plaguebot | 216f78a4be6357c2990ff1db5c359457d140ff27e71e9dcb374d119046e053f7

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
25-03-2024 08:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dd9a2edf17f5be8c871b7391a6739f89.exe
Size

967KB
MD5

dd9a2edf17f5be8c871b7391a6739f89
SHA1

cebd20ebdc923133ca26babec4375aa859e0c09b
SHA256

216f78a4be6357c2990ff1db5c359457d140ff27e71e9dcb374d119046e053f7
SHA512

e273d6f46beede6ab43523b49b1db3461374e17952e89bef451c1cd46ed9a8d7b894b19b3d4f28bf345f198f71fc54dc625151573c1e83bfca52a51545252f2f
SSDEEP

24576:hNxsglIPAtgV+rnEQBg2AdqgwGd9OCPltP0gxkR3dCqJO5VxQ75SY1:J7uKrnEQi2Ad/wQPLP0gx1qt5SY1

Score

10^/10

plaguebot botnet

Malware Config

Signatures

PlagueBot
PlagueBot is an open source Bot written in Pascal.
botnet plaguebot

PlagueBot Executable 2 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023212-6.dat	plaguebot
behavioral2/files/0x000800000002320d-17.dat	plaguebot

Checks computer location settings 2 TTPs 53 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	dd9a2edf17f5be8c871b7391a6739f89.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	winmgr.exe

