Analysis
- max time kernel
152s - max time network
140s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 19:43
Static task
static1
Behavioral task
behavioral1
Sample
Quotation 11052020.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Quotation 11052020.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target Quotation 11052020.exe
- Size 1009KB
- Sample201109-89rax47d5x
- SHA256 96a55e86b6b4d7ddfe80b096de08f57f7e8c417b2cb7dcf65a0c83aa32ed29dc
- MD5 8208efff87339c95a7c0780dcb9f6533
- SHA1 87110e1243bf9a8376d4116bdc8d6c7604ff9267
- SHA512 d6c65876b0dc46730434144c5d2ecd705d3da3c1deb6f4c7282bb1a16731c9a4dadf674232d3a29886f7e07340976df3de2f394cd17f9a66e30086d4cba2b458
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- NetWire RAT payload 22 IoCs
resource yara_rule behavioral1/memory/1860-0-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1860-1-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1860-3-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/1992-11-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1992-16-0x0000000000400000-0x0000000000433000-memory.dmp netwire behavioral1/memory/780-19-0x000000000040242D-mapping.dmp netwire behavioral1/memory/544-24-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1516-29-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1344-34-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1584-39-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1168-44-0x000000000040242D-mapping.dmp netwire behavioral1/memory/552-49-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1340-54-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1776-59-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1732-64-0x000000000040242D-mapping.dmp netwire behavioral1/memory/820-69-0x000000000040242D-mapping.dmp netwire behavioral1/memory/2008-74-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1588-79-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1980-84-0x000000000040242D-mapping.dmp netwire behavioral1/memory/516-89-0x000000000040242D-mapping.dmp netwire behavioral1/memory/944-94-0x000000000040242D-mapping.dmp netwire behavioral1/memory/1772-99-0x000000000040242D-mapping.dmp netwire - Executes dropped EXE 3 IoCs
pid Process 1164 Host.exe 1992 Host.exe 660 Host.exe - Loads dropped DLL 4 IoCs
pid Process 1860 Quotation 11052020.exe 1860 Quotation 11052020.exe 1164 Host.exe 1164 Host.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ Host.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Roaming\\Install\\Host.exe" Host.exe - Suspicious use of SetThreadContext 19 IoCs
description pid Process procid_target PID 300 set thread context of 1860 300 Quotation 11052020.exe 26 PID 1164 set thread context of 1992 1164 Host.exe 29 PID 976 set thread context of 780 976 Quotation 11052020.exe 32 PID 432 set thread context of 544 432 Quotation 11052020.exe 38 PID 956 set thread context of 1516 956 Quotation 11052020.exe 41 PID 2008 set thread context of 1344 2008 Quotation 11052020.exe 44 PID 548 set thread context of 1584 548 Quotation 11052020.exe 47 PID 1468 set thread context of 1168 1468 Quotation 11052020.exe 50 PID 1824 set thread context of 552 1824 Quotation 11052020.exe 53 PID 1788 set thread context of 1340 1788 Quotation 11052020.exe 56 PID 1632 set thread context of 1776 1632 Quotation 11052020.exe 59 PID 1636 set thread context of 1732 1636 Quotation 11052020.exe 62 PID 608 set thread context of 820 608 Quotation 11052020.exe 65 PID 1736 set thread context of 2008 1736 Quotation 11052020.exe 68 PID 1572 set thread context of 1588 1572 Quotation 11052020.exe 71 PID 1396 set thread context of 1980 1396 Quotation 11052020.exe 74 PID 1956 set thread context of 516 1956 Quotation 11052020.exe 77 PID 520 set thread context of 944 520 Quotation 11052020.exe 80 PID 1532 set thread context of 1772 1532 Quotation 11052020.exe 83 - Suspicious behavior: EnumeratesProcesses 1509 IoCs
