57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b

Analysis

max time kernel
94s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2024, 09:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Size 516KB
Sample241107-lcgypazelp
SHA256 57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b
MD5 d1c341f0c78245398af010f76b044471
SHA1 b3113b357763701c7c7934097bbb453ed6583f73
SHA512 23517d43c282fef152345d0f6776bb7d8cd1f65c0842e1e54ec5fa20521834da6b70ac5d76244ffac79bfc162aceddaffa848f6269c0c25404596e49706b065c
SSDEEP 12288:v+VQlpaJ1gVlwNRqO5LYr4TN9RrFpFNQLyO+9j:v+ulpVcg88E3rFpFNsO
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery upx

Malware Config

Signatures

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1212-0-0x0000000000400000-0x0000000000502000-memory.dmp	upx
behavioral2/memory/3436-2-0x0000000000400000-0x0000000000502000-memory.dmp	upx
behavioral2/memory/1212-34-0x0000000000400000-0x0000000000502000-memory.dmp	upx
behavioral2/memory/3376-38-0x0000000000400000-0x0000000000502000-memory.dmp	upx
behavioral2/memory/2400-36-0x0000000000400000-0x0000000000502000-memory.dmp	upx
behavioral2/memory/3376-31-0x0000000000400000-0x0000000000502000-memory.dmp	upx
behavioral2/memory/2400-32-0x0000000000400000-0x0000000000502000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe

Suspicious use of AdjustPrivilegeToken 24 IoCs

description	pid	Process
Token: SeBackupPrivilege	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeRestorePrivilege	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: 33	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeIncBasePriorityPrivilege	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: 33	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeIncBasePriorityPrivilege	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeBackupPrivilege	3436	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeRestorePrivilege	3436	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: 33	3436	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeIncBasePriorityPrivilege	3436	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: 33	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeIncBasePriorityPrivilege	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: 33	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeIncBasePriorityPrivilege	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: 33	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeIncBasePriorityPrivilege	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeBackupPrivilege	2400	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeRestorePrivilege	2400	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: 33	2400	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeIncBasePriorityPrivilege	2400	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeBackupPrivilege	3376	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeRestorePrivilege	3376	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: 33	3376	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
Token: SeIncBasePriorityPrivilege	3376	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 3436	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe	84
PID 1212 wrote to memory of 3436	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe	84
PID 1212 wrote to memory of 3436	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe	84
PID 1212 wrote to memory of 3972	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe	85
PID 1212 wrote to memory of 3972	1212	57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe	85
PID 3972 wrote to memory of 3312	3972	cmd.exe	88
PID 3972 wrote to memory of 3312	3972	cmd.exe	88
PID 3972 wrote to memory of 3948	3972	cmd.exe	89
PID 3972 wrote to memory of 3948	3972	cmd.exe	89
PID 3972 wrote to memory of 100	3972	cmd.exe	90
PID 3972 wrote to memory of 100	3972	cmd.exe	90
PID 3972 wrote to memory of 1296	3972	cmd.exe	91
PID 3972 wrote to memory of 1296	3972	cmd.exe	91
PID 3972 wrote to memory of 220	3972	cmd.exe	92
PID 3972 wrote to memory of 220	3972	cmd.exe	92
PID 3972 wrote to memory of 392	3972	cmd.exe	93
PID 3972 wrote to memory of 392	3972	cmd.exe	93
PID 3972 wrote to memory of 620	3972	cmd.exe	94
PID 3972 wrote to memory of 620	3972	cmd.exe	94
PID 3972 wrote to memory of 1556	3972	cmd.exe	95
PID 3972 wrote to memory of 1556	3972	cmd.exe	95
PID 3972 wrote to memory of 804	3972	cmd.exe	96
PID 3972 wrote to memory of 804	3972	cmd.exe	96
PID 3972 wrote to memory of 2368	3972	cmd.exe	97
PID 3972 wrote to memory of 2368	3972	cmd.exe	97
PID 3972 wrote to memory of 2984	3972	cmd.exe	98
PID 3972 wrote to memory of 2984	3972	cmd.exe	98
PID 3972 wrote to memory of 1908	3972	cmd.exe	99
PID 3972 wrote to memory of 1908	3972	cmd.exe	99
PID 3972 wrote to memory of 2080	3972	cmd.exe	100
PID 3972 wrote to memory of 2080	3972	cmd.exe	100
PID 3972 wrote to memory of 2288	3972	cmd.exe	101
PID 3972 wrote to memory of 2288	3972	cmd.exe	101
PID 3972 wrote to memory of 4192	3972	cmd.exe	102
PID 3972 wrote to memory of 4192	3972	cmd.exe	102
PID 3972 wrote to memory of 4224	3972	cmd.exe	103
PID 3972 wrote to memory of 4224	3972	cmd.exe	103
PID 3972 wrote to memory of 1604	3972	cmd.exe	104
PID 3972 wrote to memory of 1604	3972	cmd.exe	104
PID 3972 wrote to memory of 5100	3972	cmd.exe	106
PID 3972 wrote to memory of 5100	3972	cmd.exe	106
PID 3972 wrote to memory of 2220	3972	cmd.exe	107
PID 3972 wrote to memory of 2220	3972	cmd.exe	107
PID 3972 wrote to memory of 2840	3972	cmd.exe	108
PID 3972 wrote to memory of 2840	3972	cmd.exe	108
PID 3972 wrote to memory of 3104	3972	cmd.exe	109
PID 3972 wrote to memory of 3104	3972	cmd.exe	109
PID 3972 wrote to memory of 3516	3972	cmd.exe	110
PID 3972 wrote to memory of 3516	3972	cmd.exe	110
PID 3972 wrote to memory of 3600	3972	cmd.exe	111
PID 3972 wrote to memory of 3600	3972	cmd.exe	111
PID 3972 wrote to memory of 388	3972	cmd.exe	112
PID 3972 wrote to memory of 388	3972	cmd.exe	112
PID 3972 wrote to memory of 4060	3972	cmd.exe	113
PID 3972 wrote to memory of 4060	3972	cmd.exe	113
PID 3972 wrote to memory of 3652	3972	cmd.exe	114
PID 3972 wrote to memory of 3652	3972	cmd.exe	114
PID 3972 wrote to memory of 4236	3972	cmd.exe	115
PID 3972 wrote to memory of 4236	3972	cmd.exe	115
PID 3972 wrote to memory of 2012	3972	cmd.exe	116
PID 3972 wrote to memory of 2012	3972	cmd.exe	116
PID 3972 wrote to memory of 3304	3972	cmd.exe	117
PID 3972 wrote to memory of 3304	3972	cmd.exe	117
PID 3972 wrote to memory of 4708	3972	cmd.exe	118

