Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    10-07-2020 05:46

General

  • Target

    Quotation.exe

  • Size

    233KB

  • MD5

    560be75b2b6cfdace7266e5e345f242a

  • SHA1

    0217bcea49f188b04f5d4b2d35c9c2e10be55189

  • SHA256

    9c1501fbd2eb669ccbe4a41e37770191e954e6f0dd3e0a954a0670a91df3917c

  • SHA512

    577e82392b55506580cff192eee0e389f5bc6a3c53939da1aa7fb73985425a2a3d98f6acf2fb6606be1278d6e3a62863a575ea910f27810eb4c7e5d6027b7ed1

Malware Config

Signatures

  • Suspicious use of SetThreadContext 119 IoCs
  • Suspicious use of AdjustPrivilegeToken 179 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run entry to policy start application 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Suspicious use of WriteProcessMemory 630 IoCs
  • Suspicious behavior: MapViewOfSection 251 IoCs
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • System policy modification 1 TTPs 1 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21349 IoCs
  • js 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2952
    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: MapViewOfSection
      • Suspicious behavior: EnumeratesProcesses
      PID:1628
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: MapViewOfSection
        PID:1844
      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • Suspicious behavior: MapViewOfSection
        PID:2052
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious behavior: MapViewOfSection
          PID:2680
        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: MapViewOfSection
          PID:1924
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            5⤵
              PID:3820
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious behavior: MapViewOfSection
              PID:3972
            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              • Suspicious behavior: MapViewOfSection
              PID:3384
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious behavior: MapViewOfSection
                PID:744
              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                6⤵
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                • Suspicious behavior: MapViewOfSection
                PID:1100
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  7⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious behavior: MapViewOfSection
                  PID:1876
                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                  7⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • Suspicious behavior: MapViewOfSection
                  PID:3588
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    8⤵
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious behavior: MapViewOfSection
                    PID:1116
                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                    8⤵
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious behavior: MapViewOfSection
                    PID:3692
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      9⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious behavior: MapViewOfSection
                      PID:1840
                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                      9⤵
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious behavior: MapViewOfSection
                      PID:3248
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        10⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious behavior: MapViewOfSection
                        PID:2968
                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                        10⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious behavior: MapViewOfSection
                        PID:2036
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          11⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious behavior: MapViewOfSection
                          PID:3796
                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                          11⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious behavior: MapViewOfSection
                          PID:2840
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            12⤵
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious behavior: MapViewOfSection
                            PID:3996
                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                            12⤵
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious behavior: MapViewOfSection
                            PID:3384
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              13⤵
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious behavior: MapViewOfSection
                              PID:2216
                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                              13⤵
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious behavior: MapViewOfSection
                              PID:4056
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                14⤵
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious behavior: MapViewOfSection
                                PID:1712
                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                14⤵
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious behavior: MapViewOfSection
                                PID:64
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  15⤵
                                    PID:2684
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    15⤵
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious behavior: MapViewOfSection
                                    PID:2076
                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                    15⤵
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious behavior: MapViewOfSection
                                    PID:3800
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      16⤵
                                        PID:1408
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        16⤵
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious behavior: MapViewOfSection
                                        PID:3648
                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                        16⤵
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious behavior: MapViewOfSection
                                        PID:1436
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          17⤵
                                            PID:2676
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            17⤵
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious behavior: MapViewOfSection
                                            PID:2700
                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                            17⤵
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:1208
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              18⤵
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2808
                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                              18⤵
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3428
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                19⤵
                                                • Suspicious use of SetThreadContext
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1228
                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                19⤵
                                                • Suspicious use of SetThreadContext
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1100
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  20⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2760
                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                  20⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2944
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    21⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:3276
                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                    21⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:3752
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                      22⤵
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2300
                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                      22⤵
                                                      • Suspicious use of SetThreadContext
                                                      PID:1660
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                        23⤵
                                                        • Suspicious use of SetThreadContext
                                                        PID:3852
                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                        23⤵
                                                        • Suspicious use of SetThreadContext
                                                        PID:3928
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                          24⤵
                                                          • Suspicious use of SetThreadContext
                                                          PID:3356
                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                          24⤵
                                                          • Suspicious use of SetThreadContext
                                                          PID:3428
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            25⤵
                                                            • Suspicious use of SetThreadContext
                                                            PID:1404
                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                            25⤵
                                                            • Suspicious use of SetThreadContext
                                                            PID:992
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                              26⤵
                                                              • Suspicious use of SetThreadContext
                                                              PID:1436
                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                              26⤵
                                                              • Suspicious use of SetThreadContext
                                                              PID:1440
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                27⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:2160
                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                27⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:2036
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                  28⤵
                                                                    PID:3632
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    28⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:3868
                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                    28⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:1660
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      29⤵
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:4048
                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                      29⤵
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:4080
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                        30⤵
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:3820
                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                        30⤵
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:4052
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                          31⤵
                                                                          • Suspicious use of SetThreadContext
                                                                          PID:3248
                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                          31⤵
                                                                          • Suspicious use of SetThreadContext
                                                                          PID:2096
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                            32⤵
                                                                              PID:1884
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                              32⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:1560
                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                              32⤵
                                                                                PID:4056
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                  33⤵
                                                                                    PID:2532
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                    33⤵
                                                                                      PID:3612
                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                      33⤵
                                                                                        PID:2512
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                          34⤵
                                                                                            PID:3384
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                            34⤵
                                                                                              PID:1152
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                              34⤵
                                                                                                PID:2084
