Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7 -
submitted
10-07-2020 05:46
Static task
static1
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v200430
General
-
Target
Quotation.exe
-
Size
233KB
-
MD5
560be75b2b6cfdace7266e5e345f242a
-
SHA1
0217bcea49f188b04f5d4b2d35c9c2e10be55189
-
SHA256
9c1501fbd2eb669ccbe4a41e37770191e954e6f0dd3e0a954a0670a91df3917c
-
SHA512
577e82392b55506580cff192eee0e389f5bc6a3c53939da1aa7fb73985425a2a3d98f6acf2fb6606be1278d6e3a62863a575ea910f27810eb4c7e5d6027b7ed1
Malware Config
Signatures
-
Suspicious use of FindShellTrayWindow 8 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious use of SendNotifyMessage 7 IoCs
Processes:
Explorer.EXEpid process 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE 1228 Explorer.EXE -
Suspicious behavior: MapViewOfSection 283 IoCs
Processes:
Quotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exehelp.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exepid process 1464 Quotation.exe 1464 Quotation.exe 904 RegAsm.exe 532 Quotation.exe 732 RegAsm.exe 904 RegAsm.exe 904 RegAsm.exe 1676 Quotation.exe 1884 RegAsm.exe 732 RegAsm.exe 732 RegAsm.exe 1032 help.exe 1892 Quotation.exe 1824 RegAsm.exe 1884 RegAsm.exe 1884 RegAsm.exe 1732 Quotation.exe 1652 RegAsm.exe 1032 help.exe 1992 Quotation.exe 1032 help.exe 1056 RegAsm.exe 1652 RegAsm.exe 1652 RegAsm.exe 1824 RegAsm.exe 2008 Quotation.exe 1332 RegAsm.exe 1472 Quotation.exe 576 RegAsm.exe 1332 RegAsm.exe 1332 RegAsm.exe 1056 RegAsm.exe 1028 Quotation.exe 1824 RegAsm.exe 1824 RegAsm.exe 1692 RegAsm.exe 576 RegAsm.exe 576 RegAsm.exe 1056 RegAsm.exe 1056 RegAsm.exe 1816 Quotation.exe 620 RegAsm.exe 1692 RegAsm.exe 1692 RegAsm.exe 1632 Quotation.exe 1112 RegAsm.exe 620 RegAsm.exe 620 RegAsm.exe 1016 Quotation.exe 884 RegAsm.exe 1112 RegAsm.exe 1112 RegAsm.exe 740 Quotation.exe 1036 RegAsm.exe 884 RegAsm.exe 884 RegAsm.exe 1896 Quotation.exe 784 RegAsm.exe 1036 RegAsm.exe 1036 RegAsm.exe 1828 Quotation.exe 1388 RegAsm.exe 784 RegAsm.exe 784 RegAsm.exe -
Suspicious use of SetThreadContext 151 IoCs
Processes:
Quotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exehelp.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exedescription pid process target process PID 1464 set thread context of 904 1464 Quotation.exe RegAsm.exe PID 904 set thread context of 1228 904 RegAsm.exe Explorer.EXE PID 532 set thread context of 732 532 Quotation.exe RegAsm.exe PID 732 set thread context of 1228 732 RegAsm.exe Explorer.EXE PID 1676 set thread context of 1884 1676 Quotation.exe RegAsm.exe PID 1884 set thread context of 1228 1884 RegAsm.exe Explorer.EXE PID 1892 set thread context of 1824 1892 Quotation.exe RegAsm.exe PID 1824 set thread context of 1228 1824 RegAsm.exe Explorer.EXE PID 1732 set thread context of 1652 1732 Quotation.exe RegAsm.exe PID 1652 set thread context of 1228 1652 RegAsm.exe Explorer.EXE PID 1032 set thread context of 1228 1032 help.exe Explorer.EXE PID 1992 set thread context of 1056 1992 Quotation.exe RegAsm.exe PID 1056 set thread context of 1228 1056 RegAsm.exe Explorer.EXE PID 1824 set thread context of 1228 1824 RegAsm.exe Explorer.EXE PID 2008 set thread context of 1332 2008 Quotation.exe RegAsm.exe PID 1332 set thread context of 1228 1332 RegAsm.exe Explorer.EXE PID 1472 set thread context of 576 1472 Quotation.exe RegAsm.exe PID 576 set thread context of 1228 576 RegAsm.exe Explorer.EXE PID 1056 set thread context of 1228 1056 RegAsm.exe Explorer.EXE PID 1028 set thread context of 1692 1028 Quotation.exe RegAsm.exe PID 1692 set thread context of 1228 1692 RegAsm.exe Explorer.EXE PID 1816 set thread context of 620 1816 Quotation.exe RegAsm.exe PID 620 set thread context of 1228 620 RegAsm.exe Explorer.EXE PID 1632 set thread context of 1112 1632 Quotation.exe RegAsm.exe PID 1112 set thread context of 1228 1112 RegAsm.exe Explorer.EXE PID 1016 set thread context of 884 1016 Quotation.exe RegAsm.exe PID 884 set thread context of 1228 884 RegAsm.exe Explorer.EXE PID 740 set thread context of 1036 740 Quotation.exe RegAsm.exe PID 1036 set thread context of 1228 1036 RegAsm.exe Explorer.EXE PID 1896 set thread context of 784 1896 Quotation.exe RegAsm.exe PID 784 set thread context of 1228 784 RegAsm.exe Explorer.EXE PID 1828 set thread context of 1388 1828 Quotation.exe RegAsm.exe PID 1388 set thread context of 1228 1388 RegAsm.exe Explorer.EXE PID 1764 set thread context of 320 1764 Quotation.exe RegAsm.exe PID 320 set thread context of 1228 320 RegAsm.exe Explorer.EXE PID 548 set thread context of 908 548 Quotation.exe RegAsm.exe PID 