Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    20/07/2020, 07:41

General

  • Target
    Quotation.exe
  • Size 268KB
  • Sample200720-rm13dez2sn
  • SHA256 a492b017c3e12fe55493c562ed1304155616cb61b24f6dce0bfcd3eb7a7bdaf5
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • Suspicious use of WriteProcessMemory 1088 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious behavior: MapViewOfSection 281 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Gathers network information 2 TTPs 6 IoCs

    Uses commandline utility to view network configuration.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 153 IoCs
  • Suspicious use of AdjustPrivilegeToken 186 IoCs
  • Suspicious behavior: EnumeratesProcesses 15507 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    • Checks whether UAC is enabled
    • Suspicious use of SendNotifyMessage
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of AdjustPrivilegeToken
    PID:1324
    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:1072
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:836
      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:316
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:888
          • C:\Windows\SysWOW64\mstsc.exe
            "C:\Windows\SysWOW64\mstsc.exe"
            5⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:612
        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
          4⤵
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          PID:788
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            5⤵
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:1540
          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            PID:1828
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              6⤵
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:1804
            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
              6⤵
              • Suspicious use of WriteProcessMemory
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:1784
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                7⤵
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:1596
              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                7⤵
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:1564
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  8⤵
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1936
                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                  8⤵
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1944
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    9⤵
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2032
                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                    9⤵
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2028
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      10⤵
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:656
                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                      10⤵
                      • Suspicious behavior: MapViewOfSection
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:308
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        11⤵
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1436
                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                        11⤵
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        PID:560
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          12⤵
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1656
                          • C:\Windows\SysWOW64\cmmon32.exe
                            "C:\Windows\SysWOW64\cmmon32.exe"
                            13⤵
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1244
                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                          12⤵
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1396
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            13⤵
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1260
                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                            13⤵
                            • Suspicious behavior: MapViewOfSection
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1960
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              14⤵
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1876
                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                              14⤵
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2024
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                15⤵
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1476
                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                15⤵
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1068
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  16⤵
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1088
                                  • C:\Windows\SysWOW64\colorcpl.exe
                                    "C:\Windows\SysWOW64\colorcpl.exe"
                                    17⤵
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1244
                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                  16⤵
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1864
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    17⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1944
                                    • C:\Windows\SysWOW64\wscript.exe
                                      "C:\Windows\SysWOW64\wscript.exe"
                                      18⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:644
                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                    17⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:1112
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      18⤵
                                      • Suspicious behavior: MapViewOfSection
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1360
                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                      18⤵
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1584
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        19⤵
                                          PID:1952
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          19⤵
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:620
                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                          19⤵
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:560
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            20⤵
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2016
                                            • C:\Windows\SysWOW64\wscript.exe
                                              "C:\Windows\SysWOW64\wscript.exe"
                                              21⤵
                                                PID:540
                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                              20⤵
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:1440
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                21⤵
                                                • Suspicious use of SetThreadContext
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1064
                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                21⤵
                                                • Suspicious use of SetThreadContext
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:1808
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  22⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1904
                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                  22⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:668
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    23⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1800
                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                    23⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:1072
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                      24⤵
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:580
                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                        25⤵
                                                          PID:1884
                                                        • C:\Windows\SysWOW64\cmstp.exe
                                                          "C:\Windows\SysWOW64\cmstp.exe"
                                                          25⤵
                                                            PID:1812
                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                          24⤵
                                                          • Suspicious use of SetThreadContext
                                                          PID:1920
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            25⤵
                                                            • Suspicious use of SetThreadContext
                                                            PID:1556
                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                            25⤵
                                                            • Suspicious use of SetThreadContext
                                                            PID:1376
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                              26⤵
                                                              • Suspicious use of SetThreadContext
                                                              PID:644
                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                              26⤵
                                                              • Suspicious use of SetThreadContext
                                                              PID:1312
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                27⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:1048
                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                27⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:1808
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                  28⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:1928
                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                  28⤵
                                                                    PID:1976
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      29⤵
                                                                        PID:1544
                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                        29⤵
                                                                          PID:1660
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                            30⤵
                                                                              PID:1180
                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                              30⤵
                                                                                PID:1376
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                  31⤵
                                                                                    PID:1356
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                    31⤵
                                                                                      PID:1432
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                        32⤵
                                                                                          PID:840
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                          32⤵
                                                                                            PID:1952
                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                              33⤵
                                                                                                PID:824
                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                33⤵
                                                                                                  PID:1600
                                                                                                  • C:\Windows\SysWOW64\msdt.exe
                                                                                                    "C:\Windows\SysWOW64\msdt.exe"
                                                                                                    34⤵
                                                                                                      PID:296
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                    33⤵
                                                                                                      PID:1832
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                        34⤵
                                                                                                          PID:1660
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                          34⤵
                                                                                                            PID:1840
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                              35⤵
                                                                                                                PID:1572
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                35⤵
                                                                                                                  PID:296
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                    36⤵
                                                                                                                      PID:1884