pid Process 300 Quotation 11052020.exe 1840 Quotation 11052020.exe 1840 Quotation 11052020.exe 1840 Quotation 11052020.exe 1840 Quotation 11052020.exe 1840 Quotation 11052020.exe 1164 Host.exe 1840 Quotation 11052020.exe 660 Host.exe 660 Host.exe 976 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 1776 Quotation 11052020.exe 660 Host.exe 432 Quotation 11052020.exe 608 Quotation 11052020.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 660 Host.exe 608 Quotation 11052020.exe 956 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 660 Host.exe 912 Quotation 11052020.exe 2008 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 660 Host.exe 1572 Quotation 11052020.exe 548 Quotation 11052020.exe 1592 Quotation 11052020.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1592 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 1956 Quotation 11052020.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 660 Host.exe 1956 Quotation 11052020.exe 1824 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 660 Host.exe 1628 Quotation 11052020.exe 1788 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 660 Host.exe 960 Quotation 11052020.exe 1632 Quotation 11052020.exe 340 Quotation 11052020.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 660 Host.exe 340 Quotation 11052020.exe 1636 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 660 Host.exe 1560 Quotation 11052020.exe 608 Quotation 11052020.exe 956 Quotation 11052020.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 660 Host.exe 956 Quotation 11052020.exe 1736 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 660 Host.exe 1336 Quotation 11052020.exe 1572 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 660 Host.exe 1580 Quotation 11052020.exe 1396 Quotation 11052020.exe 1468 Quotation 11052020.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 660 Host.exe 1468 Quotation 11052020.exe 1956 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 660 Host.exe 1952 Quotation 11052020.exe 520 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 660 Host.exe 380 Quotation 11052020.exe 1532 Quotation 11052020.exe 1868 Quotation 11052020.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe 1868 Quotation 11052020.exe 660 Host.exe - Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 300 Quotation 11052020.exe 1164 Host.exe 976 Quotation 11052020.exe 432 Quotation 11052020.exe 956 Quotation 11052020.exe 2008 Quotation 11052020.exe 548 Quotation 11052020.exe 1468 Quotation 11052020.exe 1824 Quotation 11052020.exe 1788 Quotation 11052020.exe 1632 Quotation 11052020.exe 1636 Quotation 11052020.exe 608 Quotation 11052020.exe 1736 Quotation 11052020.exe 1572 Quotation 11052020.exe 1396 Quotation 11052020.exe 1956 Quotation 11052020.exe 520 Quotation 11052020.exe 1532 Quotation 11052020.exe - Suspicious use of WriteProcessMemory 224 IoCs
description pid Process procid_target PID 300 wrote to memory of 1860 300 Quotation 11052020.exe 26 PID 300 wrote to memory of 1860 300 Quotation 11052020.exe 26 PID 300 wrote to memory of 1860 300 Quotation 11052020.exe 26 PID 300 wrote to memory of 1860 300 Quotation 11052020.exe 26 PID 300 wrote to memory of 1840 300 Quotation 11052020.exe 27 PID 300 wrote to memory of 1840 300 Quotation 11052020.exe 27 PID 300 wrote to memory of 1840 300 Quotation 11052020.exe 27 PID 300 wrote to memory of 1840 300 Quotation 11052020.exe 27 PID 1860 wrote to memory of 1164 1860 Quotation 11052020.exe 28 PID 1860 wrote to memory of 1164 1860 Quotation 11052020.exe 28 PID 1860 wrote to memory of 1164 1860 Quotation 11052020.exe 28 PID 1860 wrote to memory of 1164 1860 Quotation 11052020.exe 28 PID 1164 wrote to memory of 1992 1164 Host.exe 29 PID 1164 wrote to memory of 1992 1164 Host.exe 29 PID 1164 wrote to memory of 1992 1164 Host.exe 29 PID 1164 wrote to memory of 1992 1164 Host.exe 29 PID 1164 wrote to memory of 660 1164 Host.exe 30 PID 1164 wrote to memory of 660 1164 Host.exe 30 PID 1164 wrote to memory of 660 1164 Host.exe 30 PID 1164 wrote to memory of 660 1164 Host.exe 30 PID 1840 wrote to memory of 976 1840 Quotation 11052020.exe 31 PID 1840 wrote to memory of 976 1840 Quotation 11052020.exe 31 PID 1840 wrote to memory of 976 1840 Quotation 11052020.exe 31 PID 1840 wrote to memory of 976 1840 Quotation 11052020.exe 31 PID 976 wrote to memory of 780 976 Quotation 11052020.exe 32 PID 976 wrote to memory of 780 976 Quotation 11052020.exe 32 PID 976 wrote to memory of 780 