Executes dropped EXE 55 IoCs

pid	Process
232	winmgr.exe
2776	winmgr.exe
1380	winmgr.exe
5068	winmgr.exe
4884	winmgr.exe
4008	winmgr.exe
3768	winmgr.exe
812	winmgr.exe
1104	winmgr.exe
2704	winmgr.exe
4396	winmgr.exe
1312	winmgr.exe
4804	winmgr.exe
2852	winmgr.exe
1256	winmgr.exe
2496	winmgr.exe
2740	winmgr.exe
1380	winmgr.exe
2284	winmgr.exe
3848	winmgr.exe
1628	winmgr.exe
2872	winmgr.exe
2704	winmgr.exe
4472	winmgr.exe
2364	winmgr.exe
1796	winmgr.exe
3208	winmgr.exe
3768	winmgr.exe
4032	winmgr.exe
3812	winmgr.exe
2568	winmgr.exe
2872	winmgr.exe
4444	winmgr.exe
4520	winmgr.exe
3556	winmgr.exe
2364	winmgr.exe
2812	winmgr.exe
920	winmgr.exe
3704	winmgr.exe
3268	winmgr.exe
1100	winmgr.exe
4220	winmgr.exe
1292	winmgr.exe
3144	winmgr.exe
1796	winmgr.exe
3208	winmgr.exe
4412	winmgr.exe
3492	winmgr.exe
1012	winmgr.exe
3768	winmgr.exe
4800	winmgr.exe
4556	winmgr.exe
4492	winmgr.exe
4668	winmgr.exe
4484	winmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 53 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
3736	schtasks.exe
728	schtasks.exe
728	schtasks.exe
1580	schtasks.exe
5060	schtasks.exe
5044	schtasks.exe
2380	schtasks.exe
1176	schtasks.exe
408	schtasks.exe
2008	schtasks.exe
32	schtasks.exe
4684	schtasks.exe
1696	schtasks.exe
4400	schtasks.exe
3216	schtasks.exe
4360	schtasks.exe
448	schtasks.exe
4048	schtasks.exe
1764	schtasks.exe
4036	schtasks.exe
3812	schtasks.exe
2688	schtasks.exe
4516	schtasks.exe
2404	schtasks.exe
4008	schtasks.exe
3964	schtasks.exe
1616	schtasks.exe
3824	schtasks.exe
3260	schtasks.exe
884	schtasks.exe
3568	schtasks.exe
5084	schtasks.exe
1368	schtasks.exe
1712	schtasks.exe
3172	schtasks.exe
2076	schtasks.exe
4528	schtasks.exe
508	schtasks.exe
3312	schtasks.exe
3696	schtasks.exe
4660	schtasks.exe
4544	schtasks.exe
4908	schtasks.exe
428	schtasks.exe
1116	schtasks.exe
812	schtasks.exe
1432	schtasks.exe
2072	schtasks.exe
4824	schtasks.exe
1136	schtasks.exe
3776	schtasks.exe
3928	schtasks.exe
3500	schtasks.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 1616	408	dd9a2edf17f5be8c871b7391a6739f89.exe	86
PID 408 wrote to memory of 1616	408	dd9a2edf17f5be8c871b7391a6739f89.exe	86
PID 408 wrote to memory of 1616	408	dd9a2edf17f5be8c871b7391a6739f89.exe	86
PID 408 wrote to memory of 924	408	dd9a2edf17f5be8c871b7391a6739f89.exe	89
PID 408 wrote to memory of 924	408	dd9a2edf17f5be8c871b7391a6739f89.exe	89
PID 408 wrote to memory of 924	408	dd9a2edf17f5be8c871b7391a6739f89.exe	89
PID 408 wrote to memory of 232	408	dd9a2edf17f5be8c871b7391a6739f89.exe	94
PID 408 wrote to memory of 232	408	dd9a2edf17f5be8c871b7391a6739f89.exe	94
PID 408 wrote to memory of 232	408	dd9a2edf17f5be8c871b7391a6739f89.exe	94
PID 232 wrote to memory of 5084	232	winmgr.exe	95
PID 232 wrote to memory of 5084	232	winmgr.exe	95
PID 232 wrote to memory of 5084	232	winmgr.exe	95
PID 232 wrote to memory of 1432	232	winmgr.exe	97
PID 232 wrote to memory of 1432	232	winmgr.exe	97
PID 232 wrote to memory of 1432	232	winmgr.exe	97
PID 232 wrote to memory of 2776	232	winmgr.exe	99
PID 232 wrote to memory of 2776	232	winmgr.exe	99
PID 232 wrote to memory of 2776	232	winmgr.exe	99
PID 2776 wrote to memory of 1696	2776	winmgr.exe	101
PID 2776 wrote to memory of 1696	2776	winmgr.exe	101
PID 2776 wrote to memory of 1696	2776	winmgr.exe	101
PID 2776 wrote to memory of 1544	2776	winmgr.exe	104
PID 2776 wrote to memory of 1544	2776	winmgr.exe	104
PID 2776 wrote to memory of 1544	2776	winmgr.exe	104
PID 2776 wrote to memory of 1380	2776	winmgr.exe	106
PID 2776 wrote to memory of 1380	2776	winmgr.exe	106
PID 2776 wrote to memory of 1380	2776	winmgr.exe	106
PID 1380 wrote to memory of 1368	1380	winmgr.exe	112
PID 1380 wrote to memory of 1368	1380	winmgr.exe	112
PID 1380 wrote to memory of 1368	1380	winmgr.exe	112
PID 1380 wrote to memory of 3156	1380	winmgr.exe	114
PID 1380 wrote to memory of 3156	1380	winmgr.exe	114
PID 1380 wrote to memory of 3156	1380	winmgr.exe	114
PID 1380 wrote to memory of 5068	1380	winmgr.exe	116
PID 1380 wrote to memory of 5068	1380	winmgr.exe	116
PID 1380 wrote to memory of 5068	1380	winmgr.exe	116
PID 5068 wrote to memory of 3172	5068	winmgr.exe	119
PID 5068 wrote to memory of 3172	5068	winmgr.exe	119
PID 5068 wrote to memory of 3172	5068	winmgr.exe	119
PID 5068 wrote to memory of 4036	5068	winmgr.exe	121
PID 5068 wrote to memory of 4036	5068	winmgr.exe	121
PID 5068 wrote to memory of 4036	5068	winmgr.exe	121
PID 5068 wrote to memory of 4884	5068	winmgr.exe	123
PID 5068 wrote to memory of 4884	5068	winmgr.exe	123
PID 5068 wrote to memory of 4884	5068	winmgr.exe	123
PID 4884 wrote to memory of 3824	4884	winmgr.exe	125
PID 4884 wrote to memory of 3824	4884	winmgr.exe	125
PID 4884 wrote to memory of 3824	4884	winmgr.exe	125
PID 4884 wrote to memory of 3532	4884	winmgr.exe	127
PID 4884 wrote to memory of 3532	4884	winmgr.exe	127
PID 4884 wrote to memory of 3532	4884	winmgr.exe	127
PID 4884 wrote to memory of 4008	4884	winmgr.exe	129
PID 4884 wrote to memory of 4008	4884	winmgr.exe	129
PID 4884 wrote to memory of 4008	4884	winmgr.exe	129
PID 4008 wrote to memory of 5060	4008	winmgr.exe	133
PID 4008 wrote to memory of 5060	4008	winmgr.exe	133
PID 4008 wrote to memory of 5060	4008	winmgr.exe	133
PID 4008 wrote to memory of 2932	4008	winmgr.exe	135
PID 4008 wrote to memory of 2932	4008	winmgr.exe	135
PID 4008 wrote to memory of 2932	4008	winmgr.exe	135
PID 4008 wrote to memory of 3768	4008	winmgr.exe	137
PID 4008 wrote to memory of 3768	4008	winmgr.exe	137
PID 4008 wrote to memory of 3768	4008	winmgr.exe	137
PID 812 wrote to memory of 2404	812	winmgr.exe	139