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                      36⤵
                                                                                                                        PID:1168
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                          37⤵
                                                                                                                            PID:1312
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                            37⤵
                                                                                                                              PID:1788
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                38⤵
                                                                                                                                  PID:1832
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                  38⤵
                                                                                                                                    PID:1112
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                    38⤵
                                                                                                                                      PID:1644
                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                        39⤵
                                                                                                                                          PID:1980
                                                                                                                                          • C:\Windows\SysWOW64\help.exe
                                                                                                                                            "C:\Windows\SysWOW64\help.exe"
                                                                                                                                            40⤵
                                                                                                                                              PID:1536
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                            39⤵
                                                                                                                                              PID:824
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                40⤵
                                                                                                                                                  PID:568
                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                  40⤵
                                                                                                                                                    PID:1168
                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                    40⤵
                                                                                                                                                      PID:1408
                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                        41⤵
                                                                                                                                                          PID:1148
                                                                                                                                                          • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                            "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                            42⤵
                                                                                                                                                              PID:852
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                            41⤵
                                                                                                                                                              PID:1204
                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                42⤵
                                                                                                                                                                  PID:1664
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                  42⤵
                                                                                                                                                                    PID:824
                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                      43⤵
                                                                                                                                                                        PID:792
                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                        43⤵
                                                                                                                                                                          PID:1352
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                          43⤵
                                                                                                                                                                            PID:1040
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                              44⤵
                                                                                                                                                                                PID:528
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                44⤵
                                                                                                                                                                                  PID:540
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                    45⤵
                                                                                                                                                                                      PID:1212
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                      45⤵
                                                                                                                                                                                        PID:1988
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                          46⤵
                                                                                                                                                                                            PID:1788
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                            46⤵
                                                                                                                                                                                              PID:612
                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                47⤵
                                                                                                                                                                                                  PID:1408
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                  47⤵
                                                                                                                                                                                                    PID:1716
                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                        PID:1516
                                                                                                                                                                                                        • C:\Windows\SysWOW64\wininit.exe
                                                                                                                                                                                                          "C:\Windows\SysWOW64\wininit.exe"
                                                                                                                                                                                                          49⤵
                                                                                                                                                                                                            PID:2264
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                            PID:1448
                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                              49⤵
                                                                                                                                                                                                                PID:1692
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                49⤵
                                                                                                                                                                                                                  PID:1072
                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                    50⤵
                                                                                                                                                                                                                      PID:1668
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                        PID:540
                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                          51⤵
                                                                                                                                                                                                                            PID:1716
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                              PID:2024
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                              51⤵
                                                                                                                                                                                                                                PID:824
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                    PID:2084
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                      PID:2112
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                                          PID:2172
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                                                            PID:2204
                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                                                PID:2284
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                  PID:2312
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                    55⤵
                                                                                                                                                                                                                                                      PID:2396
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                                        PID:2424
                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                            PID:2472
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                              PID:2508
                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                57⤵
                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                                                                                    PID:2580
                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                      58⤵
                                                                                                                                                                                                                                                                        PID:2632
                                                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                        58⤵
                                                                                                                                                                                                                                                                          PID:2640
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                          58⤵
                                                                                                                                                                                                                                                                            PID:2668
                                                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                              59⤵
                                                                                                                                                                                                                                                                                PID:2744
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                59⤵
                                                                                                                                                                                                                                                                                  PID:2772
                                                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                    60⤵
                                                                                                                                                                                                                                                                                      PID:2840