                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                34⤵
                                                                                                  PID:3000
                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                    35⤵
                                                                                                      PID:2504
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                      35⤵
                                                                                                        PID:1884
                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                          36⤵
                                                                                                            PID:2496
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                            36⤵
                                                                                                              PID:1456
                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                37⤵
                                                                                                                  PID:3632
                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                  37⤵
                                                                                                                    PID:3384
                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                      38⤵
                                                                                                                        PID:4056
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                        38⤵
                                                                                                                          PID:1396
                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                            39⤵
                                                                                                                              PID:2512
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                              39⤵
                                                                                                                                PID:2684
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                  40⤵
                                                                                                                                    PID:3588
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                    40⤵
                                                                                                                                      PID:3872
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                      40⤵
                                                                                                                                        PID:2948
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                          41⤵
                                                                                                                                            PID:1652
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                            41⤵
                                                                                                                                              PID:4032
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                42⤵
                                                                                                                                                  PID:3604
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                  42⤵
                                                                                                                                                    PID:3544
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                      43⤵
                                                                                                                                                        PID:1152
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                        43⤵
                                                                                                                                                          PID:3588
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                          43⤵
                                                                                                                                                            PID:3876
                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                              44⤵
                                                                                                                                                                PID:1332
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                44⤵
                                                                                                                                                                  PID:3272
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                    45⤵
                                                                                                                                                                      PID:3644
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                      45⤵
                                                                                                                                                                        PID:3836
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                        45⤵
                                                                                                                                                                          PID:3924
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                            46⤵
                                                                                                                                                                              PID:736
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                              46⤵
                                                                                                                                                                                PID:2036
                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                  47⤵
                                                                                                                                                                                    PID:1440
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                    47⤵
                                                                                                                                                                                      PID:1660
                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                        48⤵
                                                                                                                                                                                          PID:3832
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                          48⤵
                                                                                                                                                                                            PID:2040
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                              49⤵
                                                                                                                                                                                                PID:3912
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                49⤵
                                                                                                                                                                                                  PID:3876
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                      PID:2784
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                        PID:3692
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                            PID:1688
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                              PID:3544
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                52⤵
                                                                                                                                                                                                                  PID:3948
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                    PID:2532
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                      53⤵
                                                                                                                                                                                                                        PID:2672
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                          PID:1632
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                            54⤵
                                                                                                                                                                                                                              PID:3692
                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                                PID:1100
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                  PID:3368
                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                    55⤵
                                                                                                                                                                                                                                      PID:4032
                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                        PID:3324
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                        55⤵
                                                                                                                                                                                                                                          PID:1720
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                          55⤵
                                                                                                                                                                                                                                            PID:4172
                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                              56⤵
                                                                                                                                                                                                                                                PID:4224
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                56⤵
                                                                                                                                                                                                                                                  PID:4272
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                    57⤵
                                                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                      57⤵
                                                                                                                                                                                                                                                        PID:4336
                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                        57⤵
                                                                                                                                                                                                                                                          PID:4344
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                          57⤵
                                                                                                                                                                                                                                                            PID:4392
                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                              58⤵
                                                                                                                                                                                                                                                                PID:4456
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                58⤵
                                                                                                                                                                                                                                                                  PID:4504
                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                    59⤵
                                                                                                                                                                                                                                                                      PID:4568
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                      59⤵
                                                                                                                                                                                                                                                                        PID:4616
