Overview

overview

10

Static

static

SCAN-QMJ20...-1.exe

windows7_x64

10

SCAN-QMJ20...-1.exe

windows10_x64

8

Analysis

  • max time kernel
    150s
  • max time network
    143s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    11/07/2020, 06:11

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SCAN-QMJ201706001-1.exe
  • Size 786KB
  • Sample200711-cye6dlwm2e
  • SHA256 4c1fe4c0f5d8d1277036802c83df3e083b31318dfc2c194ce93b7169d7ba6e3d
  • MD5 SHA1 SHA512
Score
8/10
persistencespyware

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 1742 IoCs
  • Suspicious use of WriteProcessMemory 195 IoCs
  • Suspicious behavior: MapViewOfSection 70 IoCs
  • Suspicious use of AdjustPrivilegeToken 97 IoCs
  • js 2 IoCs
  • Adds Run entry to policy start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 37 IoCs
  • Drops file in Program Files directory 1 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spyware
  • Enumerates system info in registry 2 TTPs 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of AdjustPrivilegeToken
    PID:2976
    • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
      "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetThreadContext
      PID:3888
      • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
        "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetThreadContext
        PID:3948
      • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
        "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 3948 66062
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4028
        • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
          "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetThreadContext
          PID:3828
          • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
            "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
            5⤵
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetThreadContext
            PID:1736
          • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
            "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 1736 74078
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3364
            • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
              "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetThreadContext
              PID:3760
              • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                7⤵
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetThreadContext
                PID:4048
              • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 4048 81953
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:3996
                • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                  "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetThreadContext
                  PID:1948
                  • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                    "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                    9⤵
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of SetThreadContext
                    PID:2896
                  • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                    "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 2896 95875
                    9⤵
                    • Suspicious use of WriteProcessMemory
                    PID:964
                    • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                      "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetThreadContext
                      PID:1240
                      • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                        "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                        11⤵
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetThreadContext
                        PID:1600
                      • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                        "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 1600 110218
                        11⤵
                          PID:1760
                          • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                            "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                            12⤵
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of SetThreadContext
                            PID:1488
                            • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                              "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                              13⤵
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of SetThreadContext
                              PID:2148
                            • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                              "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 2148 118328
                              13⤵
                                PID:2164
                                • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                  "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                  14⤵
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetThreadContext
                                  PID:3032
                                  • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                    15⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SetThreadContext
                                    PID:3996
                                  • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                    "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 3996 126156
                                    15⤵
                                      PID:2724
                                      • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                        "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                        16⤵
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of SetThreadContext
                                        PID:968
                                        • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                          "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                          17⤵
                                          • Suspicious behavior: MapViewOfSection
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of SetThreadContext
                                          PID:3732
                                        • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                          "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 3732 140031
                                          17⤵
                                            PID:412
                                            • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                              "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                              18⤵
                                              • Suspicious behavior: MapViewOfSection
                                              • Suspicious use of SetThreadContext
                                              PID:3884
                                              • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                19⤵
                                                • Suspicious behavior: MapViewOfSection
                                                • Suspicious use of AdjustPrivilegeToken
                                                • Suspicious use of SetThreadContext
                                                PID:2080
                                              • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 2080 147953
                                                19⤵
                                                  PID:1448
                                                  • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                    20⤵
                                                    • Suspicious behavior: MapViewOfSection
                                                    • Suspicious use of SetThreadContext
                                                    PID:1632
                                                    • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                      21⤵
                                                      • Suspicious behavior: MapViewOfSection
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      • Suspicious use of SetThreadContext