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                      60⤵
                                                                                                                                                                                                                                                                                        PID:2868
                                                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                          61⤵
                                                                                                                                                                                                                                                                                            PID:2940
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                            61⤵
                                                                                                                                                                                                                                                                                              PID:2968
                                                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                62⤵
                                                                                                                                                                                                                                                                                                  PID:3016
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                                  62⤵
                                                                                                                                                                                                                                                                                                    PID:3044
                                                                                                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                      63⤵
                                                                                                                                                                                                                                                                                                        PID:2092
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                                        63⤵
                                                                                                                                                                                                                                                                                                          PID:360
                                                                                                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                            64⤵
                                                                                                                                                                                                                                                                                                              PID:2180
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                                              64⤵
                                                                                                                                                                                                                                                                                                                PID:1536
                                                                                                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                                                                  65⤵
                                                                                                                                                                                                                                                                                                                    PID:984
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                                                                    65⤵
                                                                                                                                                                                                                                                                                                                      PID:2292
                                                                                                                                                                                      • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                        "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                        • Drops file in Program Files directory
                                                                                                                                                                                        • Suspicious behavior: MapViewOfSection
                                                                                                                                                                                        • Adds Run key to start application
                                                                                                                                                                                        • Modifies Internet Explorer settings
                                                                                                                                                                                        • Suspicious use of SetThreadContext
                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                        PID:1616
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1128
                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\Firefox.exe
                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:2040
                                                                                                                                                                                          • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:1604
                                                                                                                                                                                          • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:1880
                                                                                                                                                                                          • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:2036
                                                                                                                                                                                          • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:1628
                                                                                                                                                                                          • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:1096
                                                                                                                                                                                          • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                            PID:1712
                                                                                                                                                                                          • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:1788
                                                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1452
                                                                                                                                                                                              • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:1520
                                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:776
                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1052
                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:1112
                                                                                                                                                                                                      • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                        "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:1720
                                                                                                                                                                                                      • C:\Windows\SysWOW64\NAPSTAT.EXE
                                                                                                                                                                                                        "C:\Windows\SysWOW64\NAPSTAT.EXE"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:1996
                                                                                                                                                                                                      • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                        "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:1564
                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:824
                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:1496
                                                                                                                                                                                                          • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1524
                                                                                                                                                                                                            • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:748
                                                                                                                                                                                                            • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:1648
                                                                                                                                                                                                            • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:1836
                                                                                                                                                                                                            • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                              PID:1492
                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:1760
                                                                                                                                                                                                              • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:316
                                                                                                                                                                                                                • C:\Windows\SysWOW64\wininit.exe
                                                                                                                                                                                                                  "C:\Windows\SysWOW64\wininit.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1868
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:1496
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1180
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1452
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1672
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:1988
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1696
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:432
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1440
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:1312
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:268
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:1164
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:1168
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:1668
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:1796
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1908
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1808
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:1452
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:612
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:1844
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:1972
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                            • Gathers network information
                                                                                                                                                                                                                                                            PID:1452
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:1848
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:1244
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:268
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Gathers network information