                                                                                                                                                    • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                      "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                      2⤵
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      • Adds Run entry to policy start application
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                      • System policy modification
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      PID:1648
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:3860
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2804
                                                                                                                                                          • C:\Program Files\Mozilla Firefox\Firefox.exe
                                                                                                                                                            "C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3792
                                                                                                                                                          • C:\Windows\SysWOW64\help.exe
                                                                                                                                                            "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3816
                                                                                                                                                          • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                            "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                            PID:3624
                                                                                                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1404
                                                                                                                                                            • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                              "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:1396
                                                                                                                                                              • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:1436
                                                                                                                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1440
                                                                                                                                                                  • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                    "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:2036
                                                                                                                                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:996
                                                                                                                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:1208
                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:1188
                                                                                                                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:1300
                                                                                                                                                                            • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                              "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1168
                                                                                                                                                                              • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:3748
                                                                                                                                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:3752
                                                                                                                                                                                  • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:1376
                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:4044
                                                                                                                                                                                  • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                    "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:1532
                                                                                                                                                                                  • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:2064
                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:1300
                                                                                                                                                                                  • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:3908
                                                                                                                                                                                  • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:2768
                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:3228
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:3584
                                                                                                                                                                                  • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                    "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:3044
                                                                                                                                                                                  • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                    PID:1980
                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:2036
                                                                                                                                                                                    • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                      "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:3760
                                                                                                                                                                                    • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                      "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:3132
                                                                                                                                                                                    • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                      "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:4004
                                                                                                                                                                                    • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                      "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:3824
                                                                                                                                                                                    • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                      "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                      PID:740
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                      "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:1772
                                                                                                                                                                                      • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                                                        "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:496
                                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:1416
                                                                                                                                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1216
                                                                                                                                                                                            • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                              "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:2944
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                "C:\Windows\SysWOW64\cmd.exe"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:3652
                                                                                                                                                                                                • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:2012
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                    "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1724
                                                                                                                                                                                                    • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                      "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1408
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                        "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1752
                                                                                                                                                                                                        • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                                          "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:3756
                                                                                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:2780
                                                                                                                                                                                                            • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:2860
                                                                                                                                                                                                              • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                                                "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:1372
                                                                                                                                                                                                                • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                                                  "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:3684
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                    "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:3804
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1188
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                        "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:3428
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:3596
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                            "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:2880
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:3244
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                                                                                                "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:1600
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:3736
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:3420
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                                      PID:2676
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:1152
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:756
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                          PID:1448
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:3928
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1168
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1016
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:2052
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:60
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1660
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:3008
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:4164
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\mstsc.exe
                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\mstsc.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:4320
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:4424
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • Enumerates system info in registry
                                                                                                                                                                                                                                                              PID:4540
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:4648