C:\Users\Admin\AppData\Local\Temp\57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
"C:\Users\Admin\AppData\Local\Temp\57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Local\Temp\57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
  PECMD**pecmd-cmd* PUTF "C:\Users\Admin\AppData\Local\Temp\~~3861335567790922385.tmp.bat",,"C:\Users\Admin\AppData\Local\Temp\57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe""#102|SCRIPT"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3436
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\~~3861335567790922385.tmp.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\System32\reg.exe
    Reg.exe query "HKU\S-1-5-19\Environment"
    3⤵
    PID:3312
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "isFirst" /t REG_DWORD /d "0" /f
    3⤵
    PID:3948
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "appEditionStrEn" /t REG_SZ /d "TRI" /f
    3⤵
    PID:100
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "maximizeState" /t REG_DWORD /d "0" /f
    3⤵
    PID:1296
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "sRecentFolder" /t REG_SZ /d "" /f
    3⤵
    PID:220
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "lastErrorDay" /t REG_DWORD /d "0" /f
    3⤵
    PID:392
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "lastErrorDayCount" /t REG_DWORD /d "0" /f
    3⤵
    PID:620
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "serverBuildNo" /t REG_DWORD /d "0" /f
    3⤵
    PID:1556
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "serverBuildNoCur" /t REG_DWORD /d "0" /f
    3⤵
    PID:804
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "lastUpdateCheckDay" /t REG_DWORD /d "20240704" /f
    3⤵
    PID:2368
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "lastShowADDay" /t REG_DWORD /d "0" /f
    3⤵
    PID:2984
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "sizeSelFolderDlg.cx" /t REG_DWORD /d "0" /f
    3⤵
    PID:1908
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "sizeSelFolderDlg.cy" /t REG_DWORD /d "0" /f
    3⤵
    PID:2080
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "openFolderRecursive" /t REG_DWORD /d "0" /f
    3⤵
    PID:2288
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "rectView.left" /t REG_DWORD /d "655" /f
    3⤵
    PID:4192
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "rectView.top" /t REG_DWORD /d "10" /f
    3⤵
    PID:4224
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "rectView.right" /t REG_DWORD /d "1905" /f
    3⤵
    PID:1604
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "rectView.bottom" /t REG_DWORD /d "1010" /f
    3⤵
    PID:5100
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "sizeNavDlg96.cx" /t REG_DWORD /d "0" /f
    3⤵
    PID:2220
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "sizeNavDlg96.cy" /t REG_DWORD /d "0" /f
    3⤵
    PID:2840
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "navListItemWidth96[NAVLISTITEM_NAME]" /t REG_DWORD /d "300" /f
    3⤵
    PID:3104
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "navListItemWidth96[NAVLISTITEM_DATE]" /t REG_DWORD /d "180" /f
    3⤵
    PID:3516
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "navListItemWidth96[NAVLISTITEM_SIZE]" /t REG_DWORD /d "100" /f
    3⤵
    PID:3600
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "navThumbPanelHeight" /t REG_DWORD /d "100" /f
    3⤵
    PID:388
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "sizeMetaDlg96.cx" /t REG_DWORD /d "0" /f
    3⤵
    PID:4060
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "sizeMetaDlg96.cy" /t REG_DWORD /d "0" /f
    3⤵
    PID:3652
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "darkMode" /t REG_DWORD /d "0" /f
    3⤵
    PID:4236
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "esc2exit" /t REG_DWORD /d "1" /f
    3⤵
    PID:2012
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "oneInstance" /t REG_DWORD /d "0" /f
    3⤵
    PID:3304
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "askDelete" /t REG_DWORD /d "1" /f
    3⤵
    PID:4708
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "alwaysOnTop" /t REG_DWORD /d "0" /f
    3⤵
    PID:3628
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "useSnap" /t REG_DWORD /d "1" /f
    3⤵
    PID:1340
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "lastFileActionImage" /t REG_DWORD /d "2" /f
    3⤵
    PID:1620
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "lastFileActionArchive" /t REG_DWORD /d "1" /f
    3⤵
    PID:2224
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "updateChk" /t REG_DWORD /d "0" /f
    3⤵
    PID:1964
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "updateBeta" /t REG_DWORD /d "0" /f
    3⤵
    PID:956