C:\Users\Admin\AppData\Local\Temp\dd9a2edf17f5be8c871b7391a6739f89.exe
"C:\Users\Admin\AppData\Local\Temp\dd9a2edf17f5be8c871b7391a6739f89.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:408
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
  2⤵
  - Creates scheduled task(s)
  PID:1616
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Query /FO "LIST" /TN "WinManager"
  2⤵
  PID:924
- C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
  "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:232
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
    3⤵
    - Creates scheduled task(s)
    PID:5084
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Query /FO "LIST" /TN "WinManager"
    3⤵
    PID:1432
- - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
    "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
      4⤵
      Creates scheduled task(s)
      PID:1696
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Query /FO "LIST" /TN "WinManager"
      4⤵
      PID:1544
  - - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
      "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1380
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        5⤵
        Creates scheduled task(s)
        
        PID:1368
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        5⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        5⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5068
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        6⤵
        Creates scheduled task(s)
        
        PID:3172
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        6⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4884
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        7⤵
        Creates scheduled task(s)
        
        PID:3824
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        7⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        7⤵
        Checks computer location settings
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4008
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        8⤵
        Creates scheduled task(s)
        
        PID:5060
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        8⤵
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        8⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3768
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        9⤵
        Creates scheduled task(s)
        
        PID:4660
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        9⤵
        
        PID:3848
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        9⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2704
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        10⤵
        Creates scheduled task(s)
        
        PID:3812
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        10⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        10⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1312
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        11⤵
        Creates scheduled task(s)
        
        PID:4008
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        11⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        11⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2852
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        12⤵
        Creates scheduled task(s)
        
        PID:4400
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        12⤵
        
        PID:508
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        12⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2496
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        13⤵
        Creates scheduled task(s)
        
        PID:1432
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        13⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        13⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1380
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        14⤵
        Creates scheduled task(s)
        
        PID:3260
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        14⤵
        
        PID:1708
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        14⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3848
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        15⤵
        Creates scheduled task(s)
        
        PID:5044
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        15⤵
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        15⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2872
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        16⤵
        Creates scheduled task(s)
        
        PID:2076
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        16⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        16⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4472
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        17⤵
        Creates scheduled task(s)
        
        PID:4048
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        17⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        17⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        18⤵
        Creates scheduled task(s)
        
        PID:4544
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        18⤵
        
        PID:1136
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        18⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3812
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        19⤵
        Creates scheduled task(s)
        