                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                            • memory/60-339-0x0000000000B40000-0x0000000000B56000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                            • memory/60-338-0x0000000000B40000-0x0000000000B56000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                            • memory/496-140-0x0000000000CF0000-0x0000000000D0F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                            • memory/496-141-0x0000000000CF0000-0x0000000000D0F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                            • memory/740-127-0x00000000011C0000-0x00000000011E0000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                                            • memory/740-128-0x00000000011C0000-0x00000000011E0000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                                            • memory/756-298-0x0000000000310000-0x000000000031B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/756-297-0x0000000000310000-0x000000000031B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/1016-322-0x00000000011C0000-0x00000000011E0000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                                            • memory/1016-323-0x00000000011C0000-0x00000000011E0000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              128KB

                                                                                                                                                                                                                                                            • memory/1152-291-0x00000000000D0000-0x00000000000D7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              28KB

                                                                                                                                                                                                                                                            • memory/1152-292-0x00000000000D0000-0x00000000000D7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              28KB

                                                                                                                                                                                                                                                            • memory/1168-316-0x0000000001360000-0x0000000001377000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                                            • memory/1168-317-0x0000000001360000-0x0000000001377000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                                            • memory/1188-235-0x0000000001210000-0x000000000121B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/1188-234-0x0000000001210000-0x000000000121B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/1300-55-0x0000000001250000-0x000000000168F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4.2MB

                                                                                                                                                                                                                                                            • memory/1300-54-0x0000000001250000-0x000000000168F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4.2MB

                                                                                                                                                                                                                                                            • memory/1372-215-0x0000000000B40000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                            • memory/1372-216-0x0000000000B40000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                            • memory/1376-32-0x0000000000C10000-0x0000000000C1C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/1376-33-0x0000000000C10000-0x0000000000C1C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/1408-180-0x00000000000D0000-0x00000000000D7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              28KB

                                                                                                                                                                                                                                                            • memory/1408-179-0x00000000000D0000-0x00000000000D7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              28KB

                                                                                                                                                                                                                                                            • memory/1448-304-0x0000000000F10000-0x0000000000F1A000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                            • memory/1448-303-0x0000000000F10000-0x0000000000F1A000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                            • memory/1532-41-0x0000000000310000-0x000000000031B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/1532-42-0x0000000000310000-0x000000000031B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/1600-267-0x0000000000CF0000-0x0000000000D0F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                            • memory/1600-266-0x0000000000CF0000-0x0000000000D0F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                            • memory/1648-8-0x0000000000F10000-0x0000000000F1A000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                            • memory/1648-7-0x0000000000F10000-0x0000000000F1A000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                            • memory/1648-27-0x00000000062F0000-0x0000000006477000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.5MB

                                                                                                                                                                                                                                                            • memory/1660-344-0x0000000000B40000-0x0000000000B56000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                            • memory/1660-343-0x0000000000B40000-0x0000000000B56000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                            • memory/1724-172-0x00000000002D0000-0x00000000002F7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                            • memory/1724-173-0x00000000002D0000-0x00000000002F7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                            • memory/1752-186-0x0000000000B40000-0x0000000000B56000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                            • memory/1752-185-0x0000000000B40000-0x0000000000B56000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                            • memory/1772-133-0x0000000000970000-0x000000000097C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/1772-134-0x0000000000970000-0x000000000097C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/1844-0-0x0000000000400000-0x000000000042D000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              180KB

                                                                                                                                                                                                                                                            • memory/1980-93-0x0000000001250000-0x000000000168F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4.2MB

                                                                                                                                                                                                                                                            • memory/1980-94-0x0000000001250000-0x000000000168F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4.2MB

                                                                                                                                                                                                                                                            • memory/2012-170-0x0000000000F40000-0x0000000000F52000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                            • memory/2012-169-0x0000000000F40000-0x0000000000F52000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                            • memory/2052-332-0x0000000001250000-0x000000000168F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4.2MB

                                                                                                                                                                                                                                                            • memory/2052-331-0x0000000001250000-0x000000000168F000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              4.2MB

                                                                                                                                                                                                                                                            • memory/2064-48-0x00000000008C0000-0x00000000008D9000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                            • memory/2064-47-0x00000000008C0000-0x00000000008D9000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              100KB