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "language" /t REG_SZ /d "TradChinese" /f
    3⤵
    PID:3076
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "lockTitleBarFull" /t REG_DWORD /d "0" /f
    3⤵
    PID:3052
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "lockTitleBarNormal" /t REG_DWORD /d "1" /f
    3⤵
    PID:3744
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "lockControlBar" /t REG_DWORD /d "1" /f
    3⤵
    PID:436
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "showTitlebar" /t REG_DWORD /d "0" /f
    3⤵
    PID:3724
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "showControlbar" /t REG_DWORD /d "0" /f
    3⤵
    PID:3388
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "showScrollbar" /t REG_DWORD /d "1" /f
    3⤵
    PID:4024
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "showSideArrow" /t REG_DWORD /d "1" /f
    3⤵
    PID:2424
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "showExifInfo" /t REG_DWORD /d "0" /f
    3⤵
    PID:5060
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "showBorder" /t REG_DWORD /d "0" /f
    3⤵
    PID:4512
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "showMiniTitle" /t REG_DWORD /d "0" /f
    3⤵
    PID:844
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "clrBkgnd" /t REG_DWORD /d "2105376" /f
    3⤵
    PID:2788
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "clrBorder" /t REG_DWORD /d "4473924" /f
    3⤵
    PID:1288
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "showAnimInfo" /t REG_DWORD /d "1" /f
    3⤵
    PID:2708
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "showMessage" /t REG_DWORD /d "1" /f
    3⤵
    PID:2072
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "showZoomControl" /t REG_DWORD /d "1" /f
    3⤵
    PID:1920
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "dpiPercent" /t REG_DWORD /d "0" /f
    3⤵
    PID:3880
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "applyDPISettings2Img" /t REG_DWORD /d "1" /f
    3⤵
    PID:1088
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "titleFormat" /t REG_SZ /d "${folder} ${sep} ${file} [${page}/${total}]" /f
    3⤵
    PID:3876
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "exifRotation" /t REG_DWORD /d "1" /f
    3⤵
    PID:4104
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "cacheImage" /t REG_DWORD /d "1" /f
    3⤵
    PID:4704
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "cacheSizeMB" /t REG_DWORD /d "600" /f
    3⤵
    PID:2724
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "cacheSizeMB64" /t REG_DWORD /d "600" /f
    3⤵
    PID:3356
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "usePreviewMode" /t REG_DWORD /d "1" /f
    3⤵
    PID:4724
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "applyImageIccProfile" /t REG_DWORD /d "1" /f
    3⤵
    PID:1236
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "applyMonitorIccProfile" /t REG_DWORD /d "0" /f
    3⤵
    PID:2812
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "set32BPPBkgnd" /t REG_DWORD /d "0" /f
    3⤵
    PID:4808
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "transImgBkgnd" /t REG_DWORD /d "0" /f
    3⤵
    PID:876
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "set2pagespace" /t REG_DWORD /d "0" /f
    3⤵
    PID:2340
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "twoPageSpace" /t REG_DWORD /d "10" /f
    3⤵
    PID:508
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "separateCoverPage" /t REG_DWORD /d "0" /f
    3⤵
    PID:3960
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "clipAdvanced" /t REG_DWORD /d "0" /f
    3⤵
    PID:4352
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "rawfileJpegThumbnail" /t REG_DWORD /d "0" /f
    3⤵
    PID:1800
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "useArrowKey2ScrollOnly" /t REG_DWORD /d "0" /f
    3⤵
    PID:2856
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "userKeys.count" /t REG_DWORD /d "0" /f
    3⤵
    PID:1768
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.lbtn.enable" /t REG_DWORD /d "0" /f
    3⤵
    PID:2148
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.lbtn.cmd" /t REG_SZ /d "CMD_NULL" /f
    3⤵
    PID:1932
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.dbtn.enable" /t REG_DWORD /d "1" /f
    3⤵
    PID:4508
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.dbtn.cmd" /t REG_SZ /d "CMD_EXIT" /f
    3⤵
    PID:2256
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.mbtn.enable" /t REG_DWORD /d "0" /f
    3⤵
    PID:4728
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.mbtn.cmd" /t REG_SZ /d "CMD_NULL" /f
    3⤵
    PID:4308
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.rbtn.enable" /t REG_DWORD /d "0" /f
    3⤵
    PID:1764
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.rbtn.cmd" /t REG_SZ /d "CMD_NULL" /f
    3⤵
    PID:1900
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.xbtn.enable" /t REG_DWORD /d "0" /f
    3⤵
    PID:1160
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.xbtn.cmd" /t REG_SZ /d "CMD_NULL" /f
    3⤵
    PID:3636
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.ybtn.enable" /t REG_DWORD /d "0" /f
    3⤵
    PID:1360
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.ybtn.cmd" /t REG_SZ /d "CMD_NULL" /f
    3⤵
    PID:60
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.wheelup.enable" /t REG_DWORD /d "0" /f
    3⤵
    PID:944
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.wheelup.cmd" /t REG_SZ /d "CMD_NULL" /f
    3⤵
    PID:1516
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.wheeldn.enable" /t REG_DWORD /d "0" /f
    3⤵
    PID:1744
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.wheeldn.cmd" /t REG_SZ /d "CMD_NULL" /f
    3⤵
    PID:4812
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "mouseCustom.leftClick2PageTurn" /t REG_DWORD /d "0" /f
    3⤵
    PID:1328
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "clickCanvas2ShowControls" /t REG_DWORD /d "0" /f
    3⤵
    PID:3916
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "useMouseWheelBounce" /t REG_DWORD /d "1" /f
    3⤵
    PID:4744
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "rememberFilePosInArchive" /t REG_DWORD /d "1" /f
    3⤵
    PID:716
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "rememberFilePosInFolder" /t REG_DWORD /d "0" /f
    3⤵
    PID:3672
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "shellMenuEnable" /t REG_DWORD /d "0" /f
    3⤵
    PID:1568
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "shellMenuViewer" /t REG_DWORD /d "1" /f
    3⤵
    PID:1440
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "shellMenuConv" /t REG_DWORD /d "1" /f
    3⤵
    PID:3480
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "shellMenuConvShift" /t REG_DWORD /d "0" /f
    3⤵
    PID:3872
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "shellMenuOnFolder" /t REG_DWORD /d "1" /f
    3⤵
    PID:4648
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "shellMenuOnBkgnd" /t REG_DWORD /d "1" /f
    3⤵
    PID:2624
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "photoFolder1" /t REG_SZ /d "C:\Users\Administrator\Pictures\BandiView" /f
    3⤵
    PID:4448
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "photoFolder2" /t REG_SZ /d "" /f
    3⤵
    PID:3444
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "useUserTempFolder" /t REG_DWORD /d "0" /f
    3⤵
    PID:4456
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "userTempFolder" /t REG_SZ /d "C:\Users\ADMINI~1\AppData\Local\Temp\\" /f
    3⤵
    PID:396
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "resizeWindow2FitImage" /t REG_DWORD /d "0" /f
    3⤵
    PID:4500
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "disableScreenSaver" /t REG_DWORD /d "0" /f
    3⤵
    PID:3016
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "fixNewWindowPos" /t REG_DWORD /d "0" /f
    3⤵
    PID:2512
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "extProg0" /t REG_SZ /d "" /f
    3⤵
    PID:3504
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "videoOutput" /t REG_DWORD /d "0" /f
    3⤵
    PID:1136
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "hdrMode" /t REG_DWORD /d "0" /f
    3⤵
    PID:2596
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "viewMode.stretchMode" /t REG_DWORD /d "5" /f
    3⤵
    PID:220
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "viewMode.enlage_when_small" /t REG_DWORD /d "0" /f
    3⤵
    PID:2376
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "viewMode.rotateUsingExif" /t REG_DWORD /d "0" /f
    3⤵
    PID:2988
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "viewMode.resizeMode" /t REG_DWORD /d "1" /f
    3⤵
    PID:5112
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "viewMode.interMode" /t REG_DWORD /d "1" /f
    3⤵
    PID:3100
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "viewMode.sharpeness" /t REG_DWORD /d "20" /f
    3⤵
    PID:4392
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "viewMode.gamma1000" /t REG_DWORD /d "450" /f
    3⤵
    PID:2368
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "sort.method" /t REG_DWORD /d "1" /f
    3⤵
    PID:3924
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "sort.ascending" /t REG_DWORD /d "1" /f
    3⤵
    PID:2968
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "folder_sort.method" /t REG_DWORD /d "1" /f
    3⤵
    PID:2096
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "folder_sort.ascending" /t REG_DWORD /d "1" /f
    3⤵
    PID:2156
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "zoomLock" /t REG_DWORD /d "0" /f
    3⤵
    PID:2288
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "zoomLastValuePercent" /t REG_DWORD /d "0" /f
    3⤵
    PID:4192
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "scrollLock" /t REG_DWORD /d "0" /f
    3⤵
    PID:4224
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "scrollLockInfo.pos.x" /t REG_DWORD /d "0" /f
    3⤵
    PID:5056
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "scrollLockInfo.pos.y" /t REG_DWORD /d "0" /f
    3⤵
    PID:2668
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "scrollLockInfo.snapR" /t REG_DWORD /d "0" /f
    3⤵
    PID:1992
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "scrollLockInfo.snapB" /t REG_DWORD /d "0" /f
    3⤵
    PID:4948
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "popt.marginL" /t REG_DWORD /d "15" /f
    3⤵
    PID:3152
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "popt.marginT" /t REG_DWORD /d "15" /f
    3⤵
    PID:3700
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "popt.marginR" /t REG_DWORD /d "15" /f
    3⤵
    PID:1668
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "popt.marginB" /t REG_DWORD /d "15" /f
    3⤵
    PID:2252
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "popt.zoomRatio" /t REG_DWORD /d "100" /f
    3⤵
    PID:3668
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "popt.rotate" /t REG_DWORD /d "0" /f
    3⤵
    PID:3564
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "popt.fitIn" /t REG_DWORD /d "0" /f
    3⤵
    PID:4236
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "wp_bkcolorMode" /t REG_DWORD /d "0" /f
    3⤵
    PID:2012
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "wp_bkcolor" /t REG_DWORD /d "16777215" /f
    3⤵
    PID:4696
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShow.loop" /t REG_DWORD /d "1" /f
    3⤵
    PID:2044
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShow.random" /t REG_DWORD /d "0" /f
    3⤵
    PID:1628
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShowTime[0]" /t REG_DWORD /d "1000" /f
    3⤵
    PID:3128
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShowTime[1]" /t REG_DWORD /d "2000" /f
    3⤵
    PID:4040
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShowTime[2]" /t REG_DWORD /d "3000" /f
    3⤵
    PID:4984
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShowTime[3]" /t REG_DWORD /d "4000" /f
    3⤵
    PID:1964
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShowTime[4]" /t REG_DWORD /d "5000" /f
    3⤵
    PID:4108
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShowTime[5]" /t REG_DWORD /d "6000" /f
    3⤵
    PID:1372
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShowTime[6]" /t REG_DWORD /d "7000" /f
    3⤵
    PID:2408
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShowTime[7]" /t REG_DWORD /d "8000" /f
    3⤵
    PID:992
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShowTime[8]" /t REG_DWORD /d "9000" /f
    3⤵
    PID:3976
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "slideShow.pageTurnFX" /t REG_DWORD /d "0" /f
    3⤵
    PID:2236
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "group.raw_jpg" /t REG_DWORD /d "0" /f
    3⤵
    PID:3724
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "group.raw_show_jpg" /t REG_DWORD /d "1" /f
    3⤵
    PID:3388
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "group.psd_jpg" /t REG_DWORD /d "0" /f
    3⤵
    PID:4024
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "group.psd_show_jpg" /t REG_DWORD /d "1" /f
    3⤵
    PID:2200
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "group.del_both" /t REG_DWORD /d "0" /f
    3⤵
    PID:5060
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "group.ren_both" /t REG_DWORD /d "0" /f
    3⤵
    PID:1480
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "group.cpy_both" /t REG_DWORD /d "0" /f
    3⤵
    PID:960
- - C:\Windows\System32\reg.exe
    Reg.exe add "HKCU\SOFTWARE\BandiView" /v "debug_setting_tab" /t REG_DWORD /d "0" /f
    3⤵
    PID:4160
- C:\Users\Admin\AppData\Local\Temp\57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~244128506949843720.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~244128506949843720.cmd"
    3⤵
    PID:2460
- C:\Users\Admin\AppData\Local\Temp\57cb9791095c8246ffca12b55584394fc41c814870b44360b8d418063531f58b.exe
  PECMD**pecmd-cmd* EXEC -wd:C: -hide cmd /c "C:\Users\Admin\AppData\Local\Temp\~7056257910315179073.cmd"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\~7056257910315179073.cmd"
    3⤵
    PID:4724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

~244128506949843720.cmd

Path C:\Users\Admin\AppData\Local\Temp\~244128506949843720.cmd
Size 404B
SHA256 72638d98c68726a4bbc6fb955df4cd2b4e521150e6c5b53f678e268f5dce83c4
MD5 c9a0087b872ed30b928cf536211cd03d
SHA1 ba5e66253357f04bce112ca018ef2d8c45407fea
SHA512 da3cc757bfe90d770f20992ab6345a46a3de1b641982ef7753d3fd41535a4fb875b9e13657fdfe7e06e341b02a4f17c5ad005a5b86bc3d15262e6f6b239ff0ad
MD5 SHA1 SHA512

Submit Download

~7056257910315179073.cmd

Path C:\Users\Admin\AppData\Local\Temp\~7056257910315179073.cmd
Size 521B
SHA256 253a6edb9aa58802d9ac57525e473ee873e5e98cb471eb5de706202c599fd7a3
MD5 c0e9e5fdc74324274d57bb5b4cf80d0b
SHA1 d6c9740a0fa561142860f43641c23b2e5e505eb8
SHA512 9f87a707c4e298a895791e4d9b61931668aca6e7487039055c94d4c8a473cb4e55bf101cd6715ba75ab3ef61934de4b9d7260b45658c919b40b6ab2c68da401c
MD5 SHA1 SHA512

Submit Download

~~3861335567790922385.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\~~3861335567790922385.tmp.bat
Size 13KB
SHA256 3eddbba2ef05f695f9b9b44d885cbe0ddba4a31b161afbeceac51351a0799a15
MD5 03cbfeba6f188786010fde08c14be517
SHA1 20065cbf17420bc073cced25854dea8133a3433a
SHA512 17c802411719c1713eb0d3bcec6e39472c3702f9ac8c8f5b958284f1d85af46df5488bd4885abad69ec02a18000cc6dd5cf16bfdcd4e17f2d4d0a05a77e4101e
SSDEEP 96:+L0GO7ujo8UluQdztLYCaktlfGF08YNRHP4:y0GOZbdzZYCaktlfT4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1212-0-0x0000000000400000-0x0000000000502000-memory.dmp

Download

memory/1212-34-0x0000000000400000-0x0000000000502000-memory.dmp

Download

memory/2400-36-0x0000000000400000-0x0000000000502000-memory.dmp

Download

memory/2400-32-0x0000000000400000-0x0000000000502000-memory.dmp

Download

memory/3376-38-0x0000000000400000-0x0000000000502000-memory.dmp

Download

memory/3376-31-0x0000000000400000-0x0000000000502000-memory.dmp

Download

memory/3436-2-0x0000000000400000-0x0000000000502000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads