp

Download
memory/1660-44-0x0000000000000000-mapping.dmp

Download
memory/1660-45-0x00000000009C0000-0x00000000009C6000-memory.dmp

Filesize
24KB

Download
memory/1664-209-0x000000000041E2C0-mapping.dmp

Download
memory/1676-5-0x0000000000000000-mapping.dmp

Download
memory/1676-238-0x000000000041E2C0-mapping.dmp

Download
memory/1684-224-0x000000000041E2C0-mapping.dmp

Download
memory/1684-99-0x0000000000000000-mapping.dmp

Download
memory/1688-261-0x0000000000000000-mapping.dmp

Download
memory/1692-38-0x000000000041E2C0-mapping.dmp

Download
memory/1700-35-0x0000000000000000-mapping.dmp

Download
memory/1700-36-0x0000000000A10000-0x0000000000A1B000-memory.dmp

Filesize
44KB

Download
memory/1732-255-0x000000000041E2C0-mapping.dmp

Download
memory/1732-16-0x0000000000000000-mapping.dmp

Download
memory/1748-49-0x0000000000000000-mapping.dmp

Download
memory/1748-50-0x0000000000260000-0x000000000027F000-memory.dmp

Filesize
124KB

Download
memory/1752-262-0x0000000000000000-mapping.dmp

Download
memory/1752-263-0x0000000000870000-0x0000000000884000-memory.dmp

Filesize
80KB

Download
memory/1756-195-0x0000000000000000-mapping.dmp

Download
memory/1756-221-0x0000000000000000-mapping.dmp

Download
memory/1756-222-0x000000004A520000-0x000000004A56C000-memory.dmp

Filesize
304KB

Download
memory/1764-73-0x0000000000000000-mapping.dmp

Download
memory/1768-13-0x0000000000AB0000-0x0000000000D31000-memory.dmp

Filesize
2.5MB

Download
memory/1768-12-0x0000000000000000-mapping.dmp

Download
memory/1784-233-0x0000000000000000-mapping.dmp

Download
memory/1784-149-0x0000000000000000-mapping.dmp

Download
memory/1784-265-0x000000000041E2C0-mapping.dmp

Download
memory/1788-118-0x00000000002D0000-0x0000000000316000-memory.dmp

Filesize
280KB

Download
memory/1788-117-0x0000000000000000-mapping.dmp

Download
memory/1812-200-0x000000000041E2C0-mapping.dmp

Download
memory/1816-39-0x0000000000000000-mapping.dmp

Download
memory/1816-111-0x000000000041E2C0-mapping.dmp

Download
memory/1824-15-0x000000000041E2C0-mapping.dmp

Download
memory/1828-68-0x0000000000000000-mapping.dmp

Download
memory/1836-64-0x0000000000000000-mapping.dmp

Download
memory/1836-65-0x000000004AB10000-0x000000004AB5C000-memory.dmp

Filesize
304KB

Download
memory/1840-18-0x0000000000020000-0x000000000002E000-memory.dmp

Filesize
56KB

Download
memory/1840-17-0x0000000000000000-mapping.dmp

Download
memory/1852-336-0x0000000000840000-0x0000000000866000-memory.dmp

Filesize
152KB

Download
memory/1852-335-0x0000000000000000-mapping.dmp

Download
memory/1876-183-0x00000000007B0000-0x00000000008B4000-memory.dmp

Filesize
1.0MB

Download
memory/1876-182-0x0000000000000000-mapping.dmp

Download
memory/1884-10-0x000000000041E2C0-mapping.dmp

Download
memory/1888-150-0x0000000000000000-mapping.dmp

Download
memory/1888-151-0x0000000000900000-0x000000000090D000-memory.dmp

Filesize
52KB

Download
memory/1892-186-0x000000000041E2C0-mapping.dmp

Download
memory/1892-11-0x0000000000000000-mapping.dmp

Download
memory/1896-63-0x0000000000000000-mapping.dmp

Download
memory/1896-136-0x000000000041E2C0-mapping.dmp

Download
memory/1900-132-0x00000000008C0000-0x00000000008D4000-memory.dmp

Filesize
80KB

Download
memory/1900-131-0x0000000000000000-mapping.dmp

Download
memory/1904-85-0x000000000041E2C0-mapping.dmp

Download
memory/1908-40-0x0000000000000000-mapping.dmp

Download
memory/1908-41-0x0000000000100000-0x000000000010E000-memory.dmp

Filesize
56KB

Download
memory/1912-217-0x000000000041E2C0-mapping.dmp

Download
memory/1916-271-0x0000000000000000-mapping.dmp

Download
memory/1928-162-0x0000000000000000-mapping.dmp

Download
memory/1932-94-0x0000000000000000-mapping.dmp

Download
memory/1936-256-0x0000000000000000-mapping.dmp

Download
memory/1940-198-0x0000000000C10000-0x0000000000C1D000-memory.dmp

Filesize
52KB

Download
memory/1940-196-0x0000000000000000-mapping.dmp

Download
memory/1944-159-0x0000000000000000-mapping.dmp

Download
memory/1944-181-0x0000000000C60000-0x0000000000C7C000-memory.dmp

Filesize
112KB

Download
memory/1944-180-0x0000000000000000-mapping.dmp

Download