908 set thread context of 1228 908 RegAsm.exe Explorer.EXE PID 1952 set thread context of 1904 1952 Quotation.exe RegAsm.exe PID 1904 set thread context of 1228 1904 RegAsm.exe Explorer.EXE PID 320 set thread context of 1228 320 RegAsm.exe Explorer.EXE PID 1040 set thread context of 1192 1040 Quotation.exe RegAsm.exe PID 1192 set thread context of 1228 1192 RegAsm.exe Explorer.EXE PID 908 set thread context of 1228 908 RegAsm.exe Explorer.EXE PID 1264 set thread context of 1480 1264 Quotation.exe RegAsm.exe PID 1480 set thread context of 1228 1480 RegAsm.exe Explorer.EXE PID 1932 set thread context of 1580 1932 Quotation.exe RegAsm.exe PID 1580 set thread context of 1228 1580 RegAsm.exe Explorer.EXE PID 1684 set thread context of 1492 1684 Quotation.exe RegAsm.exe PID 1492 set thread context of 1228 1492 RegAsm.exe Explorer.EXE PID 1044 set thread context of 1816 1044 Quotation.exe RegAsm.exe PID 1816 set thread context of 1228 1816 RegAsm.exe Explorer.EXE PID 1580 set thread context of 1228 1580 RegAsm.exe Explorer.EXE PID 1484 set thread context of 1564 1484 Quotation.exe RegAsm.exe PID 1564 set thread context of 1228 1564 RegAsm.exe Explorer.EXE PID 1492 set thread context of 1228 1492 RegAsm.exe Explorer.EXE PID 924 set thread context of 2044 924 Quotation.exe RegAsm.exe PID 2044 set thread context of 1228 2044 RegAsm.exe Explorer.EXE PID 816 set thread context of 296 816 Quotation.exe RegAsm.exe PID 296 set thread context of 1228 296 RegAsm.exe Explorer.EXE PID 1552 set thread context of 656 1552 Quotation.exe RegAsm.exe PID 656 set thread context of 1228 656 RegAsm.exe Explorer.EXE PID 2044 set thread context of 1228 2044 RegAsm.exe Explorer.EXE PID 324 set thread context of 1896 324 Quotation.exe RegAsm.exe PID 1896 set thread context of 1228 1896 RegAsm.exe Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 188 IoCs
Processes:
Quotation.exeRegAsm.exeQuotation.exeRegAsm.exehelp.exeQuotation.exeRegAsm.exeexplorer.exeQuotation.exeRegAsm.exerundll32.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.execmd.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exewuapp.exeQuotation.exeRegAsm.exerundll32.exehelp.exeQuotation.exehelp.exeRegAsm.execontrol.exeQuotation.exeRegAsm.exesvchost.exeQuotation.exeRegAsm.execolorcpl.exeQuotation.exeRegAsm.execmd.exeQuotation.exeRegAsm.exeNETSTAT.EXEQuotation.exeRegAsm.exemstsc.exeQuotation.exeRegAsm.exehelp.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.exeQuotation.exeRegAsm.execscript.exeQuotation.exeRegAsm.exewininit.exeQuotation.exeRegAsm.exemstsc.exewuapp.exesvchost.exeQuotation.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 1464 Quotation.exe Token: SeDebugPrivilege 904 RegAsm.exe Token: SeDebugPrivilege 532 Quotation.exe Token: SeDebugPrivilege 732 RegAsm.exe Token: SeDebugPrivilege 1032 help.exe Token: SeDebugPrivilege 1676 Quotation.exe Token: SeDebugPrivilege 1884 RegAsm.exe Token: SeDebugPrivilege 1768 explorer.exe Token: SeDebugPrivilege 1892 Quotation.exe Token: SeDebugPrivilege 1824 RegAsm.exe Token: SeDebugPrivilege 1840 rundll32.exe Token: SeDebugPrivilege 1732 Quotation.exe Token: SeDebugPrivilege 1652 RegAsm.exe Token: SeDebugPrivilege 1992 Quotation.exe Token: SeDebugPrivilege 1056 RegAsm.exe Token: SeDebugPrivilege 1960 cmd.exe Token: SeDebugPrivilege 2008 Quotation.exe Token: SeDebugPrivilege 1332 RegAsm.exe Token: SeDebugPrivilege 1472 Quotation.exe Token: SeDebugPrivilege 576 RegAsm.exe Token: SeDebugPrivilege 1700 wuapp.exe Token: SeDebugPrivilege 1028 Quotation.exe Token: SeDebugPrivilege 1692 RegAsm.exe Token: SeDebugPrivilege 1908 rundll32.exe Token: SeDebugPrivilege 1600 help.exe Token: SeDebugPrivilege 1816 Quotation.exe Token: SeDebugPrivilege 1660 help.exe Token: SeDebugPrivilege 620 RegAsm.exe Token: SeDebugPrivilege 1748 control.exe Token: SeDebugPrivilege 1632 Quotation.exe Token: SeDebugPrivilege 1112 RegAsm.exe Token: SeDebugPrivilege 2032 svchost.exe Token: SeDebugPrivilege 1016 Quotation.exe Token: SeDebugPrivilege 884 RegAsm.exe Token: SeDebugPrivilege 1956 colorcpl.exe Token: SeDebugPrivilege 740 Quotation.exe Token: SeDebugPrivilege 1036 RegAsm.exe Token: SeDebugPrivilege 1836 cmd.exe Token: SeDebugPrivilege 1896 Quotation.exe Token: SeDebugPrivilege 784 RegAsm.exe Token: SeDebugPrivilege 1996 NETSTAT.EXE Token: SeDebugPrivilege 1828 Quotation.exe Token: SeDebugPrivilege 1388 RegAsm.exe Token: SeDebugPrivilege 1556 mstsc.exe Token: SeDebugPrivilege 1764 Quotation.exe Token: SeDebugPrivilege 320 RegAsm.exe Token: SeDebugPrivilege 1560 help.exe Token: SeDebugPrivilege 548 Quotation.exe Token: SeDebugPrivilege 908 RegAsm.exe Token: SeDebugPrivilege 1952 Quotation.exe Token: SeDebugPrivilege 1904 RegAsm.exe Token: SeDebugPrivilege 1040 Quotation.exe Token: SeDebugPrivilege 1192 RegAsm.exe Token: SeDebugPrivilege 292 cscript.exe Token: SeDebugPrivilege 1264 Quotation.exe Token: SeDebugPrivilege 1480 RegAsm.exe Token: SeDebugPrivilege 1016 wininit.exe Token: SeDebugPrivilege 1932 Quotation.exe Token: SeDebugPrivilege 1580 RegAsm.exe Token: SeDebugPrivilege 2036 mstsc.exe Token: SeDebugPrivilege 816 wuapp.exe Token: SeDebugPrivilege 1640 svchost.exe Token: SeDebugPrivilege 1684 Quotation.exe Token: SeDebugPrivilege 1492 RegAsm.