976 Quotation 11052020.exe 32 PID 976 wrote to memory of 780 976 Quotation 11052020.exe 32 PID 976 wrote to memory of 1776 976 Quotation 11052020.exe 33 PID 976 wrote to memory of 1776 976 Quotation 11052020.exe 33 PID 976 wrote to memory of 1776 976 Quotation 11052020.exe 33 PID 976 wrote to memory of 1776 976 Quotation 11052020.exe 33 PID 1776 wrote to memory of 432 1776 Quotation 11052020.exe 37 PID 1776 wrote to memory of 432 1776 Quotation 11052020.exe 37 PID 1776 wrote to memory of 432 1776 Quotation 11052020.exe 37 PID 1776 wrote to memory of 432 1776 Quotation 11052020.exe 37 PID 432 wrote to memory of 544 432 Quotation 11052020.exe 38 PID 432 wrote to memory of 544 432 Quotation 11052020.exe 38 PID 432 wrote to memory of 544 432 Quotation 11052020.exe 38 PID 432 wrote to memory of 544 432 Quotation 11052020.exe 38 PID 432 wrote to memory of 608 432 Quotation 11052020.exe 39 PID 432 wrote to memory of 608 432 Quotation 11052020.exe 39 PID 432 wrote to memory of 608 432 Quotation 11052020.exe 39 PID 432 wrote to memory of 608 432 Quotation 11052020.exe 39 PID 608 wrote to memory of 956 608 Quotation 11052020.exe 40 PID 608 wrote to memory of 956 608 Quotation 11052020.exe 40 PID 608 wrote to memory of 956 608 Quotation 11052020.exe 40 PID 608 wrote to memory of 956 608 Quotation 11052020.exe 40 PID 956 wrote to memory of 1516 956 Quotation 11052020.exe 41 PID 956 wrote to memory of 1516 956 Quotation 11052020.exe 41 PID 956 wrote to memory of 1516 956 Quotation 11052020.exe 41 PID 956 wrote to memory of 1516 956 Quotation 11052020.exe 41 PID 956 wrote to memory of 912 956 Quotation 11052020.exe 42 PID 956 wrote to memory of 912 956 Quotation 11052020.exe 42 PID 956 wrote to memory of 912 956 Quotation 11052020.exe 42 PID 956 wrote to memory of 912 956 Quotation 11052020.exe 42 PID 912 wrote to memory of 2008 912 Quotation 11052020.exe 43 PID 912 wrote to memory of 2008 912 Quotation 11052020.exe 43 PID 912 wrote to memory of 2008 912 Quotation 11052020.exe 43 PID 912 wrote to memory of 2008 912 Quotation 11052020.exe 43 PID 2008 wrote to memory of 1344 2008 Quotation 11052020.exe 44 PID 2008 wrote to memory of 1344 2008 Quotation 11052020.exe 44 PID 2008 wrote to memory of 1344 2008 Quotation 11052020.exe 44 PID 2008 wrote to memory of 1344 2008 Quotation 11052020.exe 44 PID 2008 wrote to memory of 1572 2008 Quotation 11052020.exe 45 PID 2008 wrote to memory of 1572 2008 Quotation 11052020.exe 45 PID 2008 wrote to memory of 1572 2008 Quotation 11052020.exe 45 PID 2008 wrote to memory of 1572 2008 Quotation 11052020.exe 45 PID 1572 wrote to memory of 548 1572 Quotation 11052020.exe 46 PID 1572 wrote to memory of 548 1572 Quotation 11052020.exe 46 PID 1572 wrote to memory of 548 1572 Quotation 11052020.exe 46 PID 1572 wrote to memory of 548 1572 Quotation 11052020.exe 46 PID 548 wrote to memory of 1584 548 Quotation 11052020.exe 47 PID 548 wrote to memory of 1584 548 Quotation 11052020.exe 47 PID 548 wrote to memory of 1584 548 Quotation 11052020.exe 47 PID 548 wrote to memory of 1584 548 Quotation 11052020.exe 47 PID 548 wrote to memory of 1592 548 Quotation 11052020.exe 48 PID 548 wrote to memory of 1592 548 Quotation 11052020.exe 48 PID 548 wrote to memory of 1592 548 Quotation 11052020.exe 48 PID 548 wrote to memory of 1592 548 Quotation 11052020.exe 48 PID 1592 wrote to memory of 1468 1592 Quotation 11052020.exe 49 PID 1592 wrote to memory of 1468 1592 Quotation 11052020.exe 49 PID 1592 wrote to memory of 1468 1592 Quotation 11052020.exe 49 PID 1592 wrote to memory of 1468 1592 Quotation 11052020.exe 49 PID 1468 wrote to memory of 1168 1468 Quotation 11052020.exe 50 PID 1468 wrote to memory of 1168 1468 Quotation 11052020.exe 50 PID 1468 wrote to memory of 1168 1468 Quotation 11052020.exe 50 PID 1468 wrote to memory of 1168 1468 Quotation 11052020.exe 50 PID 1468 wrote to memory of 1956 1468 Quotation 11052020.exe 51 PID 1468 wrote to memory of 1956 1468 Quotation 11052020.exe 51 PID 1468 wrote to memory of 1956 1468 Quotation 11052020.exe 51 PID 1468 wrote to memory of 1956 1468 Quotation 11052020.exe 51 PID 1956 wrote to memory of 1824 1956 Quotation 11052020.exe 52 PID 1956 wrote to memory of 