        PID:2688
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        19⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        19⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4444
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        20⤵
        Creates scheduled task(s)
        
        PID:728
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        20⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        20⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2364
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        21⤵
        Creates scheduled task(s)
        
        PID:1580
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        21⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        21⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3704
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        22⤵
        Creates scheduled task(s)
        
        PID:3568
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        22⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        22⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4220
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        23⤵
        Creates scheduled task(s)
        
        PID:3312
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        23⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        23⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1796
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        24⤵
        Creates scheduled task(s)
        
        PID:2008
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        24⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        24⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3492
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        25⤵
        Creates scheduled task(s)
        
        PID:3964
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        25⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        25⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4800
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        26⤵
        Creates scheduled task(s)
        
        PID:428
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        26⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        26⤵
        Executes dropped EXE
        
        PID:4668

C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:812
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
  2⤵
  - Creates scheduled task(s)
  PID:2404
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Query /FO "LIST" /TN "WinManager"
  2⤵
  PID:4036
- C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
  "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
    3⤵
    - Creates scheduled task(s)
    PID:1116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Query /FO "LIST" /TN "WinManager"
    3⤵
    PID:212
- - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
    "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4396
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
      4⤵
      Creates scheduled task(s)
      PID:448
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Query /FO "LIST" /TN "WinManager"
      4⤵
      PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
      "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:4804
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        5⤵
        Creates scheduled task(s)
        
        PID:812
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        5⤵
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1256
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        6⤵
        Creates scheduled task(s)
        
        PID:1136
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        6⤵
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2740
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        7⤵
        Creates scheduled task(s)
        
        PID:3736
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        7⤵
        
        PID:648
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2284
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        8⤵
        Creates scheduled task(s)
        
        PID:728
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        8⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        8⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1628
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        9⤵
        Creates scheduled task(s)
        
        PID:2380
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        9⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        9⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2704
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        10⤵
        Creates scheduled task(s)
        
        PID:3216
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        10⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        10⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2364
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        11⤵
        Creates scheduled task(s)
        
        PID:4528
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        11⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        11⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        12⤵
        Creates scheduled task(s)
        
        PID:3776
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        12⤵
        
        PID:1176
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        12⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2568
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        13⤵
        Creates scheduled task(s)
        
        PID:4824
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        13⤵
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        13⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4520
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        14⤵
        Creates scheduled task(s)
        
        PID:4684
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        14⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        14⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:2812
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        15⤵
        Creates scheduled task(s)
        
        PID:3696
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        15⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        15⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3268
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        16⤵
        Creates scheduled task(s)
        
        PID:4360
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        16⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        16⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1292
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        17⤵
        Creates scheduled task(s)
        
        PID:3500
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        17⤵
        
        PID:2264
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        17⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3208
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        18⤵
        Creates scheduled task(s)
        
        PID:884
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        18⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        18⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1012
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        19⤵
        Creates scheduled task(s)
        
        PID:4036
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        19⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        19⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4556
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        20⤵
        Creates scheduled task(s)
        
        PID:1176
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        20⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        20⤵
        Executes dropped EXE
        
        PID:4484

C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
PID:3768
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
  2⤵
  - Creates scheduled task(s)
  PID:1712
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /Query /FO "LIST" /TN "WinManager"
  2⤵
  PID:2068
- C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
  "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
    3⤵
    - Creates scheduled task(s)
    PID:2072
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /Query /FO "LIST" /TN "WinManager"
    3⤵
    PID:2976
- - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
    "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:2872
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
      4⤵
      Creates scheduled task(s)
      PID:32
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Query /FO "LIST" /TN "WinManager"
      4⤵
      PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
      "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:3556
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        5⤵
        Creates scheduled task(s)
        
        PID:3928
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        5⤵
        
        PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        5⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:920
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        6⤵
        Creates scheduled task(s)
        
        PID:408
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        6⤵
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        6⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:1100
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        7⤵
        Creates scheduled task(s)
        
        PID:508
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        7⤵
        
        PID:4520
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        7⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3144
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        8⤵
        Creates scheduled task(s)
        
        PID:1764
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        8⤵
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        8⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:4412
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        9⤵
        Creates scheduled task(s)
        
        PID:4908
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        9⤵
        
        PID:608
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        9⤵
        Checks computer location settings
        Executes dropped EXE
        
        PID:3768
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Create /TN "WinManager" /XML "C:\Users\Admin\AppData\Local\Temp\NewTask.xml"
        10⤵
        Creates scheduled task(s)
        
        PID:4516
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Query /FO "LIST" /TN "WinManager"
        10⤵
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe" /wait
        10⤵
        Executes dropped EXE
        
        PID:4492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
8ce1abde750fec35c5fa5d1461c03f87

SHA1
5ed3fe68ce7231f52ba477b214c1d05f409224be

SHA256
f646b9e402fc6ae2a9283797e2e449d9ce1e64dbbc0463ad7fb2627aa491b58d

SHA512
81703d6c3aa90849b910ac549185edfd9c0b5a2f8e140bf2edb9e303f407885de37443b4e8464f0ef37f178342e02b76d859e7173eb57697820b3d556cdabf96

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
8822b243d31a8643b4747b127d01afe1

SHA1
982acee88f85d5e8b4d53de0a31745de6b6e742a

SHA256
ec227ef0b479bdc9aee152eabf88793346077f62811390bd70fd2096ab28c072

SHA512
5ac0888c857db60984b857b3b0debca4c6f981d21e6a4e3ab5ae491d6d6ee438291b34454777516e32f6ffa84aab6bf40ab03a69a0b37b860b792ef6ba699db1

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
5238bf4ca68f5edf438d588ec5569ef9

SHA1
5715715b08eeb9d6d767c6d1a3864c0ef98a7fdb

SHA256
db04798cef1ca48a7559eb7b05bf09f4abb442aeee58d0226d31a2338d462d56

SHA512
d05858eeb16bdf891b7b99a602541bca6ca2050725cc049ba7248d268540fb9440b66907f49d89f6f924de12e4f8b1b39b434667349e2b08d6a994bee3e51af4

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
cf819ab7cf05cd4d87a2dbb4a83e07d0

SHA1
e8dcfa9dc44bd7e34864bfac1c355edbd00a3856

SHA256
94545d6efb11d211a88b96311f847eaa85e9f4dfa7a830a05d9f79fc5bc9f7ea

SHA512
4d70c72955957dcce0cbb31289af1182fbe5534131aaba7f5c5040bce16cfbb5909b510c6bb8f3a3142dc455856570457825dd12eccf0a758fdb5663a001408a

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
3706d6a565ae41318cf8334f94996c41

SHA1
c16f37d83b4a3e99281b2519006bbcdc2c527302

SHA256
a61b0301950751b7ba1c7fe37cc39f12d9bdd786171d1e5960653d0508769645

SHA512
5fb6372a2584b5cd5612595ffaf2d16925b06cdbbbe61390b5aab92ad366f51008107244e1efc9e026ef1177a66876655c90769d782e539102fb523f51a9a703

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
24355b8f7764a360fc05cf35304f1e5c

SHA1
6c638077256f2b8c56c221fa307aa26408b16f7b

SHA256
da581f662ba00e101cb12f809d89c8ea3fb6eba2076b5fc0f608853ae995e749

SHA512
afdffa193e6cb3234959b77356ea1569583dfa08c2174ac284438834b5a1c55a29b7bbfaa6705ba71982e2218041ee0af2f8d7d68a8213b0a1675d84d452ad62

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
2721c23d88caba1c0ced696663f57fec

SHA1
53b1f6cd1fc332362c0ce109619deb27851ab5b6

SHA256
f83547e1a0725aff40d173b7d96a724f6f1bd9341820f50fb0d840b17a069403

SHA512
4a4f4007e824a6e31bf96f90aebf4b4b5c93b07eb47f7ab96f72872a125dead7614e29bcad2ae69435c08a7ba70046ba2ed0f5247f4bd3a59416a7ab8c727ab2