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
chkdsk.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Suspicious use of WriteProcessMemory 1101 IoCs
Processes:
Quotation.exeExplorer.EXEQuotation.exehelp.exeQuotation.exeQuotation.exedescription pid process target process PID 1464 wrote to memory of 308 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 308 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 904 1464 Quotation.exe RegAsm.exe PID 1464 wrote to memory of 532 1464 Quotation.exe Quotation.exe PID 1464 wrote to memory of 532 1464 Quotation.exe Quotation.exe PID 1464 wrote to memory of 532 1464 Quotation.exe Quotation.exe PID 1464 wrote to memory of 532 1464 Quotation.exe Quotation.exe PID 1228 wrote to memory of 1032 1228 Explorer.EXE help.exe PID 1228 wrote to memory of 1032 1228 Explorer.EXE help.exe PID 1228 wrote to memory of 1032 1228 Explorer.EXE help.exe PID 1228 wrote to memory of 1032 1228 Explorer.EXE help.exe PID 532 wrote to memory of 732 532 Quotation.exe RegAsm.exe PID 532 wrote to memory of 732 532 Quotation.exe RegAsm.exe PID 532 wrote to memory of 732 532 Quotation.exe RegAsm.exe PID 532 wrote to memory of 732 532 Quotation.exe RegAsm.exe PID 532 wrote to memory of 732 532 Quotation.exe RegAsm.exe PID 532 wrote to memory of 732 532 Quotation.exe RegAsm.exe PID 532 wrote to memory of 732 532 Quotation.exe RegAsm.exe PID 532 wrote to memory of 732 532 Quotation.exe RegAsm.exe PID 532 wrote to memory of 1676 532 Quotation.exe Quotation.exe PID 532 wrote to memory of 1676 532 Quotation.exe Quotation.exe PID 532 wrote to memory of 1676 532 Quotation.exe Quotation.exe PID 532 wrote to memory of 1676 532 Quotation.exe Quotation.exe PID 1228 wrote to memory of 1768 1228 Explorer.EXE explorer.exe PID 1228 wrote to memory of 1768 1228 Explorer.EXE explorer.exe PID 1228 wrote to memory of 1768 1228 Explorer.EXE explorer.exe PID 1228 wrote to memory of 1768 1228 Explorer.EXE explorer.exe PID 1032 wrote to memory of 1384 1032 help.exe cmd.exe PID 1032 wrote to memory of 1384 1032 help.exe cmd.exe PID 1032 wrote to memory of 1384 1032 help.exe cmd.exe PID 1032 wrote to memory of 1384 1032 help.exe cmd.exe PID 1676 wrote to memory of 1884 1676 Quotation.exe RegAsm.exe PID 1676 wrote to memory of 1884 1676 Quotation.exe RegAsm.exe PID 1676 wrote to memory of 1884 1676 Quotation.exe RegAsm.exe PID 1676 wrote to memory of 1884 1676 Quotation.exe RegAsm.exe PID 1676 wrote to memory of 1884 1676 Quotation.exe RegAsm.exe PID 1676 wrote to memory of 1884 1676 Quotation.exe RegAsm.exe PID 1676 wrote to memory of 1884 1676 Quotation.exe RegAsm.exe PID 1676 wrote to memory of 1884 1676 Quotation.exe RegAsm.exe PID 1676 wrote to memory of 1892 1676 Quotation.exe Quotation.exe PID 1676 wrote to memory of 1892 1676 Quotation.exe Quotation.exe PID 1676 wrote to memory of 1892 1676 Quotation.exe Quotation.exe PID 1676 wrote to memory of 1892 1676 Quotation.exe Quotation.exe PID 1228 wrote to memory of 1840 1228 Explorer.EXE rundll32.exe PID 1228 wrote to memory of 1840 1228 Explorer.EXE rundll32.exe PID 1228 wrote to memory of 1840 1228 Explorer.EXE rundll32.exe PID 1228 wrote to memory of 1840 1228 Explorer.EXE rundll32.exe PID 1228 wrote to memory of 1840 1228 Explorer.EXE rundll32.exe PID 1228 wrote to memory of 1840 1228 Explorer.EXE rundll32.exe PID 1228 wrote to memory of 1840 1228 Explorer.EXE rundll32.exe PID 1892 wrote to memory of 1824 1892 Quotation.exe RegAsm.exe PID 1892 wrote to memory of 1824 1892 Quotation.exe RegAsm.exe -
Suspicious behavior: EnumeratesProcesses 15410 IoCs
Processes:
Quotation.exepid process 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe 1464 Quotation.exe -
Processes:
Explorer.EXEdescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Checks whether UAC is enabled