1824 1956 Quotation 11052020.exe 52 PID 1956 wrote to memory of 1824 1956 Quotation 11052020.exe 52 PID 1956 wrote to memory of 1824 1956 Quotation 11052020.exe 52 PID 1824 wrote to memory of 552 1824 Quotation 11052020.exe 53 PID 1824 wrote to memory of 552 1824 Quotation 11052020.exe 53 PID 1824 wrote to memory of 552 1824 Quotation 11052020.exe 53 PID 1824 wrote to memory of 552 1824 Quotation 11052020.exe 53 PID 1824 wrote to memory of 1628 1824 Quotation 11052020.exe 54 PID 1824 wrote to memory of 1628 1824 Quotation 11052020.exe 54 PID 1824 wrote to memory of 1628 1824 Quotation 11052020.exe 54 PID 1824 wrote to memory of 1628 1824 Quotation 11052020.exe 54 PID 1628 wrote to memory of 1788 1628 Quotation 11052020.exe 55 PID 1628 wrote to memory of 1788 1628 Quotation 11052020.exe 55 PID 1628 wrote to memory of 1788 1628 Quotation 11052020.exe 55 PID 1628 wrote to memory of 1788 1628 Quotation 11052020.exe 55 PID 1788 wrote to memory of 1340 1788 Quotation 11052020.exe 56 PID 1788 wrote to memory of 1340 1788 Quotation 11052020.exe 56 PID 1788 wrote to memory of 1340 1788 Quotation 11052020.exe 56 PID 1788 wrote to memory of 1340 1788 Quotation 11052020.exe 56 PID 1788 wrote to memory of 960 1788 Quotation 11052020.exe 57 PID 1788 wrote to memory of 960 1788 Quotation 11052020.exe 57 PID 1788 wrote to memory of 960 1788 Quotation 11052020.exe 57 PID 1788 wrote to memory of 960 1788 Quotation 11052020.exe 57 PID 960 wrote to memory of 1632 960 Quotation 11052020.exe 58 PID 960 wrote to memory of 1632 960 Quotation 11052020.exe 58 PID 960 wrote to memory of 1632 960 Quotation 11052020.exe 58 PID 960 wrote to memory of 1632 960 Quotation 11052020.exe 58 PID 1632 wrote to memory of 1776 1632 Quotation 11052020.exe 59 PID 1632 wrote to memory of 1776 1632 Quotation 11052020.exe 59 PID 1632 wrote to memory of 1776 1632 Quotation 11052020.exe 59 PID 1632 wrote to memory of 1776 1632 Quotation 11052020.exe 59 PID 1632 wrote to memory of 340 1632 Quotation 11052020.exe 60 PID 1632 wrote to memory of 340 1632 Quotation 11052020.exe 60 PID 1632 wrote to memory of 340 1632 Quotation 11052020.exe 60 PID 1632 wrote to memory of 340 1632 Quotation 11052020.exe 60 PID 340 wrote to memory of 1636 340 Quotation 11052020.exe 61 PID 340 wrote to memory of 1636 340 Quotation 11052020.exe 61 PID 340 wrote to memory of 1636 340 Quotation 11052020.exe 61 PID 340 wrote to memory of 1636 340 Quotation 11052020.exe 61 PID 1636 wrote to memory of 1732 1636 Quotation 11052020.exe 62 PID 1636 wrote to memory of 1732 1636 Quotation 11052020.exe 62 PID 1636 wrote to memory of 1732 1636 Quotation 11052020.exe 62 PID 1636 wrote to memory of 1732 1636 Quotation 11052020.exe 62 PID 1636 wrote to memory of 1560 1636 Quotation 11052020.exe 63 PID 1636 wrote to memory of 1560 1636 Quotation 11052020.exe 63 PID 1636 wrote to memory of 1560 1636 Quotation 11052020.exe 63 PID 1636 wrote to memory of 1560 1636 Quotation 11052020.exe 63 PID 1560 wrote to memory of 608 1560 Quotation 11052020.exe 64 PID 1560 wrote to memory of 608 1560 Quotation 11052020.exe 64 PID 1560 wrote to memory of 608 1560 Quotation 11052020.exe 64 PID 1560 wrote to memory of 608 1560 Quotation 11052020.exe 64 PID 608 wrote to memory of 820 608 Quotation 11052020.exe 65 PID 608 wrote to memory of 820 608 Quotation 11052020.exe 65 PID 608 wrote to memory of 820 608 Quotation 11052020.exe 65 PID 608 wrote to memory of 820 608 Quotation 11052020.exe 65 PID 608 wrote to memory of 956 608 Quotation 11052020.exe 66 PID 608 wrote to memory of 956 608 Quotation 11052020.exe 66 PID 608 wrote to memory of 956 608 Quotation 11052020.exe 66 PID 608 wrote to memory of 956 608 Quotation 11052020.exe 66 PID 956 wrote to memory of 1736 956 Quotation 11052020.exe 67 PID 956 wrote to memory of 1736 956 Quotation 11052020.exe 67 PID 956 wrote to memory of 1736 956 Quotation 11052020.exe 67 PID 956 wrote to memory of 1736 956 Quotation 11052020.exe 67 PID 1736 wrote to memory of 2008 1736 Quotation 11052020.exe 68 PID 1736 wrote to memory of 2008 1736 Quotation 11052020.exe 68 PID 1736 wrote to memory of 2008 1736 Quotation 11052020.exe 68 PID 1736 wrote to memory of 2008 1736 Quotation 