resource	yara_rule
behavioral1/memory/1116-2-0x0000000004F60000-0x000000000584B000-memory.dmp	family_glupteba
behavioral1/memory/1116-3-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/1116-57-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/1116-59-0x0000000004F60000-0x000000000584B000-memory.dmp	family_glupteba
behavioral1/memory/1020-86-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/1020-137-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/808-163-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/808-166-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/808-223-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/808-225-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/808-227-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/808-229-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/808-231-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/808-233-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/808-235-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba
behavioral1/memory/808-237-0x0000000000400000-0x0000000002ED3000-memory.dmp	family_glupteba

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

description	ioc	Process
File opened for modification	C:\Windows\rss	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
File created	C:\Windows\rss\csrss.exe	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-3051 = "Qyzylorda Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-362 = "GTB Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-121 = "SA Pacific Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe

pid	Process
2560	powershell.exe
2560	powershell.exe
1116	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
1116	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
4972	powershell.exe
4972	powershell.exe
1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
2372	powershell.exe
2372	powershell.exe
4888	powershell.exe
4888	powershell.exe
3552	powershell.exe
3552	powershell.exe
4200	powershell.exe
4200	powershell.exe
1912	powershell.exe
1912	powershell.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
808	csrss.exe
808	csrss.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
808	csrss.exe
808	csrss.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe
2092	injector.exe

description	pid	Process
Token: SeDebugPrivilege	2560	powershell.exe
Token: SeDebugPrivilege	1116	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Token: SeImpersonatePrivilege	1116	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe
Token: SeDebugPrivilege	4972	powershell.exe
Token: SeDebugPrivilege	2372	powershell.exe
Token: SeDebugPrivilege	4888	powershell.exe
Token: SeDebugPrivilege	3552	powershell.exe
Token: SeDebugPrivilege	4200	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeSystemEnvironmentPrivilege	808	csrss.exe

description	pid	Process	procid_target
PID 1116 wrote to memory of 2560	1116	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	88
PID 1116 wrote to memory of 2560	1116	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	88
PID 1116 wrote to memory of 2560	1116	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	88
PID 1020 wrote to memory of 4972	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	93
PID 1020 wrote to memory of 4972	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	93
PID 1020 wrote to memory of 4972	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	93
PID 1020 wrote to memory of 3096	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	95
PID 1020 wrote to memory of 3096	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	95
PID 3096 wrote to memory of 1512	3096	cmd.exe	97
PID 3096 wrote to memory of 1512	3096	cmd.exe	97
PID 1020 wrote to memory of 2372	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	99
PID 1020 wrote to memory of 2372	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	99
PID 1020 wrote to memory of 2372	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	99
PID 1020 wrote to memory of 4888	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	101
PID 1020 wrote to memory of 4888	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	101
PID 1020 wrote to memory of 4888	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	101
PID 1020 wrote to memory of 808	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	103
PID 1020 wrote to memory of 808	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	103
PID 1020 wrote to memory of 808	1020	31a25019889dd75ec99f4c5efbc753a0438279b96ef6dbdbb309018cf7926fa3.exe	103
PID 808 wrote to memory of 3552	808	csrss.exe	108
PID 808 wrote to memory of 3552	808	csrss.exe	108
PID 808 wrote to memory of 3552	808	csrss.exe	108
PID 808 wrote to memory of 4200	808	csrss.exe	114
PID 808 wrote to memory of 4200	808	csrss.exe	114
PID 808 wrote to memory of 4200	808	csrss.exe	114
PID 808 wrote to memory of 1912	808	csrss.exe	118
PID 808 wrote to memory of 1912	808	csrss.exe	118
PID 808 wrote to memory of 1912	808	csrss.exe	118
PID 808 wrote to memory of 2092	808	csrss.exe	120
PID 808 wrote to memory of 2092	808	csrss.exe	120

pid	Process
4448	schtasks.exe
4972	schtasks.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

DNS Request

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.