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"3⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"4⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"5⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"6⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"7⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"8⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"9⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"10⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"11⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"12⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"13⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"14⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"15⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"16⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"17⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"18⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"19⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"18⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"20⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"22⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"24⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"25⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"24⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"25⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"25⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"26⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"26⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"27⤵
- Suspicious use of SetThreadContext
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"28⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"28⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"28⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"27⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"28⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"28⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"29⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"29⤵
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"30⤵
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"30⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"31⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"31⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"32⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"32⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"33⤵
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"33⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"34⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"34⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"35⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"35⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"36⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"36⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"37⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"37⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"38⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"38⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"39⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"39⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"40⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"40⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"41⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"41⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"42⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"42⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"43⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"43⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"44⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"44⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"45⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"45⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"46⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"46⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"47⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"47⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"48⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"48⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"49⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"49⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"50⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"50⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"51⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"51⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"52⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"52⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"53⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"53⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"54⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"54⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"55⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"55⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"56⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"56⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"57⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"57⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"58⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"58⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"59⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"59⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"60⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"60⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"61⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"61⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"62⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"62⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"63⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"63⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"64⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"64⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"65⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"65⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"66⤵
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"66⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"3⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\SysWOW64\rundll32.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
-
C:\Windows\SysWOW64\cmmon32.exe"C:\Windows\SysWOW64\cmmon32.exe"2⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Enumerates system info in registry
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\autochk.exe"C:\Windows\SysWOW64\autochk.exe"2⤵
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
-
C:\Windows\SysWOW64\NAPSTAT.EXE"C:\Windows\SysWOW64\NAPSTAT.EXE"2⤵
-
C:\Windows\SysWOW64\wininit.exe"C:\Windows\SysWOW64\wininit.exe"2⤵
-
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"2⤵
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
-
C:\Windows\SysWOW64\wscript.exe"C:\Windows\SysWOW64\wscript.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\autoconv.exe"C:\Windows\SysWOW64\autoconv.exe"2⤵
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/292-90-0x0000000000000000-mapping.dmp
-
memory/292-91-0x0000000000860000-0x0000000000882000-memory.dmpFilesize
136KB
-
memory/296-125-0x000000000041E2C0-mapping.dmp
-
memory/320-77-0x000000000041E2C0-mapping.dmp
-
memory/324-130-0x0000000000000000-mapping.dmp
-
memory/404-187-0x0000000000000000-mapping.dmp
-
memory/404-239-0x0000000000000000-mapping.dmp
-
memory/472-172-0x000000000041E2C0-mapping.dmp
-
memory/532-2-0x0000000000000000-mapping.dmp
-
memory/548-206-0x0000000000000000-mapping.dmp
-
memory/548-78-0x0000000000000000-mapping.dmp
-
memory/548-207-0x0000000000E30000-0x0000000000E38000-memory.dmpFilesize
32KB
-
memory/568-194-0x000000000041E2C0-mapping.dmp
-
memory/576-33-0x000000000041E2C0-mapping.dmp
-
memory/580-137-0x0000000000000000-mapping.dmp
-
memory/620-47-0x000000000041E2C0-mapping.dmp
-
memory/656-129-0x000000000041E2C0-mapping.dmp
-
memory/732-4-0x000000000041E2C0-mapping.dmp
-
memory/740-58-0x0000000000000000-mapping.dmp
-
memory/760-251-0x0000000000000000-mapping.dmp
-
memory/784-67-0x000000000041E2C0-mapping.dmp
-
memory/788-148-0x000000000041E2C0-mapping.dmp
-
memory/816-103-0x0000000000F00000-0x0000000000F0B000-memory.dmpFilesize
44KB
-
memory/816-158-0x000000000041E2C0-mapping.dmp
-
memory/816-121-0x0000000000000000-mapping.dmp
-
memory/816-102-0x0000000000000000-mapping.dmp
-
memory/852-266-0x0000000000000000-mapping.dmp
-
memory/884-57-0x000000000041E2C0-mapping.dmp
-
memory/904-1-0x000000000041E2C0-mapping.dmp
-
memory/904-0-0x0000000000400000-0x000000000042D000-memory.dmpFilesize
180KB
-
memory/908-82-0x000000000041E2C0-mapping.dmp
-
memory/924-116-0x0000000000000000-mapping.dmp
-
memory/924-146-0x0000000000340000-0x000000000034B000-memory.dmpFilesize
44KB
-
memory/924-145-0x0000000000000000-mapping.dmp
-
memory/964-267-0x0000000000000000-mapping.dmp
-
memory/964-268-0x00000000005A0000-0x00000000005A7000-memory.dmpFilesize
28KB
-
memory/1016-95-0x0000000000000000-mapping.dmp
-