11052020.exe 68 PID 1736 wrote to memory of 1336 1736 Quotation 11052020.exe 69 PID 1736 wrote to memory of 1336 1736 Quotation 11052020.exe 69 PID 1736 wrote to memory of 1336 1736 Quotation 11052020.exe 69 PID 1736 wrote to memory of 1336 1736 Quotation 11052020.exe 69 PID 1336 wrote to memory of 1572 1336 Quotation 11052020.exe 70 PID 1336 wrote to memory of 1572 1336 Quotation 11052020.exe 70 PID 1336 wrote to memory of 1572 1336 Quotation 11052020.exe 70 PID 1336 wrote to memory of 1572 1336 Quotation 11052020.exe 70 PID 1572 wrote to memory of 1588 1572 Quotation 11052020.exe 71 PID 1572 wrote to memory of 1588 1572 Quotation 11052020.exe 71 PID 1572 wrote to memory of 1588 1572 Quotation 11052020.exe 71 PID 1572 wrote to memory of 1588 1572 Quotation 11052020.exe 71 PID 1572 wrote to memory of 1580 1572 Quotation 11052020.exe 72 PID 1572 wrote to memory of 1580 1572 Quotation 11052020.exe 72 PID 1572 wrote to memory of 1580 1572 Quotation 11052020.exe 72 PID 1572 wrote to memory of 1580 1572 Quotation 11052020.exe 72 PID 1580 wrote to memory of 1396 1580 Quotation 11052020.exe 73 PID 1580 wrote to memory of 1396 1580 Quotation 11052020.exe 73 PID 1580 wrote to memory of 1396 1580 Quotation 11052020.exe 73 PID 1580 wrote to memory of 1396 1580 Quotation 11052020.exe 73 PID 1396 wrote to memory of 1980 1396 Quotation 11052020.exe 74 PID 1396 wrote to memory of 1980 1396 Quotation 11052020.exe 74 PID 1396 wrote to memory of 1980 1396 Quotation 11052020.exe 74 PID 1396 wrote to memory of 1980 1396 Quotation 11052020.exe 74 PID 1396 wrote to memory of 1468 1396 Quotation 11052020.exe 75 PID 1396 wrote to memory of 1468 1396 Quotation 11052020.exe 75 PID 1396 wrote to memory of 1468 1396 Quotation 11052020.exe 75 PID 1396 wrote to memory of 1468 1396 Quotation 11052020.exe 75 PID 1468 wrote to memory of 1956 1468 Quotation 11052020.exe 76 PID 1468 wrote to memory of 1956 1468 Quotation 11052020.exe 76 PID 1468 wrote to memory of 1956 1468 Quotation 11052020.exe 76 PID 1468 wrote to memory of 1956 1468 Quotation 11052020.exe 76 PID 1956 wrote to memory of 516 1956 Quotation 11052020.exe 77 PID 1956 wrote to memory of 516 1956 Quotation 11052020.exe 77 PID 1956 wrote to memory of 516 1956 Quotation 11052020.exe 77 PID 1956 wrote to memory of 516 1956 Quotation 11052020.exe 77 PID 1956 wrote to memory of 1952 1956 Quotation 11052020.exe 78 PID 1956 wrote to memory of 1952 1956 Quotation 11052020.exe 78 PID 1956 wrote to memory of 1952 1956 Quotation 11052020.exe 78 PID 1956 wrote to memory of 1952 1956 Quotation 11052020.exe 78 PID 1952 wrote to memory of 520 1952 Quotation 11052020.exe 79 PID 1952 wrote to memory of 520 1952 Quotation 11052020.exe 79 PID 1952 wrote to memory of 520 1952 Quotation 11052020.exe 79 PID 1952 wrote to memory of 520 1952 Quotation 11052020.exe 79 PID 520 wrote to memory of 944 520 Quotation 11052020.exe 80 PID 520 wrote to memory of 944 520 Quotation 11052020.exe 80 PID 520 wrote to memory of 944 520 Quotation 11052020.exe 80 PID 520 wrote to memory of 944 520 Quotation 11052020.exe 80 PID 520 wrote to memory of 380 520 Quotation 11052020.exe 81 PID 520 wrote to memory of 380 520 Quotation 11052020.exe 81 PID 520 wrote to memory of 380 520 Quotation 11052020.exe 81 PID 520 wrote to memory of 380 520 Quotation 11052020.exe 81 PID 380 wrote to memory of 1532 380 Quotation 11052020.exe 82 PID 380 wrote to memory of 1532 380 Quotation 11052020.exe 82 PID 380 wrote to memory of 1532 380 Quotation 11052020.exe 82 PID 380 wrote to memory of 1532 380 Quotation 11052020.exe 82 PID 1532 wrote to memory of 1772 1532 Quotation 11052020.exe 83 PID 1532 wrote to memory of 1772 1532 Quotation 11052020.exe 83 PID 1532 wrote to memory of 1772 1532 Quotation 11052020.exe 83 PID 1532 wrote to memory of 1772 1532 Quotation 11052020.exe 83 PID 1532 wrote to memory of 1868 1532 Quotation 11052020.exe 84 PID 1532 wrote to memory of 1868 1532 Quotation 11052020.exe 84 PID 1532 wrote to memory of 1868 1532 Quotation 11052020.exe 84 PID 1532 wrote to memory of 1868 1532 Quotation 11052020.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe" -m "C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1992