memory/1952-133-0x0000000000000000-mapping.dmp

Download
memory/1952-83-0x0000000000000000-mapping.dmp

Download
memory/1952-134-0x0000000000E60000-0x0000000000E65000-memory.dmp

Filesize
20KB

Download
memory/1956-60-0x00000000007E0000-0x00000000007F8000-memory.dmp

Filesize
96KB

Download
memory/1956-59-0x0000000000000000-mapping.dmp

Download
memory/1960-27-0x0000000000000000-mapping.dmp

Download
memory/1960-28-0x000000004AB70000-0x000000004ABBC000-memory.dmp

Filesize
304KB

Download
memory/1988-214-0x0000000000000000-mapping.dmp

Download
memory/1988-215-0x0000000000F40000-0x0000000000F5B000-memory.dmp

Filesize
108KB

Download
memory/1992-21-0x0000000000000000-mapping.dmp

Download
memory/1992-247-0x0000000000000000-mapping.dmp

Download
memory/1992-248-0x0000000000910000-0x0000000000918000-memory.dmp

Filesize
32KB

Download
memory/1996-70-0x0000000000E30000-0x0000000000E39000-memory.dmp

Filesize
36KB

Download
memory/1996-69-0x0000000000000000-mapping.dmp

Download
memory/2008-26-0x0000000000000000-mapping.dmp

Download
memory/2012-260-0x000000000041E2C0-mapping.dmp

Download
memory/2032-55-0x0000000000B20000-0x0000000000B28000-memory.dmp

Filesize
32KB

Download
memory/2032-54-0x0000000000000000-mapping.dmp

Download
memory/2036-100-0x0000000000000000-mapping.dmp

Download
memory/2036-101-0x0000000000110000-0x0000000000214000-memory.dmp

Filesize
1.0MB

Download
memory/2044-120-0x000000000041E2C0-mapping.dmp

Download
memory/2052-273-0x000000000041E2C0-mapping.dmp

Download
memory/2080-274-0x0000000000000000-mapping.dmp

Download
memory/2252-333-0x000000000041E2C0-mapping.dmp

Download
memory/2256-282-0x0000000000000000-mapping.dmp

Download
memory/2256-283-0x0000000000510000-0x0000000000532000-memory.dmp

Filesize
136KB

Download
memory/2264-277-0x000000000041E2C0-mapping.dmp

Download
memory/2292-278-0x0000000000000000-mapping.dmp

Download
memory/2332-288-0x0000000000000000-mapping.dmp

Download
memory/2332-289-0x0000000000B20000-0x0000000000B36000-memory.dmp

Filesize
88KB

Download
memory/2340-280-0x000000000041E2C0-mapping.dmp

Download
memory/2368-281-0x0000000000000000-mapping.dmp

Download
memory/2428-296-0x0000000000400000-0x0000000000446000-memory.dmp

Filesize
280KB

Download
memory/2428-295-0x0000000000000000-mapping.dmp

Download
memory/2436-286-0x000000000041E2C0-mapping.dmp

Download
memory/2464-287-0x0000000000000000-mapping.dmp

Download
memory/2504-298-0x0000000000060000-0x000000000007A000-memory.dmp

Filesize
104KB

Download
memory/2504-297-0x0000000000000000-mapping.dmp

Download
memory/2524-292-0x000000000041E2C0-mapping.dmp

Download
memory/2532-303-0x0000000000000000-mapping.dmp

Download
memory/2532-304-0x00000000002E0000-0x00000000002F6000-memory.dmp

Filesize
88KB

Download
memory/2560-293-0x0000000000000000-mapping.dmp

Download
memory/2600-306-0x0000000000A40000-0x0000000000A4B000-memory.dmp

Filesize
44KB

Download
memory/2600-305-0x0000000000000000-mapping.dmp

Download
memory/2640-300-0x000000000041E2C0-mapping.dmp

Download
memory/2652-311-0x0000000000BB0000-0x0000000000BB9000-memory.dmp

Filesize
36KB

Download
memory/2652-310-0x0000000000000000-mapping.dmp

Download
memory/2676-301-0x0000000000000000-mapping.dmp

Download
memory/2716-313-0x0000000000FB0000-0x0000000000FC4000-memory.dmp

Filesize
80KB

Download
memory/2716-312-0x0000000000000000-mapping.dmp

Download
memory/2748-308-0x000000000041E2C0-mapping.dmp

Download
memory/2776-309-0x0000000000000000-mapping.dmp

Download
memory/2812-319-0x0000000000CE0000-0x0000000000CFC000-memory.dmp

Filesize
112KB

Download
memory/2812-318-0x0000000000000000-mapping.dmp

Download
memory/2844-315-0x000000000041E2C0-mapping.dmp

Download
memory/2872-316-0x0000000000000000-mapping.dmp

Download
memory/2928-321-0x000000000041E2C0-mapping.dmp

Download
memory/2956-322-0x0000000000000000-mapping.dmp

Download
memory/3000-325-0x000000000041E2C0-mapping.dmp

Download
memory/3028-326-0x0000000000000000-mapping.dmp

Download
memory/3064-330-0x0000000000000000-mapping.dmp

Download
memory/3064-331-0x00000000009C0000-0x00000000009C8000-memory.dmp

Filesize
32KB

Download