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
9ba97d15f1b45f2304a199aa51c6d01d

SHA1
9ca697f6f0281593bff47f99972f691ac4a876f7

SHA256
039302b4e1d0db52a3627e590abe5f4991f57e21a59ed739780d54cb160e4cab

SHA512
c54a96bfd04620fb22b6ebfafc7efa9ad0f74b9019a2988c1699e04171fd0d07263353f530505ec461695b3063126d6dadf1f0d5510cc831dd947327133f4245

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
d8db74296a8da5ee6250033d9922674d

SHA1
c5fd4ac104cc3510db5c8237fe59870f939ab1b4

SHA256
9cc5a28f56e014f8f5df1b8125e5d81e8b24ba3ee16593c4b3b53cf69aede1de

SHA512
bb838a7330e6f4c41dc478d589c21be6d3be3d6daf33b57ca68f2121495a7518e21188f2a17cd2769f5ce2a372ebb287b89ce9744f0e953287f439ca62a08c81

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
6cee1216b03bf11f3215969b0197f8db

SHA1
10aacb877aeb0dd4328ebd26dedad9af1246a1ce

SHA256
8c56ba5f6843fe36bf6b918f82fdbca411728d1e88fc5d8501109eec628e842a

SHA512
d5defbf111b8eb4bed04cd8bb6afd90c7c5ef6e08cb0b068646a2714f2ef979d406638dbcb7a41550211f9d7dee9f336aa227dd0dabe016cab401872b7411313

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
2e0a127bf1c538a6f1af27e7864cecb0

SHA1
6173a5b686afb51a525345136f82aeb57b5da11b

SHA256
69556fd0a3b2bc48d6a6f995cf3224314fea8069967c3821576aa10bdf0beea4

SHA512
a6f4e3a1cd4b7092dc152c94548f0715503e9967cf87db10c42ea2261e18cd1329afa1b93952c2404cdfa7a083a64fa3a6c48be4168efd44c9d27c03ea0780b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
d41980ea626e85f916125fb6eef2191f

SHA1
887e31bd8e54b1ea29622a0d67fe40303f91c977

SHA256
34f17298690041ff56a9e89836d5a619f908d281cc3f81dd1ddd26770e7c3010

SHA512
232eab5016db0a02e27ea47d2d5203138501ecbed7afb91665a4d70cafd605a009ff2e829a918faa0870647b6fe8fe48366bff9b912ce7c6be9a7bcd5048d6b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
5f172fe0e5ddf1623206660b4b68c321

SHA1
f8524ba962b428a41fd91fe8925ba092bd5d8918

SHA256
1e23bc6b0b9c738599aeb166d98c14cda577f52e38a292fcd59bce244a4a9fa2

SHA512
c8f7fc045137977869a0e5385f977f2ad81c25d1a2119818b87c038eb544bcf2b8d0c545ef0d78dafb5faeab9a0fb5c860828cde288d634aca4363502a22e8d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
d8e218b50fb49858a19a900d7d256e70

SHA1
7f58a84b22b6dbcce0e793dbba5ec9a34fce99f5

SHA256
5db2116df6ee42b811b93561a9489c298a391de6708bd52b5c44285c046d5a3f

SHA512
1f36b07cbdf31254b858edd89a5d2e8a7a1f46defc6e586422811d64097f1f23660bd65b56727e190bff9a913b95e7af243eb2ffa8dc1115aaad6ba280a7359e

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
121d2cd2070968b84fa474f55eef7d82

SHA1
b78621f20a316ab9c722179c1c08c1cbffec1cb1

SHA256
45f7536513413de1a99e6fc669b5d0a2b865f7cac92dc6f71627207e64e6aab4

SHA512
c28ae89e1122a7f6577718cd23b3bb38fb6755318684af745afe9a8ac0c4b2be398ce5de518d849754afb78a713a6bd33fd1f1a5a5661baa8bc13a9fd8a978d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
d44e790869b9db6d95f1da2c60ade2de

SHA1
e0c365ee8ba47b9c47dbee44c9ceb58f6b5ff51d

SHA256
945a077e47c4d1fc3c729901d9619a99eefe3584c6ecd51ef914ecee02b30f3e

SHA512
f2a3a565d8e6d3378cb3d4e31b944fa3674f0d6fd8d54da5cb9e64d2117a7b27084ffccbb4fee1f5d3f34685e99811ee6c967b7852e453b8cdce71d02d4699d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
21ec2f96c031610d1cda26109d92d5cb

SHA1
6bb278390bb06cbe2c298a69efedf27449f77188

SHA256
1452827082cfa3755710bae70aa4fe571e3546c51f09ec38584277ed1b307deb

SHA512
2ed30d6890674076816a3b6ea285e13d573e20d621611761b8ee85d807439e2cc2195e9b28e8d473df1c28716d92d7c63f65e626ceb7238053bfbd61950ee420

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
77f0b29f90d0c8d09c8d9c36b461faf0

SHA1
81b59e0d1ec2098c39f66f290d1c04f4bfef66e4

SHA256
5bb767ede3dcd14ed787fe71d7048101e478b1236243f8b102bce947d65c6b3a

SHA512
61990e59abe796148e7e503cc19191572d12491e8d8f793d6d95f195906eab572c8b2184df3e036996c3347207b64f8746b9e0b1d7e855b2e491146d763cec73

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
aeceff850d2e4c8440f2b8645ee521da

SHA1
bf8c44aeebbbd923b40130f133a09efbc96a600a

SHA256
0560cd502ce538e4e498d3033da51423a9d30394d432d89c1551646a5856a631

SHA512
04de26517ec82d0ca37b0e8c1916394d3222133e001b93ae8c912fb625f685a1464c6fe056b4629f5d5c04e596dd9469f5184596c27946c0d9a717adbcd51646

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
bec7d6a98896e3e0cc3d1d4aeb4b1145

SHA1
870ed6240caa98b05f0422717d25dd6cf7e0b9c1

SHA256
f5ab23d1cf1b322c0748637410db3d46e6ef75756afeb826a374e0abe6a019a7

SHA512
b0b6d7a8ae3a38ec842a1c8520bca4ecb69693d1a4b1adfaa9518f3238b5cb7d063296a36a334118b9a8d7b1a739a02a807be38f7bb9caac8bfbaa60007f7305

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
68770431d3dd85a585f96d159350b6ff

SHA1
0f3d06531ef061b3544383a244841e72aaea66cd

SHA256
ef79b14bd8131842e818549a5b191bafc4a1a95498670a399de2a4be6c17750c

SHA512
992cbcfdc450a0145dae9c7a9414232474c67c8e838ccd52f9b4ed3b45194b580f2a21632b27d941ea96383eecd17ba8ba60ead536ec8bc492862a5fc749b432

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
7f2046d70bbf5c89899875ac9ffc6123

SHA1
0991ef84744449733229d95d970abab405ea2610

SHA256
68a7b8237a54aa050ff683e2f2e845a6fb199e15d7e7f0fc8d9bd7872e67ccb8

SHA512
f3c41d7d16127eef8f342d84e5156feb814c058b30f462eaa00ac41ffd0eda29f01e94a483b739ef42e9c0b9dad7e749a055e225875729b54d0c36fccf2bc9e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
1def712ae9047673022a13fc94413435

SHA1
4a810ef84adcea2f1a5f52b5e895c0dab3ba0acc

SHA256
05b8a4119d45a6f1683586b57603d97af7d92585a39e1cd4310b809171b33c49

SHA512
7befad2d386384261f16463dde5f7a1c3edb9beeebede0d00a75694adf217528869ac6f8658d5a3fcd7bb2f0df01180396f1a18c0695eb865933318f2e57fd60

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
e12cff8bcb2b4961215013acea9afeb2