                                                      PID:1472
                                                    • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 1472 155921
                                                      21⤵
                                                        PID:1784
                                                        • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                          22⤵
                                                          • Suspicious behavior: MapViewOfSection
                                                          • Suspicious use of SetThreadContext
                                                          PID:2160
                                                          • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                            23⤵
                                                            • Suspicious behavior: MapViewOfSection
                                                            • Suspicious use of SetThreadContext
                                                            PID:2152
                                                          • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 2152 163703
                                                            23⤵
                                                              PID:3164
                                                              • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                                24⤵
                                                                • Suspicious behavior: MapViewOfSection
                                                                • Suspicious use of SetThreadContext
                                                                PID:1312
                                                                • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                                  25⤵
                                                                  • Suspicious behavior: MapViewOfSection
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:1272
                                                                • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 1272 171562
                                                                  25⤵
                                                                    PID:3468
                                                                    • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                                      26⤵
                                                                      • Suspicious behavior: MapViewOfSection
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:2224
                                                                      • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                                        27⤵
                                                                        • Suspicious behavior: MapViewOfSection
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:2172
                                                                      • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 2172 185531
                                                                        27⤵
                                                                          PID:2456
                                                                          • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                                            28⤵
                                                                            • Suspicious behavior: MapViewOfSection
                                                                            • Suspicious use of SetThreadContext
                                                                            PID:3616
                                                                            • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                                              29⤵
                                                                              • Suspicious behavior: MapViewOfSection
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:3920
                                                                            • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 3920 193468
                                                                              29⤵
                                                                                PID:3976
                                                                                • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                                  "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                                                  30⤵
                                                                                  • Suspicious use of SetThreadContext
                                                                                  PID:4040
                                                                                  • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                                                    31⤵
                                                                                    • Suspicious use of SetThreadContext
                                                                                    PID:968
                                                                                  • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 968 201234
                                                                                    31⤵
                                                                                      PID:408
                                                                                      • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                                                        32⤵
                                                                                        • Suspicious use of SetThreadContext
                                                                                        PID:1384
                                                                                        • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                                                                          33⤵
                                                                                          • Suspicious use of SetThreadContext
                                                                                          PID:2128
                                                                                        • C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe" 2 2128 209203
                                                                                          33⤵
                                                                                            PID:1776
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\SysWOW64\cmd.exe"
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of AdjustPrivilegeToken
                              • Adds Run entry to policy start application
                              • Suspicious use of SetThreadContext
                              • Drops file in Program Files directory
                              • System policy modification
                              • Modifies Internet Explorer settings
                              PID:3860
                              • C:\Windows\SysWOW64\cmd.exe
                                /c del "C:\Users\Admin\AppData\Local\Temp\SCAN-QMJ201706001-1.exe"
                                3⤵
                                  PID:3324
                                • C:\Windows\SysWOW64\cmd.exe
                                  /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
                                  3⤵
                                    PID:992
                                  • C:\Program Files\Mozilla Firefox\Firefox.exe
                                    "C:\Program Files\Mozilla Firefox\Firefox.exe"
                                    3⤵
                                      PID:1200
                                  • C:\Windows\SysWOW64\raserver.exe
                                    "C:\Windows\SysWOW64\raserver.exe"
                                    2⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2488
                                  • C:\Windows\SysWOW64\cmstp.exe