memory/1016-53-0x0000000000000000-mapping.dmp
-
memory/1016-96-0x0000000000D80000-0x0000000000D9A000-memory.dmpFilesize
104KB
-
memory/1028-328-0x000000000041E2C0-mapping.dmp
-
memory/1028-218-0x0000000000000000-mapping.dmp
-
memory/1028-34-0x0000000000000000-mapping.dmp
-
memory/1032-7-0x00000000009C0000-0x00000000009C6000-memory.dmpFilesize
24KB
-
memory/1032-23-0x00000000018B0000-0x0000000001A32000-memory.dmpFilesize
1.5MB
-
memory/1032-6-0x0000000000000000-mapping.dmp
-
memory/1036-62-0x000000000041E2C0-mapping.dmp
-
memory/1040-173-0x0000000000000000-mapping.dmp
-
memory/1040-86-0x0000000000000000-mapping.dmp
-
memory/1040-232-0x000000000041E2C0-mapping.dmp
-
memory/1044-108-0x0000000000000000-mapping.dmp
-
memory/1044-142-0x000000000041E2C0-mapping.dmp
-
memory/1056-25-0x000000000041E2C0-mapping.dmp
-
memory/1084-205-0x0000000000000000-mapping.dmp
-
memory/1108-191-0x0000000000000000-mapping.dmp
-
memory/1108-192-0x0000000000110000-0x0000000000128000-memory.dmpFilesize
96KB
-
memory/1112-52-0x000000000041E2C0-mapping.dmp
-
memory/1128-245-0x0000000000000000-mapping.dmp
-
memory/1128-246-0x0000000001300000-0x000000000131B000-memory.dmpFilesize
108KB
-
memory/1132-253-0x00000000006C0000-0x00000000006D8000-memory.dmpFilesize
96KB
-
memory/1132-252-0x0000000000000000-mapping.dmp
-
memory/1148-139-0x0000000000000000-mapping.dmp
-
memory/1148-140-0x0000000000490000-0x00000000004A8000-memory.dmpFilesize
96KB
-
memory/1160-177-0x0000000000000000-mapping.dmp
-
memory/1192-88-0x000000000041E2C0-mapping.dmp
-
memory/1212-201-0x0000000000000000-mapping.dmp
-
memory/1212-258-0x0000000000820000-0x0000000000838000-memory.dmpFilesize
96KB
-
memory/1212-257-0x0000000000000000-mapping.dmp
-
memory/1220-165-0x000000000041E2C0-mapping.dmp
-
memory/1224-204-0x000000000041E2C0-mapping.dmp
-
memory/1228-22-0x0000000007270000-0x0000000007340000-memory.dmpFilesize
832KB
-
memory/1228-113-0x0000000009C20000-0x0000000009D78000-memory.dmpFilesize
1.3MB
-
memory/1228-294-0x000000000D510000-0x000000000D686000-memory.dmpFilesize
1.5MB
-
memory/1228-302-0x000000000D780000-0x000000000D928000-memory.dmpFilesize
1.7MB
-
memory/1228-190-0x000000000B530000-0x000000000B625000-memory.dmpFilesize
980KB
-
memory/1228-317-0x000000000DA30000-0x000000000DB68000-memory.dmpFilesize
1.2MB
-
memory/1228-290-0x000000000D430000-0x000000000D503000-memory.dmpFilesize
844KB
-
memory/1228-197-0x000000000B630000-0x000000000B785000-memory.dmpFilesize
1.3MB
-
memory/1228-184-0x000000000B440000-0x000000000B52F000-memory.dmpFilesize
956KB
-
memory/1228-284-0x000000000D210000-0x000000000D2C4000-memory.dmpFilesize
720KB
-
memory/1228-138-0x000000000A3F0000-0x000000000A581000-memory.dmpFilesize
1.6MB
-
memory/1228-174-0x000000000B100000-0x000000000B238000-memory.dmpFilesize
1.2MB
-
memory/1228-275-0x000000000CC00000-0x000000000CD71000-memory.dmpFilesize
1.4MB
-
memory/1228-202-0x000000000B8F0000-0x000000000BA7F000-memory.dmpFilesize
1.6MB
-
memory/1228-144-0x000000000A590000-0x000000000A73C000-memory.dmpFilesize
1.7MB
-
memory/1228-323-0x000000000DB70000-0x000000000DC6A000-memory.dmpFilesize
1000KB
-
memory/1228-171-0x000000000AF90000-0x000000000B0F7000-memory.dmpFilesize
1.4MB
-
memory/1228-236-0x000000000BFE0000-0x000000000C0F4000-memory.dmpFilesize
1.1MB
-
memory/1228-109-0x0000000005E40000-0x0000000005F10000-memory.dmpFilesize
832KB
-
memory/1228-211-0x000000000BB40000-0x000000000BC24000-memory.dmpFilesize
912KB
-
memory/1228-167-0x000000000AE30000-0x000000000AF8F000-memory.dmpFilesize
1.4MB
-
memory/1228-163-0x000000000AC60000-0x000000000AD31000-memory.dmpFilesize
836KB
-
memory/1248-229-0x000000000041E2C0-mapping.dmp
-
memory/1264-89-0x0000000000000000-mapping.dmp
-
memory/1276-212-0x0000000000000000-mapping.dmp
-
memory/1332-30-0x000000000041E2C0-mapping.dmp
-
memory/1340-176-0x000000000041E2C0-mapping.dmp
-
memory/1348-143-0x0000000000000000-mapping.dmp
-
memory/1352-227-0x0000000000A90000-0x0000000000AD6000-memory.dmpFilesize
280KB
-
memory/1352-226-0x0000000000000000-mapping.dmp
-
memory/1356-155-0x000000000041E2C0-mapping.dmp
-
memory/1376-243-0x000000000041E2C0-mapping.dmp
-
memory/1384-8-0x0000000000000000-mapping.dmp
-
memory/1388-72-0x000000000041E2C0-mapping.dmp
-
memory/1424-161-0x000000000041E2C0-mapping.dmp
-
memory/1432-219-0x0000000000000000-mapping.dmp
-
memory/1456-244-0x0000000000000000-mapping.dmp
-
memory/1456-225-0x0000000000000000-mapping.dmp
-
memory/1456-270-0x000000000041E2C0-mapping.dmp
-
memory/1464-235-0x0000000000330000-0x0000000000335000-memory.dmpFilesize
20KB
-
memory/1464-166-0x0000000000000000-mapping.dmp
-
