Analysis

  • max time kernel
    150s
  • max time network
    139s
  • platform
    windows10_x64
  • resource
    win10v200430
  • submitted
    20/07/2020, 07:41

General

  • Target
    Quotation.exe
  • Size 268KB
  • Sample200720-rm13dez2sn
  • SHA256 a492b017c3e12fe55493c562ed1304155616cb61b24f6dce0bfcd3eb7a7bdaf5
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • Suspicious behavior: EnumeratesProcesses 20927 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Enumerates system info in registry 2 TTPs 1 IoCs
  • Suspicious use of WriteProcessMemory 619 IoCs
  • Suspicious use of SetThreadContext 117 IoCs
  • Suspicious use of AdjustPrivilegeToken 172 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: MapViewOfSection 246 IoCs
  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • System policy modification 1 TTPs 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of AdjustPrivilegeToken
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: MapViewOfSection
      PID:3912
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: MapViewOfSection
        PID:4004
      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: MapViewOfSection
        PID:424
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:908
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: MapViewOfSection
            PID:988
          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
            4⤵
            • Suspicious use of WriteProcessMemory
            • Suspicious use of SetThreadContext
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: MapViewOfSection
            PID:1520
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious behavior: MapViewOfSection
              PID:2084
            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
              5⤵
              • Suspicious use of WriteProcessMemory
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious behavior: MapViewOfSection
              PID:2728
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                6⤵
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious behavior: MapViewOfSection
                PID:3884
              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                6⤵
                • Suspicious use of WriteProcessMemory
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious behavior: MapViewOfSection
                PID:3952
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  7⤵
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious behavior: MapViewOfSection
                  PID:3572
                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                  7⤵
                  • Suspicious use of WriteProcessMemory
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious behavior: MapViewOfSection
                  PID:504
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    8⤵
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious behavior: MapViewOfSection
                    PID:3736
                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                    8⤵
                    • Suspicious use of WriteProcessMemory
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious behavior: MapViewOfSection
                    PID:620
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      9⤵
                        PID:3160
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        9⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious behavior: MapViewOfSection
                        PID:3688
                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                        9⤵
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious behavior: MapViewOfSection
                        PID:3040
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          10⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious behavior: MapViewOfSection
                          PID:588
                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                          10⤵
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious behavior: MapViewOfSection
                          PID:3876
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            11⤵
                              PID:2164
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              11⤵
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious behavior: MapViewOfSection
                              PID:2308
                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                              11⤵
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious behavior: MapViewOfSection
                              PID:2436
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                12⤵
                                  PID:2636
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  12⤵
                                    PID:3028
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    12⤵
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious behavior: MapViewOfSection
                                    PID:796
                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                    12⤵
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious behavior: MapViewOfSection
                                    PID:3940
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      13⤵
                                        PID:3740
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        13⤵
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious behavior: MapViewOfSection
                                        PID:388
                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                        13⤵
                                        • Suspicious use of SetThreadContext
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious behavior: MapViewOfSection
                                        PID:3888
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          14⤵
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious behavior: MapViewOfSection
                                          PID:3728
                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                          14⤵
                                          • Suspicious use of SetThreadContext
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious behavior: MapViewOfSection
                                          PID:3612
                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                            15⤵
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious behavior: MapViewOfSection
                                            PID:1264
                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                            15⤵
                                            • Suspicious use of SetThreadContext
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious behavior: MapViewOfSection
                                            PID:2148
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              16⤵
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious behavior: MapViewOfSection
                                              PID:2040
                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                              16⤵
                                              • Suspicious use of SetThreadContext
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:2128
                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                17⤵
                                                  PID:3808
                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                  17⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2320
                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                  17⤵
                                                  • Suspicious use of SetThreadContext
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:2976
                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                    18⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:992
                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                    18⤵
                                                    • Suspicious use of SetThreadContext
                                                    • Suspicious use of AdjustPrivilegeToken
                                                    PID:2980
                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                      19⤵
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3464
                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                      19⤵
                                                      • Suspicious use of SetThreadContext
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3744
                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                        20⤵
                                                          PID:2244
                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                          20⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3888
                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                          20⤵
                                                          • Suspicious use of SetThreadContext
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3904
                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                            21⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:1312
                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                            21⤵
                                                            • Suspicious use of SetThreadContext
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:2740
                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                              22⤵
                                                              • Suspicious use of SetThreadContext
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:1316
                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                              22⤵
                                                              • Suspicious use of SetThreadContext
                                                              PID:1560
                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                23⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:2808
                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                23⤵
                                                                • Suspicious use of SetThreadContext
                                                                PID:2128
                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                  24⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:1504
                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                  24⤵
                                                                  • Suspicious use of SetThreadContext
                                                                  PID:3876
                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                    25⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:1104
                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                    25⤵
                                                                    • Suspicious use of SetThreadContext
                                                                    PID:3088
                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                      26⤵
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:2148
                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                      26⤵
                                                                      • Suspicious use of SetThreadContext
                                                                      PID:3988
                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                        27⤵
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:3768
                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                        27⤵
                                                                        • Suspicious use of SetThreadContext
                                                                        PID:1608
                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                          28⤵
                                                                            PID:504
                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                            28⤵
                                                                            • Suspicious use of SetThreadContext
                                                                            PID:3184
                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                            28⤵
                                                                            • Suspicious use of SetThreadContext
                                                                            PID:3040
                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                              29⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:3308
                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                              29⤵
                                                                              • Suspicious use of SetThreadContext
                                                                              PID:2432
                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                30⤵
                                                                                  PID:1020
                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                  30⤵
                                                                                    PID:2232
                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                    30⤵
                                                                                    • Suspicious use of SetThreadContext
                                                                                    PID:3960
                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                    30⤵
                                                                                    • Suspicious use of SetThreadContext
                                                                                    PID:3908
                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                      31⤵
                                                                                        PID:2976
                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                        31⤵
                                                                                          PID:640
                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                          31⤵
                                                                                          • Suspicious use of SetThreadContext
                                                                                          PID:1460
                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                          31⤵
                                                                                          • Suspicious use of SetThreadContext
                                                                                          PID:3408
                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                            32⤵
                                                                                              PID:676
                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                              32⤵
                                                                                                PID:2832
                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                  33⤵
                                                                                                    PID:1156
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                    33⤵
                                                                                                      PID:3804
                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                        34⤵
                                                                                                          PID:2264
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                          34⤵
                                                                                                            PID:3376
                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                              35⤵
                                                                                                                PID:3904
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                35⤵
                                                                                                                  PID:640
                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                    36⤵
                                                                                                                      PID:3808
                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                      36⤵
                                                                                                                        PID:1004
                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                          37⤵
                                                                                                                            PID:3084
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                            37⤵
                                                                                                                              PID:2092
                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                38⤵
                                                                                                                                  PID:1288
                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                  38⤵
                                                                                                                                    PID:2520
                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                    38⤵
                                                                                                                                      PID:688
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                      38⤵
                                                                                                                                        PID:2832
                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                          39⤵
                                                                                                                                            PID:1520
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                            39⤵
                                                                                                                                              PID:3848
                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                40⤵
                                                                                                                                                  PID:1872
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                  40⤵
                                                                                                                                                    PID:3580
                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                      41⤵
                                                                                                                                                        PID:424
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                        41⤵
                                                                                                                                                          PID:1924
                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                            42⤵
                                                                                                                                                              PID:1092
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                              42⤵
                                                                                                                                                                PID:592
                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                  43⤵
                                                                                                                                                                    PID:904
                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                    43⤵
                                                                                                                                                                      PID:4036
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                      43⤵
                                                                                                                                                                        PID:376
                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                          44⤵
                                                                                                                                                                            PID:4080
                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                            44⤵
                                                                                                                                                                              PID:2728
                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                              44⤵
                                                                                                                                                                                PID:3028
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                44⤵
                                                                                                                                                                                  PID:3916
                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                    45⤵
                                                                                                                                                                                      PID:3604
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                      45⤵
                                                                                                                                                                                        PID:1344
                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                          46⤵
                                                                                                                                                                                            PID:2092
                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                            46⤵
                                                                                                                                                                                              PID:3088
                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                              46⤵
                                                                                                                                                                                                PID:3824
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                46⤵
                                                                                                                                                                                                  PID:808
                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                      PID:4080
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                      47⤵
                                                                                                                                                                                                        PID:3844
                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                          48⤵
                                                                                                                                                                                                            PID:620
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                            48⤵
                                                                                                                                                                                                              PID:944
                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                49⤵
                                                                                                                                                                                                                  PID:3088
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                  49⤵
                                                                                                                                                                                                                    PID:2572
                                                                                                                                                                                                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                      50⤵
                                                                                                                                                                                                                        PID:2520
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                        50⤵
                                                                                                                                                                                                                          PID:1344
                                                                                                                                                                                                                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                            51⤵
                                                                                                                                                                                                                              PID:1020
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                              51⤵
                                                                                                                                                                                                                                PID:3836
                                                                                                                                                                                                                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                  52⤵
                                                                                                                                                                                                                                    PID:2164
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                    52⤵
                                                                                                                                                                                                                                      PID:1288
                                                                                                                                                                                                                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                        53⤵
                                                                                                                                                                                                                                          PID:584
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                          53⤵
                                                                                                                                                                                                                                            PID:3644
                                                                                                                                                                                                                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                              54⤵
                                                                                                                                                                                                                                                PID:3992
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                54⤵
                                                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                    55⤵
                                                                                                                                                                                                                                                      PID:3540
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                      55⤵
                                                                                                                                                                                                                                                        PID:1432
                                                                                                                                                                                                                                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                          56⤵
                                                                                                                                                                                                                                                            PID:640
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                            56⤵
                                                                                                                                                                                                                                                              PID:4140
                                                                                                                                                                                                                                                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                                                                                                                                                                                                                                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                                                                                                                                57⤵
                                                                                                                                                                                                                                                                  PID:4208
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\Quotation.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\Quotation.exe"
                                                                                                                                                                                                                                                                  57⤵
                                                                                                                                                                                                                                                                    PID:4256
                                                                                                                                                    • C:\Windows\SysWOW64\control.exe
                                                                                                                                                      "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                      2⤵
                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                      • Suspicious use of SetThreadContext
                                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                      • Adds policy Run key to start application
                                                                                                                                                      • Modifies Internet Explorer settings
                                                                                                                                                      • Suspicious behavior: MapViewOfSection
                                                                                                                                                      • System policy modification
                                                                                                                                                      PID:2020
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:4024
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
                                                                                                                                                          3⤵
                                                                                                                                                            PID:2840
                                                                                                                                                          • C:\Program Files\Mozilla Firefox\Firefox.exe
                                                                                                                                                            "C:\Program Files\Mozilla Firefox\Firefox.exe"
                                                                                                                                                            3⤵
                                                                                                                                                              PID:3932
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\SysWOW64\cmd.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2072
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\SysWOW64\cmd.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3440
                                                                                                                                                          • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                            "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3328
                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                            "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2236
                                                                                                                                                          • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                            "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3684
                                                                                                                                                          • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                            "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:520
                                                                                                                                                          • C:\Windows\SysWOW64\msiexec.exe
                                                                                                                                                            "C:\Windows\SysWOW64\msiexec.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:1216
                                                                                                                                                          • C:\Windows\SysWOW64\help.exe
                                                                                                                                                            "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2968
                                                                                                                                                          • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                            "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3944
                                                                                                                                                          • C:\Windows\SysWOW64\help.exe
                                                                                                                                                            "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:1160
                                                                                                                                                          • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                            "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3036
                                                                                                                                                          • C:\Windows\SysWOW64\mstsc.exe
                                                                                                                                                            "C:\Windows\SysWOW64\mstsc.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:1624
                                                                                                                                                          • C:\Windows\SysWOW64\help.exe
                                                                                                                                                            "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:2716
                                                                                                                                                          • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                            "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:704
                                                                                                                                                          • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                            "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3980
                                                                                                                                                          • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                            "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                            2⤵
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3396
                                                                                                                                                          • C:\Windows\SysWOW64\NETSTAT.EXE
                                                                                                                                                            "C:\Windows\SysWOW64\NETSTAT.EXE"
                                                                                                                                                            2⤵
                                                                                                                                                            • Gathers network information
                                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                            PID:3608
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            "C:\Windows\SysWOW64\cmd.exe"
                                                                                                                                                            2⤵
                                                                                                                                                              PID:1000
                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                              2⤵
                                                                                                                                                                PID:3584
                                                                                                                                                              • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:3160
                                                                                                                                                                • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                  "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1720
                                                                                                                                                                  • C:\Windows\SysWOW64\ipconfig.exe
                                                                                                                                                                    "C:\Windows\SysWOW64\ipconfig.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Gathers network information
                                                                                                                                                                    PID:2980
                                                                                                                                                                  • C:\Windows\SysWOW64\cmstp.exe
                                                                                                                                                                    "C:\Windows\SysWOW64\cmstp.exe"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:3948
                                                                                                                                                                    • C:\Windows\SysWOW64\systray.exe
                                                                                                                                                                      "C:\Windows\SysWOW64\systray.exe"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:812
                                                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                        "C:\Windows\SysWOW64\rundll32.exe"
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:3784
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          "C:\Windows\SysWOW64\cmd.exe"
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:3420
                                                                                                                                                                          • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                            "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:984
                                                                                                                                                                            • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                              "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:1156
                                                                                                                                                                              • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:740
                                                                                                                                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:904
                                                                                                                                                                                  • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                    "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4036
                                                                                                                                                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:3848
                                                                                                                                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:3316
                                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:3764
                                                                                                                                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:584
                                                                                                                                                                                            • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                              "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:3972
                                                                                                                                                                                              • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:3744
                                                                                                                                                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:3028
                                                                                                                                                                                                  • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                    "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:1288
                                                                                                                                                                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:3904
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                        "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:3988
                                                                                                                                                                                                        • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                                                                          "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:3600
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                            "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:3940
                                                                                                                                                                                                            • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                              "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3952
                                                                                                                                                                                                              • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                                                "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3640
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  "C:\Windows\SysWOW64\cmd.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1196
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                    "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:2800
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                      "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:1444
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:2636
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:3644
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:1336
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:748
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:1432
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:2984
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:3128
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:2804
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autochk.exe
                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autochk.exe"
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:808
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:3548
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmmon32.exe
                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\cmmon32.exe"
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:2244
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:3892
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:3844
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:656
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:3540
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:3792
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:620
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:3936
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:3424
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:2356
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\autoconv.exe
                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\autoconv.exe"
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:2092
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:848
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\netsh.exe
                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\netsh.exe"
                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                        PID:772
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\explorer.exe
                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\explorer.exe"
                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                          PID:4044
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:3880
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\chkdsk.exe
                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\chkdsk.exe"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                            PID:1700
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:2128
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\autofmt.exe
                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\autofmt.exe"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:1432
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                  PID:2356
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\msdt.exe
                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\msdt.exe"
                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                    PID:1084
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\control.exe
                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\control.exe"
                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                      PID:904
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\wlanext.exe
                                                                                                                                                                                                                                                                                      "C:\Windows\SysWOW64\wlanext.exe"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        "C:\Windows\SysWOW64\cmd.exe"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:3316
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cscript.exe
                                                                                                                                                                                                                                                                                          "C:\Windows\SysWOW64\cscript.exe"
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:2116
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            "C:\Windows\SysWOW64\cmd.exe"
                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                              PID:3972
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\wscript.exe
                                                                                                                                                                                                                                                                                              "C:\Windows\SysWOW64\wscript.exe"
                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                PID:2984
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\raserver.exe
                                                                                                                                                                                                                                                                                                "C:\Windows\SysWOW64\raserver.exe"
                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                  PID:4172
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\help.exe
                                                                                                                                                                                                                                                                                                  "C:\Windows\SysWOW64\help.exe"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:4200
                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\svchost.exe
                                                                                                                                                                                                                                                                                                    "C:\Windows\SysWOW64\svchost.exe"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:4292

                                                                                                                                                                                                                                                                                                  Network

                                                                                                                                                                                                                                                                                                        MITRE ATT&CK Enterprise v6

                                                                                                                                                                                                                                                                                                        Replay Monitor

                                                                                                                                                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                        Downloads

                                                                                                                                                                                                                                                                                                        memory/520-48-0x0000000001300000-0x0000000001473000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/520-47-0x0000000001300000-0x0000000001473000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/704-97-0x00000000008E0000-0x00000000008EC000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/704-96-0x00000000008E0000-0x00000000008EC000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/740-190-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/740-189-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/772-263-0x0000000000EA0000-0x0000000000EBE000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/772-264-0x0000000000EA0000-0x0000000000EBE000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/812-164-0x00000000008E0000-0x00000000008E6000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/812-165-0x00000000008E0000-0x00000000008E6000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/848-257-0x0000000000C60000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/848-258-0x0000000000C60000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/904-307-0x00000000009E0000-0x0000000000A00000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/904-306-0x00000000009E0000-0x0000000000A00000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/984-183-0x0000000001300000-0x0000000001473000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/984-184-0x0000000001300000-0x0000000001473000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1000-128-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1000-129-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1084-300-0x0000000001300000-0x0000000001473000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1084-301-0x0000000001300000-0x0000000001473000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1160-74-0x0000000000F20000-0x0000000000F27000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1160-75-0x0000000000F20000-0x0000000000F27000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1196-227-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1196-226-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1216-53-0x0000000000060000-0x0000000000072000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1216-54-0x0000000000060000-0x0000000000072000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1444-241-0x0000000000F20000-0x0000000000F27000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1444-242-0x0000000000F20000-0x0000000000F27000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1624-86-0x0000000000340000-0x000000000063C000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1624-83-0x0000000000340000-0x000000000063C000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1700-282-0x0000000001270000-0x000000000127A000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1700-283-0x0000000001270000-0x000000000127A000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1720-144-0x0000000000F20000-0x0000000000F27000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/1720-143-0x0000000000F20000-0x0000000000F27000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2020-10-0x00000000009E0000-0x0000000000A00000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2020-11-0x00000000009E0000-0x0000000000A00000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2072-15-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2072-14-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2116-325-0x0000000000020000-0x0000000000047000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2116-326-0x0000000000020000-0x0000000000047000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2128-289-0x0000000000C60000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2128-288-0x0000000000C60000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2236-35-0x0000000000020000-0x0000000000047000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2236-34-0x0000000000020000-0x0000000000047000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2244-252-0x0000000000A20000-0x0000000000A2C000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2244-251-0x0000000000A20000-0x0000000000A2C000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2356-295-0x0000000001300000-0x0000000001473000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2356-294-0x0000000001300000-0x0000000001473000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2716-89-0x0000000000F20000-0x0000000000F27000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2716-90-0x0000000000F20000-0x0000000000F27000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2800-232-0x0000000000C60000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2800-233-0x0000000000C60000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2968-59-0x0000000000F20000-0x0000000000F27000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2968-60-0x0000000000F20000-0x0000000000F27000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2980-151-0x0000000000D20000-0x0000000000D2B000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2980-150-0x0000000000D20000-0x0000000000D2B000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2984-342-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2984-341-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-148-0x000000000A260000-0x000000000A3A0000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-94-0x0000000007610000-0x00000000076EA000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-246-0x0000000005C70000-0x0000000005D30000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-25-0x00000000062F0000-0x0000000006473000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-280-0x000000000BA20000-0x000000000BB6B000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-42-0x0000000006610000-0x00000000067B5000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-103-0x0000000007A10000-0x0000000007AC1000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-346-0x000000000C860000-0x000000000C91B000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-212-0x000000000AD90000-0x000000000AE51000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-181-0x000000000A860000-0x000000000A987000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-317-0x000000000C120000-0x000000000C2BE000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/2988-330-0x000000000C420000-0x000000000C517000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3036-81-0x00000000008E0000-0x00000000008EC000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3036-80-0x00000000008E0000-0x00000000008EC000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3160-138-0x0000000000EA0000-0x0000000000EBE000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3160-137-0x0000000000EA0000-0x0000000000EBE000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3316-319-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3316-320-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3328-27-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3328-28-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3396-111-0x0000000001300000-0x0000000001473000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3396-112-0x0000000001300000-0x0000000001473000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3420-176-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3420-177-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3440-20-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3440-21-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3548-248-0x0000000001160000-0x000000000117F000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3548-249-0x0000000001160000-0x000000000117F000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3600-202-0x0000000001160000-0x000000000117F000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3600-201-0x0000000001160000-0x000000000117F000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3608-123-0x00000000002F0000-0x00000000002FB000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3608-122-0x00000000002F0000-0x00000000002FB000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3640-221-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3640-220-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3684-44-0x0000000000240000-0x0000000000256000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3684-45-0x0000000000240000-0x0000000000256000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3784-170-0x0000000000BE0000-0x0000000000BF3000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3784-171-0x0000000000BE0000-0x0000000000BF3000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3880-276-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3880-275-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3932-115-0x00007FF692EE0000-0x00007FF692F73000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3932-116-0x00007FF692EE0000-0x00007FF692F73000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3932-117-0x00007FF692EE0000-0x00007FF692F73000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3940-208-0x0000000000020000-0x0000000000047000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3940-207-0x0000000000020000-0x0000000000047000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3944-65-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3944-66-0x0000000001140000-0x0000000001167000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3948-162-0x0000000000240000-0x0000000000256000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3948-156-0x0000000000240000-0x0000000000256000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3952-214-0x0000000000EA0000-0x0000000000EBE000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3952-215-0x0000000000EA0000-0x0000000000EBE000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3972-332-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3972-333-0x00000000008B0000-0x0000000000909000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3976-313-0x0000000000C60000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3976-312-0x0000000000C60000-0x0000000000C77000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3980-105-0x0000000001160000-0x000000000117F000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3980-106-0x0000000001160000-0x000000000117F000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3988-196-0x0000000000020000-0x0000000000047000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/3988-195-0x0000000000020000-0x0000000000047000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/4004-0-0x0000000000400000-0x000000000042D000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/4044-270-0x00000000000B0000-0x00000000004EF000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/4044-269-0x00000000000B0000-0x00000000004EF000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/4172-348-0x0000000001160000-0x000000000117F000-memory.dmp

                                                                                                                                                                                                                                                                                                        memory/4172-349-0x0000000001160000-0x000000000117F000-memory.dmp