                                    "C:\Windows\SysWOW64\cmstp.exe"
                                    2⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3060
                                  • C:\Windows\SysWOW64\autochk.exe
                                    "C:\Windows\SysWOW64\autochk.exe"
                                    2⤵
                                      PID:1796
                                    • C:\Windows\SysWOW64\autochk.exe
                                      "C:\Windows\SysWOW64\autochk.exe"
                                      2⤵
                                        PID:968
                                      • C:\Windows\SysWOW64\autochk.exe
                                        "C:\Windows\SysWOW64\autochk.exe"
                                        2⤵
                                          PID:3696
                                        • C:\Windows\SysWOW64\autochk.exe
                                          "C:\Windows\SysWOW64\autochk.exe"
                                          2⤵
                                            PID:3744
                                          • C:\Windows\SysWOW64\autochk.exe
                                            "C:\Windows\SysWOW64\autochk.exe"
                                            2⤵
                                              PID:3732
                                            • C:\Windows\SysWOW64\autochk.exe
                                              "C:\Windows\SysWOW64\autochk.exe"
                                              2⤵
                                                PID:3728
                                              • C:\Windows\SysWOW64\autochk.exe
                                                "C:\Windows\SysWOW64\autochk.exe"
                                                2⤵
                                                  PID:412
                                                • C:\Windows\SysWOW64\autochk.exe
                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                  2⤵
                                                    PID:488
                                                  • C:\Windows\SysWOW64\mstsc.exe
                                                    "C:\Windows\SysWOW64\mstsc.exe"
                                                    2⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:624
                                                  • C:\Windows\SysWOW64\msiexec.exe
                                                    "C:\Windows\SysWOW64\msiexec.exe"
                                                    2⤵
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1840
                                                  • C:\Windows\SysWOW64\autoconv.exe
                                                    "C:\Windows\SysWOW64\autoconv.exe"
                                                    2⤵
                                                      PID:2696
                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                      2⤵
                                                        PID:2708
                                                      • C:\Windows\SysWOW64\wlanext.exe
                                                        "C:\Windows\SysWOW64\wlanext.exe"
                                                        2⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2764
                                                      • C:\Windows\SysWOW64\chkdsk.exe
                                                        "C:\Windows\SysWOW64\chkdsk.exe"
                                                        2⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Enumerates system info in registry
                                                        PID:1012
                                                      • C:\Windows\SysWOW64\wscript.exe
                                                        "C:\Windows\SysWOW64\wscript.exe"
                                                        2⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:880
                                                      • C:\Windows\SysWOW64\wlanext.exe
                                                        "C:\Windows\SysWOW64\wlanext.exe"
                                                        2⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1400
                                                      • C:\Windows\SysWOW64\msiexec.exe
                                                        "C:\Windows\SysWOW64\msiexec.exe"
                                                        2⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:2144
                                                      • C:\Windows\SysWOW64\cmmon32.exe
                                                        "C:\Windows\SysWOW64\cmmon32.exe"
                                                        2⤵
                                                          PID:3368
                                                        • C:\Windows\SysWOW64\colorcpl.exe
                                                          "C:\Windows\SysWOW64\colorcpl.exe"
                                                          2⤵
                                                            PID:3712
                                                          • C:\Windows\SysWOW64\cmstp.exe
                                                            "C:\Windows\SysWOW64\cmstp.exe"
                                                            2⤵
                                                              PID:2364
                                                            • C:\Windows\SysWOW64\ipconfig.exe
                                                              "C:\Windows\SysWOW64\ipconfig.exe"
                                                              2⤵
                                                                PID:2724
                                                              • C:\Windows\SysWOW64\msdt.exe
                                                                "C:\Windows\SysWOW64\msdt.exe"
                                                                2⤵
                                                                  PID:1228
                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                  2⤵
                                                                    PID:3812
                                                                  • C:\Windows\SysWOW64\autoconv.exe
                                                                    "C:\Windows\SysWOW64\autoconv.exe"
                                                                    2⤵
                                                                      PID:552
                                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                                      2⤵
                                                                        PID:1852
                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                        2⤵
                                                                          PID:1856
                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                          2⤵
                                                                            PID:1604
                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                            2⤵
                                                                              PID:2096
                                                                            • C:\Windows\SysWOW64\autoconv.exe
                                                                              "C:\Windows\SysWOW64\autoconv.exe"
                                                                              2⤵
                                                                                PID:2076
                                                                              • C:\Windows\SysWOW64\autoconv.exe
                                                                                "C:\Windows\SysWOW64\autoconv.exe"
                                                                                2⤵
                                                                                  PID:2120
                                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                                  2⤵
                                                                                    PID:2136