                                                                                                                                                                                                                                                                  PID:452
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:1808
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:1980
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:2028
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:1072
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:612
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:1212
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1352
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:1704
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1672
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:1560
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:612
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:1644
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:364
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:1788
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:392
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:1444
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:568
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:788
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:1988
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:612
                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                            PID:1644
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                              PID:1040
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                PID:540
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • Gathers network information
                                                                                                                                                                                                                                                                                                                PID:980
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                  PID:1164
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\wuapp.exe
                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\wuapp.exe"
                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                    PID:1772
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                    • Gathers network information
                                                                                                                                                                                                                                                                                                                    PID:1708
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\mstsc.exe
                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\mstsc.exe"
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:1400
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:1040
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                          PID:2052
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                            PID:2060
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                            PID:2068
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:2076
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                PID:2164
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                                                                                                                                                                PID:2252
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:2364
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:2616
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                        PID:2624
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                        • Gathers network information
                                                                                                                                                                                                                                                                                                                                        PID:2712
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                          PID:2736
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\colorcpl.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\colorcpl.exe"
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                            PID:2816
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                              PID:2920
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                PID:2060
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                • Gathers network information
                                                                                                                                                                                                                                                                                                                                                PID:1016
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:2244

                                                                                                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                                                                                                    memory/268-184-0x0000000000C60000-0x0000000000C78000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/296-197-0x0000000000840000-0x0000000000934000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/316-131-0x0000000000420000-0x000000000043F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/432-154-0x0000000000AE0000-0x0000000000AE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/452-192-0x00000000005C0000-0x00000000005CA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/540-125-0x0000000000420000-0x0000000000446000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/612-33-0x00000000007A0000-0x00000000008A4000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/644-107-0x0000000000420000-0x0000000000446000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/836-0-0x0000000000400000-0x000000000042D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/852-239-0x0000000000B90000-0x0000000000B95000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/980-223-0x00000000004B0000-0x00000000004B9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1040-255-0x0000000000CD0000-0x0000000000CE6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1096-42-0x0000000000AC0000-0x0000000000ADB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1164-230-0x00000000008B0000-0x00000000008BE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1244-181-0x00000000003F0000-0x00000000003FE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1244-75-0x00000000004D0000-0x00000000004DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1244-99-0x0000000000810000-0x0000000000828000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-22-0x0000000008C60000-0x0000000008DAE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-157-0x000000000B210000-0x000000000B38E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-68-0x0000000009890000-0x00000000099C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-234-0x00000000043C0000-0x0000000004475000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-331-0x000000000EB80000-0x000000000ECE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-242-0x000000000CEE0000-0x000000000CFE2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-89-0x000000000A170000-0x000000000A311000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-320-0x000000000E970000-0x000000000EA51000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-12-0x0000000007DE0000-0x0000000007F50000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-113-0x000000000A650000-0x000000000A77C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-246-0x000000000CFF0000-0x000000000D17F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-182-0x000000000BA30000-0x000000000BBD3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-307-0x000000000E810000-0x000000000E963000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-205-0x000000000C410000-0x000000000C56E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-86-0x0000000006D2A000-0x0000000006D3A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-304-0x000000000E6E0000-0x000000000E80E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-171-0x000000000B700000-0x000000000B884000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-16-0x0000000007F50000-0x000000000804B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-285-0x000000000DF10000-0x000000000E014000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-56-0x0000000007090000-0x00000000071D2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-259-0x000000000D2E0000-0x000000000D419000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-267-0x000000000D660000-0x000000000D80D000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-129-0x000000000A9E0000-0x000000000AAC7000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-132-0x000000000AAD0000-0x000000000ABAD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1324-263-0x000000000D540000-0x000000000D656000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1400-253-0x0000000000400000-0x0000000000504000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1440-156-0x00000000005B0000-0x00000000005CC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1452-170-0x00000000005A0000-0x00000000005A9000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1492-115-0x0000000000AD0000-0x0000000000ADE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1536-229-0x0000000000FF0000-0x0000000000FF6000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1564-73-0x0000000000670000-0x0000000000686000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1604-21-0x0000000000770000-0x0000000000775000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1616-84-0x00000000761C0000-0x00000000762DD000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1616-83-0x0000000076C90000-0x0000000076C9C000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1616-100-0x00000000041A0000-0x0000000004329000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1616-24-0x0000000003120000-0x0000000003263000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1616-7-0x0000000000420000-0x0000000000446000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1628-40-0x0000000000470000-0x0000000000477000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1648-88-0x0000000000880000-0x000000000089F000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1672-213-0x0000000000780000-0x000000000078E000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1704-204-0x0000000000F80000-0x0000000000F98000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1708-248-0x0000000000D50000-0x0000000000D5A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1712-47-0x0000000000ED0000-0x0000000000EEC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1720-52-0x0000000000FF0000-0x000000000100B000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1760-120-0x0000000000AD0000-0x0000000000ADE000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1772-241-0x0000000000FF0000-0x0000000000FFB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1808-202-0x0000000000EC0000-0x0000000000EDB000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1812-149-0x00000000005A0000-0x00000000005B8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1848-176-0x00000000007A0000-0x00000000007BC000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1868-140-0x0000000000AC0000-0x0000000000ADA000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1880-30-0x0000000000E70000-0x0000000000E77000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1972-165-0x0000000000580000-0x0000000000598000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/1996-67-0x0000000000400000-0x0000000000446000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2036-35-0x0000000000920000-0x0000000000938000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2040-102-0x000000013F830000-0x000000013F8C3000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2060-336-0x0000000000140000-0x0000000000146000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2068-272-0x0000000000350000-0x0000000000357000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2076-277-0x0000000000450000-0x0000000000456000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2164-284-0x00000000005D0000-0x00000000005D8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2252-287-0x0000000000210000-0x0000000000217000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2264-279-0x0000000000B10000-0x0000000000B2A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2364-292-0x00000000006B0000-0x00000000006CF000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2388-296-0x0000000000230000-0x0000000000236000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2616-306-0x0000000000780000-0x00000000007A2000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2624-312-0x0000000000510000-0x0000000000526000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2712-314-0x0000000000500000-0x000000000050A000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2736-319-0x0000000000B20000-0x0000000000B28000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2816-322-0x00000000001E0000-0x00000000001F8000-memory.dmp

                                                                                                                                                                                                                                                                                                                                                    memory/2920-327-0x0000000000550000-0x000000000056F000-memory.dmp