                                                                                                                                                                                                                                                            • memory/2676-285-0x0000000000F10000-0x0000000000F1A000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                            • memory/2676-286-0x0000000000F10000-0x0000000000F1A000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                            • memory/2768-69-0x0000000001210000-0x000000000121B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/2768-68-0x0000000001210000-0x000000000121B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/2780-198-0x00000000000C0000-0x00000000000D3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              76KB

                                                                                                                                                                                                                                                            • memory/2780-203-0x00000000000C0000-0x00000000000D3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              76KB

                                                                                                                                                                                                                                                            • memory/2860-209-0x0000000001210000-0x000000000121B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/2860-210-0x0000000001210000-0x000000000121B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/2880-253-0x0000000000970000-0x000000000097C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/2880-252-0x0000000000970000-0x000000000097C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/2944-160-0x0000000000830000-0x00000000009A3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                            • memory/2944-159-0x0000000000830000-0x00000000009A3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                            • memory/2952-257-0x000000000BFA0000-0x000000000C0C7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                            • memory/2952-271-0x000000000C220000-0x000000000C2F6000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              856KB

                                                                                                                                                                                                                                                            • memory/2952-308-0x000000000C850000-0x000000000C9A9000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                            • memory/2952-264-0x000000000C0D0000-0x000000000C212000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                            • memory/2952-190-0x000000000B590000-0x000000000B675000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              916KB

                                                                                                                                                                                                                                                            • memory/2952-365-0x000000000D500000-0x000000000D656000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                            • memory/2952-138-0x0000000008730000-0x0000000008819000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              932KB

                                                                                                                                                                                                                                                            • memory/2952-123-0x0000000009960000-0x0000000009AFF000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                            • memory/2952-20-0x0000000005740000-0x000000000584B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.0MB

                                                                                                                                                                                                                                                            • memory/2952-333-0x000000000CE50000-0x000000000CF12000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              776KB

                                                                                                                                                                                                                                                            • memory/2952-59-0x0000000007380000-0x00000000074BC000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                            • memory/2952-167-0x00000000092B0000-0x00000000093A6000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              984KB

                                                                                                                                                                                                                                                            • memory/2952-52-0x0000000007230000-0x0000000007372000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                            • memory/2952-153-0x000000000A100000-0x000000000A2A7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.7MB

                                                                                                                                                                                                                                                            • memory/2952-157-0x000000000AE90000-0x000000000AFD3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.3MB

                                                                                                                                                                                                                                                            • memory/2952-66-0x0000000006D80000-0x0000000006E6A000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              936KB

                                                                                                                                                                                                                                                            • memory/2952-226-0x000000000BAD0000-0x000000000BBA4000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              848KB

                                                                                                                                                                                                                                                            • memory/2952-91-0x00000000097B0000-0x0000000009951000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                            • memory/2952-116-0x0000000008F30000-0x000000000908E000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                            • memory/2952-177-0x000000000B170000-0x000000000B28E000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.1MB

                                                                                                                                                                                                                                                            • memory/2952-345-0x000000000D0C0000-0x000000000D25B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.6MB

                                                                                                                                                                                                                                                            • memory/2952-13-0x0000000005610000-0x0000000005739000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.2MB

                                                                                                                                                                                                                                                            • memory/3008-349-0x00000000002D0000-0x00000000002F7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                            • memory/3008-348-0x00000000002D0000-0x00000000002F7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                            • memory/3044-87-0x0000000000310000-0x000000000031B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/3044-86-0x0000000000310000-0x000000000031B000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              44KB

                                                                                                                                                                                                                                                            • memory/3132-105-0x0000000000020000-0x0000000000047000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                            • memory/3132-106-0x0000000000020000-0x0000000000047000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                            • memory/3228-74-0x00000000000C0000-0x00000000000D3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              76KB

                                                                                                                                                                                                                                                            • memory/3228-75-0x00000000000C0000-0x00000000000D3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              76KB

                                                                                                                                                                                                                                                            • memory/3244-260-0x00000000002D0000-0x00000000002F7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                            • memory/3244-259-0x00000000002D0000-0x00000000002F7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              156KB