memory/1464-234-0x0000000000000000-mapping.dmp
-
memory/1472-168-0x0000000000000000-mapping.dmp
-
memory/1472-169-0x0000000000970000-0x0000000000BF1000-memory.dmpFilesize
2.5MB
-
memory/1472-31-0x0000000000000000-mapping.dmp
-
memory/1480-93-0x000000000041E2C0-mapping.dmp
-
memory/1484-112-0x0000000000000000-mapping.dmp
-
memory/1484-188-0x0000000000000000-mapping.dmp
-
memory/1484-189-0x00000000008A0000-0x00000000008B4000-memory.dmpFilesize
80KB
-
memory/1488-241-0x0000000000F90000-0x0000000000FAA000-memory.dmpFilesize
104KB
-
memory/1488-240-0x0000000000000000-mapping.dmp
-
memory/1492-107-0x000000000041E2C0-mapping.dmp
-
memory/1500-179-0x0000000000BF0000-0x0000000000BFD000-memory.dmpFilesize
52KB
-
memory/1500-178-0x0000000000000000-mapping.dmp
-
memory/1516-329-0x0000000000000000-mapping.dmp
-
memory/1516-230-0x0000000000000000-mapping.dmp
-
memory/1532-210-0x0000000000000000-mapping.dmp
-
memory/1544-250-0x000000000041E2C0-mapping.dmp
-
memory/1552-334-0x0000000000000000-mapping.dmp
-
memory/1552-126-0x0000000000000000-mapping.dmp
-
memory/1556-74-0x0000000000000000-mapping.dmp
-
memory/1556-75-0x0000000000090000-0x0000000000194000-memory.dmpFilesize
1.0MB
-
memory/1560-80-0x00000000009C0000-0x00000000009C6000-memory.dmpFilesize
24KB
-
memory/1560-79-0x0000000000000000-mapping.dmp
-
memory/1564-115-0x000000000041E2C0-mapping.dmp
-
memory/1572-153-0x000000004A260000-0x000000004A2AC000-memory.dmpFilesize
304KB
-
memory/1572-152-0x0000000000000000-mapping.dmp
-
memory/1580-98-0x000000000041E2C0-mapping.dmp
-
memory/1600-42-0x0000000000000000-mapping.dmp
-
memory/1616-122-0x0000000000000000-mapping.dmp
-
memory/1616-123-0x0000000000850000-0x0000000000864000-memory.dmpFilesize
80KB
-
memory/1632-48-0x0000000000000000-mapping.dmp
-
memory/1640-104-0x0000000000000000-mapping.dmp
-
memory/1640-105-0x00000000004A0000-0x00000000004A8000-memory.dmpFilesize
32KB
-
memory/1644-156-0x0000000000000000-mapping.dmp
-
memory/1652-20-0x000000000041E2C0-mapping.dmp
-
memory/1660-44-0x0000000000000000-mapping.dmp
-
memory/1660-45-0x00000000009C0000-0x00000000009C6000-memory.dmpFilesize
24KB
-
memory/1664-209-0x000000000041E2C0-mapping.dmp
-
memory/1676-5-0x0000000000000000-mapping.dmp
-
memory/1676-238-0x000000000041E2C0-mapping.dmp
-
memory/1684-224-0x000000000041E2C0-mapping.dmp
-
memory/1684-99-0x0000000000000000-mapping.dmp
-
memory/1688-261-0x0000000000000000-mapping.dmp
-
memory/1692-38-0x000000000041E2C0-mapping.dmp
-
memory/1700-35-0x0000000000000000-mapping.dmp
-
memory/1700-36-0x0000000000A10000-0x0000000000A1B000-memory.dmpFilesize
44KB
-
memory/1732-255-0x000000000041E2C0-mapping.dmp
-
memory/1732-16-0x0000000000000000-mapping.dmp
-
memory/1748-49-0x0000000000000000-mapping.dmp
-
memory/1748-50-0x0000000000260000-0x000000000027F000-memory.dmpFilesize
124KB
-
memory/1752-262-0x0000000000000000-mapping.dmp
-
memory/1752-263-0x0000000000870000-0x0000000000884000-memory.dmpFilesize
80KB
-
memory/1756-195-0x0000000000000000-mapping.dmp
-
memory/1756-221-0x0000000000000000-mapping.dmp
-
memory/1756-222-0x000000004A520000-0x000000004A56C000-memory.dmpFilesize
304KB
-
memory/1764-73-0x0000000000000000-mapping.dmp
-
memory/1768-13-0x0000000000AB0000-0x0000000000D31000-memory.dmpFilesize
2.5MB
-
memory/1768-12-0x0000000000000000-mapping.dmp
-
memory/1784-233-0x0000000000000000-mapping.dmp
-
memory/1784-149-0x0000000000000000-mapping.dmp
-
memory/1784-265-0x000000000041E2C0-mapping.dmp
-
memory/1788-118-0x00000000002D0000-0x0000000000316000-memory.dmpFilesize
280KB
-
memory/1788-117-0x0000000000000000-mapping.dmp
-
memory/1812-200-0x000000000041E2C0-mapping.dmp
-
memory/1816-39-0x0000000000000000-mapping.dmp
-
memory/1816-111-0x000000000041E2C0-mapping.dmp
-
memory/1824-15-0x000000000041E2C0-mapping.dmp
-
memory/1828-68-0x0000000000000000-mapping.dmp
-
memory/1836-64-0x0000000000000000-mapping.dmp
-
memory/1836-65-0x000000004AB10000-0x000000004AB5C000-memory.dmpFilesize
304KB
-
memory/1840-18-0x0000000000020000-0x000000000002E000-memory.dmpFilesize
56KB
-
memory/1840-17-0x0000000000000000-mapping.dmp
-
memory/1852-336-0x0000000000840000-0x0000000000866000-memory.dmpFilesize
152KB
-
memory/1852-335-0x0000000000000000-mapping.dmp
-
memory/1876-183-0x00000000007B0000-0x00000000008B4000-memory.dmpFilesize
1.0MB
-
memory/1876-182-0x0000000000000000-mapping.dmp
-
memory/1884-10-0x000000000041E2C0-mapping.dmp
-
memory/1888-150-0x0000000000000000-mapping.dmp
-
memory/1888-151-0x0000000000900000-0x000000000090D000-memory.dmpFilesize
52KB
-
memory/1892-186-0x000000000041E2C0-mapping.dmp
-