-
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe" 2 1992 2592911334⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:660
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1860 2592900722⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"4⤵PID:780
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 780 2592914144⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"5⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"6⤵PID:544
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 544 2593004786⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"7⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"8⤵PID:1516
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1516 2593095578⤵
- Suspicious use of WriteProcessMemory
PID:912 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"9⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"10⤵PID:1344
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1344 25931860510⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"11⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:548 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"12⤵PID:1584
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1584 25932771612⤵PID:1592
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"13⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"14⤵PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1168 25933679514⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"15⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1824 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"16⤵PID:552
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 552 25934589016⤵PID:1628
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"17⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"18⤵PID:1340
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1340 25935490718⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"19⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"20⤵PID:1776
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1776 25936400120⤵PID:340
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"21⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1636 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"22⤵PID:1732
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1732 25937303422⤵PID:1560
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"23⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:608 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"24⤵PID:820
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 820 25938211324⤵PID:956
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"25⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1736 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"26⤵PID:2008
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 2008 25939114626⤵PID:1336
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"27⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1572 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"28⤵PID:1588
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1588 25940022528⤵PID:1580
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"29⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1396 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"30⤵PID:1980
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1980 25940927330⤵PID:1468
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"31⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1956 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"32⤵PID:516
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 516 25941833732⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"33⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:520 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"34⤵PID:944
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 944 25942740034⤵PID:380
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"35⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"36⤵PID:1772
-
-
C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe"C:\Users\Admin\AppData\Local\Temp\Quotation 11052020.exe" 2 1772 25943646436⤵PID:1868
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-