                                                                                Network

                                                                                      MITRE ATT&CK Enterprise v6

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      memory/624-33-0x0000000000110000-0x000000000040C000-memory.dmp
                                                                                      Download

                                                                                      memory/624-31-0x0000000000110000-0x000000000040C000-memory.dmp
                                                                                      Download

                                                                                      memory/880-71-0x00000000001D0000-0x00000000001F7000-memory.dmp
                                                                                      Download

                                                                                      memory/880-72-0x00000000001D0000-0x00000000001F7000-memory.dmp
                                                                                      Download

                                                                                      memory/1012-64-0x0000000000AD0000-0x0000000000ADA000-memory.dmp
                                                                                      Download

                                                                                      memory/1012-63-0x0000000000AD0000-0x0000000000ADA000-memory.dmp
                                                                                      Download

                                                                                      memory/1200-37-0x00007FF7D67B0000-0x00007FF7D6843000-memory.dmp
                                                                                      Download

                                                                                      memory/1200-40-0x00007FF7D67B0000-0x00007FF7D6843000-memory.dmp
                                                                                      Download

                                                                                      memory/1200-36-0x00007FF7D67B0000-0x00007FF7D6843000-memory.dmp
                                                                                      Download

                                                                                      memory/1228-125-0x0000000000DD0000-0x0000000000F43000-memory.dmp
                                                                                      Download

                                                                                      memory/1228-127-0x0000000000DD0000-0x0000000000F43000-memory.dmp
                                                                                      Download

                                                                                      memory/1400-80-0x0000000000240000-0x0000000000257000-memory.dmp
                                                                                      Download

                                                                                      memory/1400-79-0x0000000000240000-0x0000000000257000-memory.dmp
                                                                                      Download

                                                                                      memory/1840-45-0x00000000003E0000-0x00000000003F2000-memory.dmp
                                                                                      Download

                                                                                      memory/1840-43-0x00000000003E0000-0x00000000003F2000-memory.dmp
                                                                                      Download

                                                                                      memory/2144-86-0x00000000003E0000-0x00000000003F2000-memory.dmp
                                                                                      Download

                                                                                      memory/2144-88-0x00000000003E0000-0x00000000003F2000-memory.dmp
                                                                                      Download

                                                                                      memory/2364-110-0x0000000001050000-0x0000000001066000-memory.dmp
                                                                                      Download

                                                                                      memory/2364-111-0x0000000001050000-0x0000000001066000-memory.dmp
                                                                                      Download

                                                                                      memory/2488-13-0x0000000001050000-0x000000000106F000-memory.dmp
                                                                                      Download

                                                                                      memory/2488-12-0x0000000001050000-0x000000000106F000-memory.dmp
                                                                                      Download

                                                                                      memory/2724-119-0x0000000000C00000-0x0000000000C0B000-memory.dmp
                                                                                      Download

                                                                                      memory/2724-117-0x0000000000C00000-0x0000000000C0B000-memory.dmp
                                                                                      Download

                                                                                      memory/2764-51-0x0000000000240000-0x0000000000257000-memory.dmp
                                                                                      Download

                                                                                      memory/2764-52-0x0000000000240000-0x0000000000257000-memory.dmp
                                                                                      Download

                                                                                      memory/2976-69-0x0000000006B30000-0x0000000006CA1000-memory.dmp
                                                                                      Download

                                                                                      memory/2976-77-0x0000000008F50000-0x00000000090F0000-memory.dmp
                                                                                      Download

                                                                                      memory/2976-131-0x00000000092C0000-0x00000000093E3000-memory.dmp
                                                                                      Download

                                                                                      memory/2976-99-0x00000000073C0000-0x00000000074B1000-memory.dmp
                                                                                      Download

                                                                                      memory/2976-123-0x00000000091D0000-0x00000000092BD000-memory.dmp
                                                                                      Download

                                                                                      memory/3060-22-0x0000000001050000-0x0000000001066000-memory.dmp
                                                                                      Download

                                                                                      memory/3060-20-0x0000000001050000-0x0000000001066000-memory.dmp
                                                                                      Download

                                                                                      memory/3368-95-0x0000000000F90000-0x0000000000F9C000-memory.dmp
                                                                                      Download

                                                                                      memory/3368-93-0x0000000000F90000-0x0000000000F9C000-memory.dmp
                                                                                      Download

                                                                                      memory/3712-102-0x0000000000E60000-0x0000000000E79000-memory.dmp
                                                                                      Download

                                                                                      memory/3712-104-0x0000000000E60000-0x0000000000E79000-memory.dmp
                                                                                      Download

                                                                                      memory/3860-34-0x0000000006710000-0x00000000067F7000-memory.dmp
                                                                                      Download

                                                                                      memory/3860-4-0x0000000001290000-0x00000000012E9000-memory.dmp
                                                                                      Download

                                                                                      memory/3860-5-0x0000000001290000-0x00000000012E9000-memory.dmp
                                                                                      Download

                                                                                      memory/3948-0-0x0000000000400000-0x000000000042D000-memory.dmp
                                                                                      Download