memory/1892-11-0x0000000000000000-mapping.dmp
-
memory/1896-63-0x0000000000000000-mapping.dmp
-
memory/1896-136-0x000000000041E2C0-mapping.dmp
-
memory/1900-132-0x00000000008C0000-0x00000000008D4000-memory.dmpFilesize
80KB
-
memory/1900-131-0x0000000000000000-mapping.dmp
-
memory/1904-85-0x000000000041E2C0-mapping.dmp
-
memory/1908-40-0x0000000000000000-mapping.dmp
-
memory/1908-41-0x0000000000100000-0x000000000010E000-memory.dmpFilesize
56KB
-
memory/1912-217-0x000000000041E2C0-mapping.dmp
-
memory/1916-271-0x0000000000000000-mapping.dmp
-
memory/1928-162-0x0000000000000000-mapping.dmp
-
memory/1932-94-0x0000000000000000-mapping.dmp
-
memory/1936-256-0x0000000000000000-mapping.dmp
-
memory/1940-198-0x0000000000C10000-0x0000000000C1D000-memory.dmpFilesize
52KB
-
memory/1940-196-0x0000000000000000-mapping.dmp
-
memory/1944-159-0x0000000000000000-mapping.dmp
-
memory/1944-181-0x0000000000C60000-0x0000000000C7C000-memory.dmpFilesize
112KB
-
memory/1944-180-0x0000000000000000-mapping.dmp
-
memory/1952-133-0x0000000000000000-mapping.dmp
-
memory/1952-83-0x0000000000000000-mapping.dmp
-
memory/1952-134-0x0000000000E60000-0x0000000000E65000-memory.dmpFilesize
20KB
-
memory/1956-60-0x00000000007E0000-0x00000000007F8000-memory.dmpFilesize
96KB
-
memory/1956-59-0x0000000000000000-mapping.dmp
-
memory/1960-27-0x0000000000000000-mapping.dmp
-
memory/1960-28-0x000000004AB70000-0x000000004ABBC000-memory.dmpFilesize
304KB
-
memory/1988-214-0x0000000000000000-mapping.dmp
-
memory/1988-215-0x0000000000F40000-0x0000000000F5B000-memory.dmpFilesize
108KB
-
memory/1992-21-0x0000000000000000-mapping.dmp
-
memory/1992-247-0x0000000000000000-mapping.dmp
-
memory/1992-248-0x0000000000910000-0x0000000000918000-memory.dmpFilesize
32KB
-
memory/1996-70-0x0000000000E30000-0x0000000000E39000-memory.dmpFilesize
36KB
-
memory/1996-69-0x0000000000000000-mapping.dmp
-
memory/2008-26-0x0000000000000000-mapping.dmp
-
memory/2012-260-0x000000000041E2C0-mapping.dmp
-
memory/2032-55-0x0000000000B20000-0x0000000000B28000-memory.dmpFilesize
32KB
-
memory/2032-54-0x0000000000000000-mapping.dmp
-
memory/2036-100-0x0000000000000000-mapping.dmp
-
memory/2036-101-0x0000000000110000-0x0000000000214000-memory.dmpFilesize
1.0MB
-
memory/2044-120-0x000000000041E2C0-mapping.dmp
-
memory/2052-273-0x000000000041E2C0-mapping.dmp
-
memory/2080-274-0x0000000000000000-mapping.dmp
-
memory/2252-333-0x000000000041E2C0-mapping.dmp
-
memory/2256-282-0x0000000000000000-mapping.dmp
-
memory/2256-283-0x0000000000510000-0x0000000000532000-memory.dmpFilesize
136KB
-
memory/2264-277-0x000000000041E2C0-mapping.dmp
-
memory/2292-278-0x0000000000000000-mapping.dmp
-
memory/2332-288-0x0000000000000000-mapping.dmp
-
memory/2332-289-0x0000000000B20000-0x0000000000B36000-memory.dmpFilesize
88KB
-
memory/2340-280-0x000000000041E2C0-mapping.dmp
-
memory/2368-281-0x0000000000000000-mapping.dmp
-
memory/2428-296-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/2428-295-0x0000000000000000-mapping.dmp
-
memory/2436-286-0x000000000041E2C0-mapping.dmp
-
memory/2464-287-0x0000000000000000-mapping.dmp
-
memory/2504-298-0x0000000000060000-0x000000000007A000-memory.dmpFilesize
104KB
-
memory/2504-297-0x0000000000000000-mapping.dmp
-
memory/2524-292-0x000000000041E2C0-mapping.dmp
-
memory/2532-303-0x0000000000000000-mapping.dmp
-
memory/2532-304-0x00000000002E0000-0x00000000002F6000-memory.dmpFilesize
88KB
-
memory/2560-293-0x0000000000000000-mapping.dmp
-
memory/2600-306-0x0000000000A40000-0x0000000000A4B000-memory.dmpFilesize
44KB
-
memory/2600-305-0x0000000000000000-mapping.dmp
-
memory/2640-300-0x000000000041E2C0-mapping.dmp
-
memory/2652-311-0x0000000000BB0000-0x0000000000BB9000-memory.dmpFilesize
36KB
-
memory/2652-310-0x0000000000000000-mapping.dmp
-
memory/2676-301-0x0000000000000000-mapping.dmp
-
memory/2716-313-0x0000000000FB0000-0x0000000000FC4000-memory.dmpFilesize
80KB
-
memory/2716-312-0x0000000000000000-mapping.dmp
-
memory/2748-308-0x000000000041E2C0-mapping.dmp
-
memory/2776-309-0x0000000000000000-mapping.dmp
-
memory/2812-319-0x0000000000CE0000-0x0000000000CFC000-memory.dmpFilesize
112KB
-
memory/2812-318-0x0000000000000000-mapping.dmp
-
memory/2844-315-0x000000000041E2C0-mapping.dmp
-
memory/2872-316-0x0000000000000000-mapping.dmp
-
memory/2928-321-0x000000000041E2C0-mapping.dmp
-
memory/2956-322-0x0000000000000000-mapping.dmp
-
memory/3000-325-0x000000000041E2C0-mapping.dmp
-
memory/3028-326-0x0000000000000000-mapping.dmp
-
memory/3064-330-0x0000000000000000-mapping.dmp
-
memory/3064-331-0x00000000009C0000-0x00000000009C8000-memory.dmpFilesize
32KB