                                                                                                                                                                                                                                                            • memory/3420-280-0x0000000001360000-0x0000000001377000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                                            • memory/3420-279-0x0000000001360000-0x0000000001377000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                                            • memory/3428-241-0x0000000000970000-0x000000000097C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/3428-240-0x0000000000970000-0x000000000097C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/3584-81-0x0000000000B40000-0x0000000000B56000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                            • memory/3584-80-0x0000000000B40000-0x0000000000B56000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                            • memory/3596-247-0x0000000000F40000-0x0000000000F52000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                            • memory/3596-246-0x0000000000F40000-0x0000000000F52000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              72KB

                                                                                                                                                                                                                                                            • memory/3624-22-0x0000000000F10000-0x0000000000F1A000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                            • memory/3624-23-0x0000000000F10000-0x0000000000F1A000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                            • memory/3652-162-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              356KB

                                                                                                                                                                                                                                                            • memory/3652-163-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              356KB

                                                                                                                                                                                                                                                            • memory/3684-222-0x0000000000830000-0x00000000009A3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                            • memory/3684-221-0x0000000000830000-0x00000000009A3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                            • memory/3736-273-0x0000000001360000-0x0000000001377000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                                            • memory/3736-274-0x0000000001360000-0x0000000001377000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              92KB

                                                                                                                                                                                                                                                            • memory/3756-193-0x0000000000B40000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                            • memory/3756-192-0x0000000000B40000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                            • memory/3760-100-0x0000000000C10000-0x0000000000C1C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/3760-99-0x0000000000C10000-0x0000000000C1C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/3792-145-0x00007FF688500000-0x00007FF688593000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              588KB

                                                                                                                                                                                                                                                            • memory/3792-144-0x00007FF688500000-0x00007FF688593000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              588KB

                                                                                                                                                                                                                                                            • memory/3792-146-0x00007FF688500000-0x00007FF688593000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              588KB

                                                                                                                                                                                                                                                            • memory/3804-228-0x0000000000970000-0x000000000097C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/3804-229-0x0000000000970000-0x000000000097C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              48KB

                                                                                                                                                                                                                                                            • memory/3816-16-0x00000000000D0000-0x00000000000D7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              28KB

                                                                                                                                                                                                                                                            • memory/3816-15-0x00000000000D0000-0x00000000000D7000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              28KB

                                                                                                                                                                                                                                                            • memory/3824-118-0x0000000000830000-0x00000000009A3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                            • memory/3824-119-0x0000000000830000-0x00000000009A3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              1.4MB

                                                                                                                                                                                                                                                            • memory/3908-61-0x0000000001350000-0x000000000136E000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                            • memory/3908-62-0x0000000001350000-0x000000000136E000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                            • memory/3928-311-0x0000000000B40000-0x0000000000B56000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                            • memory/3928-310-0x0000000000B40000-0x0000000000B56000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              88KB

                                                                                                                                                                                                                                                            • memory/4004-112-0x0000000000B40000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                            • memory/4004-111-0x0000000000B40000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                            • memory/4044-39-0x0000000001350000-0x000000000136E000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                            • memory/4044-38-0x0000000001350000-0x000000000136E000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              120KB

                                                                                                                                                                                                                                                            • memory/4164-354-0x00000000000C0000-0x00000000000D3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              76KB

                                                                                                                                                                                                                                                            • memory/4164-355-0x00000000000C0000-0x00000000000D3000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              76KB

                                                                                                                                                                                                                                                            • memory/4320-360-0x0000000001230000-0x000000000152C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              3.0MB

                                                                                                                                                                                                                                                            • memory/4320-361-0x0000000001230000-0x000000000152C000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              3.0MB

                                                                                                                                                                                                                                                            • memory/4424-368-0x0000000000B40000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                            • memory/4424-367-0x0000000000B40000-0x0000000000B46000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              24KB

                                                                                                                                                                                                                                                            • memory/4540-373-0x0000000000F10000-0x0000000000F1A000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              40KB

                                                                                                                                                                                                                                                            • memory/4540-374-0x0000000000F10000-0x0000000000F1A000-memory.dmp

                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                              40KB