SHA1
164880db04dbb902b18678e42ae70dadbad12996

SHA256
c23adbe70377c3278c412147e312e3e702df5a39a796edc36a47c6d3781453fb

SHA512
a41dc9c885dc9d7833aa4087b36edb56824c5279f0c4d23e57de314fd46fd5e9f25d4f006e28c98563503f77a0fd9575741f7a0e2d6e4d88b2ba3bc2981fa037

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
33bb4d9f6ba1a2117785107296a9b961

SHA1
20a206c4f4df8824e2e69c65f9ab4f1fbbda15e5

SHA256
8fdb9fb92263e027c9133b3d8165323d5df77cc68298483404d9bcbc30a2fa66

SHA512
22f4d8bdcb52d5475a266d8211cfbdc2b270475d26fb5d8d617fb2a53afc4adb580e77b5aaf67e009439599b8d78ddd8c32466072178357cc2470ed800cdcbb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
a9a23ee333d778d4ee2e7f213969de99

SHA1
84154a87856def190cba46142b0571e7c74bd87a

SHA256
affaccd3018ad514bcdb250b4e8bdc10693bf434d7b6c11a0fdf24bcbf26f9d8

SHA512
fce95f0e6a642947ce72bbfb16009776754d0f16109eda3ac1e9c0e2869b514770eae8be9da239fb99505ae32b11c00416a67e6b5423dd25ca6c8f6cb8b6eef4

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
8f3235cf0cc86f8aab9bb0323ab4472f

SHA1
d81a0efbcfca5a81cac12fb6847f766bc1a0c712

SHA256
eb4e474b15b260efc02e97d8331df6ce7892ca3f1a2dbdba141ee7b56011e77e

SHA512
a1c3d5fe9a94c9f41ad33e049751a891338f8a93a0e6d50875e0fd05997f403399c23e14d7dd341b6403f329318cb175f9bc1b9a8b5e8591b41d654dbb3d328c

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
1ce7f077ab02f068fc68077b32fb372a

SHA1
d2edaa28644d8f16b948a7db6019a86f794e32e4

SHA256
499b8b5b95d1c885da2ca7b634b43e11597dc25a7f26eee288745e02a5b7a40c

SHA512
74137a625100d5a0a0738f940d926af4bb2a17182607709a5604254d456db524792b6713102fb93cf1378045e2fefdc3ec2d5bfb8afe96b9ee5aeed34362cc2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\NewTask.xml

Filesize
1KB

MD5
a48ba37d50ee79bd924c756089d79db6

SHA1
f51cbc8027c57f83c10441f7d32efd8971cb7bfd

SHA256
c46c6a5d56a7b603659659870e438951140a3bbb44fd2d1a319674b29cad6bac

SHA512
3a8c2f815a94572a5063b90cb98937f2609fa4d76c07abd5754bd009adf83621b7fdb8f4547809fa6b7ca838cdd716656c525187a28d7ab052e571cae77af9b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plague\RCX6215.tmp

Filesize
967KB

MD5
c01481cc14f98455d7d815b260213893

SHA1
c1781719d8d64e3f3c4a755e8f46ca83b9803edf

SHA256
266a173350354b2831a2cf32849e664421c5ed2c2bf0b0254e6aea690dcbeadf

SHA512
7954ef5c54c68e3904888f9ea0928e44640ba0c2f2b1f21f775993b114104fbe5b85f76a0aa80469e131d9cafadcfbb820a443124484c7caeb8ee48557b9b6b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Plague\winmgr.exe

Filesize
967KB

MD5
dd9a2edf17f5be8c871b7391a6739f89

SHA1
cebd20ebdc923133ca26babec4375aa859e0c09b

SHA256
216f78a4be6357c2990ff1db5c359457d140ff27e71e9dcb374d119046e053f7

SHA512
e273d6f46beede6ab43523b49b1db3461374e17952e89bef451c1cd46ed9a8d7b894b19b3d4f28bf345f198f71fc54dc625151573c1e83bfca52a51545252f2f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads