804ceedb4da459b12a480e99c2de2f2b0d248c0e9a928ce8746bd970e745fb8c

Analysis

max time kernel
120s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/11/2024, 21:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe
Size 61KB
Sample241113-z2fntazake
SHA256 804ceedb4da459b12a480e99c2de2f2b0d248c0e9a928ce8746bd970e745fb8c
MD5 fcab8db6a0da3dbc2212a61774e8927c
SHA1 72194bcca73be4e3fb42e29b9563ab60b63d2861
SHA512 95d328bc27dafa155105bea11e6759f7caafc64ff8389d777c93b44effa1f40c123e6e2d38f4b66baed95481a690971f3bdb0509b611de18cc28f31bc885e86b
SSDEEP 1536:UE3HjO+qAAM0ib/fY9npdwLMKcTbImrvcBsFWMmu:jDY9pqLnc9rUBumu
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2284	cmd.exe

Executes dropped EXE 61 IoCs

pid	Process
2220	msfeeds.exe
2192	uianimation.exe
484	samcli.exe
2388	kbdusr.exe
1944	kbdfa.exe
536	cryptbase.exe
2180	duser.exe
2676	netcenter.exe
1776	dpnhpast.exe
796	kbd101a.exe
1288	tvratings.exe
1624	jsintl.exe
1796	sechost.exe
2056	f3ahvoas.exe
1580	api-ms-win-crt-utility-l1-1-0.exe
2412	radarrs.exe
2780	iprtrmgr.exe
2676	shimgvw.exe
1776	taskcomp.exe
2540	kbdmlt48.exe
1700	magnification.exe
2988	odexl32.exe
2388	oleacchooks.exe
2056	wmdmlog.exe
1532	wkscli.exe
2680	rdpendp.exe
1672	mfc100.exe
1012	vdsbas.exe
444	msafd.exe
644	radarrs.exe
2628	dpwsockx.exe
1636	racengn.exe
2912	eapqec.exe
1376	mfc120ita.exe
2488	pid.exe
1556	wscproxystub.exe
1684	fthsvc.exe
3036	catsrvps.exe
2372	cmutil.exe
1044	winsrpc.exe
780	catsrvps.exe
844	msieftp.exe
2348	actioncentercpl.exe
1376	dinput.exe
2600	nlslexicons0003.exe
1504	resampledmo.exe
2316	searchfolder.exe
1368	expsrv.exe
2556	fdpnp.exe
2128	xpssvcs.exe
2156	api-ms-win-security-sddl-l1-1-0.exe
2684	msdmo.exe
2840	msvcp140_1.exe
2364	oleacc.exe
1040	puiapi.exe
1596	sqmapi.exe
1144	wshelper.exe
2260	vccorlib140.exe
2356	kbdlt2.exe
1584	loghours.exe
2824	odbc32gt.exe

Loads dropped DLL 64 IoCs

pid	Process
3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe
3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe
3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe
3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe
2220	msfeeds.exe
2220	msfeeds.exe
2220	msfeeds.exe
2220	msfeeds.exe
2220	msfeeds.exe
2192	uianimation.exe
2192	uianimation.exe
2192	uianimation.exe
2192	uianimation.exe
2192	uianimation.exe
484	samcli.exe
484	samcli.exe
484	samcli.exe
484	samcli.exe
484	samcli.exe
2388	kbdusr.exe
2388	kbdusr.exe
2388	kbdusr.exe
2388	kbdusr.exe
2388	kbdusr.exe
1760	WerFault.exe
1760	WerFault.exe
1760	WerFault.exe
1944	kbdfa.exe
1944	kbdfa.exe
1944	kbdfa.exe
1944	kbdfa.exe
1944	kbdfa.exe
536	cryptbase.exe
536	cryptbase.exe
536	cryptbase.exe
536	cryptbase.exe
536	cryptbase.exe
2180	duser.exe
2180	duser.exe
2180	duser.exe
2180	duser.exe
2180	duser.exe
2676	netcenter.exe
2676	netcenter.exe
2676	netcenter.exe
2676	netcenter.exe
2676	netcenter.exe
1776	dpnhpast.exe
1776	dpnhpast.exe
1776	dpnhpast.exe
1776	dpnhpast.exe
1776	dpnhpast.exe
796	kbd101a.exe
796	kbd101a.exe
796	kbd101a.exe
796	kbd101a.exe
796	kbd101a.exe
1288	tvratings.exe
1288	tvratings.exe
1288	tvratings.exe
1288	tvratings.exe
1288	tvratings.exe
1624	jsintl.exe
1624	jsintl.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\cryptbase.exe	kbdfa.exe
File created	C:\Windows\SysWOW64\kbd101a.exe	dpnhpast.exe
File opened for modification	C:\Windows\SysWOW64\expsrv.exe	searchfolder.exe
File created	C:\Windows\SysWOW64\radarrs.exe	msafd.exe
File opened for modification	C:\Windows\SysWOW64\odbc32gt.exe	loghours.exe
File opened for modification	C:\Windows\SysWOW64\odexl32.exe	magnification.exe
File opened for modification	C:\Windows\SysWOW64\radarrs.exe	msafd.exe
File created	C:\Windows\SysWOW64\cmutil.exe	catsrvps.exe
File created	C:\Windows\SysWOW64\loghours.exe	kbdlt2.exe
File opened for modification	C:\Windows\SysWOW64\jsintl.exe	tvratings.exe
File opened for modification	C:\Windows\SysWOW64\actioncentercpl.exe	msieftp.exe
File opened for modification	C:\Windows\SysWOW64\kbd101a.exe	dpnhpast.exe
File opened for modification	C:\Windows\SysWOW64\winsrpc.exe	cmutil.exe
File created	C:\Windows\SysWOW64\actioncentercpl.exe	msieftp.exe
File created	C:\Windows\SysWOW64\dinput.exe	actioncentercpl.exe
File opened for modification	C:\Windows\SysWOW64\racengn.exe	dpwsockx.exe
File opened for modification	C:\Windows\SysWOW64\fthsvc.exe	wscproxystub.exe
File opened for modification	C:\Windows\SysWOW64\wkscli.exe	wmdmlog.exe
File created	C:\Windows\SysWOW64\odbc32gt.exe	loghours.exe
File opened for modification	C:\Windows\SysWOW64\samcli.exe	uianimation.exe
File created	C:\Windows\SysWOW64\wmdmlog.exe	oleacchooks.exe
File opened for modification	C:\Windows\SysWOW64\rdpendp.exe	wkscli.exe
File created	C:\Windows\SysWOW64\wscproxystub.exe	pid.exe
File created	C:\Windows\SysWOW64\winsrpc.exe	cmutil.exe
File created	C:\Windows\SysWOW64\searchfolder.exe	resampledmo.exe
File created	C:\Windows\SysWOW64\catsrvps.exe	fthsvc.exe
File opened for modification	C:\Windows\SysWOW64\cmutil.exe	catsrvps.exe
File opened for modification	C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.exe	f3ahvoas.exe
File created	C:\Windows\SysWOW64\odexl32.exe	magnification.exe
File created	C:\Windows\SysWOW64\oleacchooks.exe	odexl32.exe
File created	C:\Windows\SysWOW64\mfc120ita.exe	eapqec.exe
File created	C:\Windows\SysWOW64\radarrs.exe	api-ms-win-crt-utility-l1-1-0.exe
File opened for modification	C:\Windows\SysWOW64\radarrs.exe	api-ms-win-crt-utility-l1-1-0.exe
File opened for modification	C:\Windows\SysWOW64\loghours.exe	kbdlt2.exe
File created	C:\Windows\SysWOW64\catsrvps.exe	winsrpc.exe
File created	C:\Windows\SysWOW64\msdmo.exe	api-ms-win-security-sddl-l1-1-0.exe
File opened for modification	C:\Windows\SysWOW64\kbdlt2.exe	vccorlib140.exe
File opened for modification	C:\Windows\SysWOW64\uianimation.exe	msfeeds.exe
File created	C:\Windows\SysWOW64\samcli.exe	uianimation.exe
File created	C:\Windows\SysWOW64\kbdusr.exe	samcli.exe
File created	C:\Windows\SysWOW64\fdpnp.exe	expsrv.exe
File opened for modification	C:\Windows\SysWOW64\fdpnp.exe	expsrv.exe
File created	C:\Windows\SysWOW64\xpssvcs.exe	fdpnp.exe
File opened for modification	C:\Windows\SysWOW64\duser.exe	cryptbase.exe
File opened for modification	C:\Windows\SysWOW64\netcenter.exe	duser.exe
File created	C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.exe	f3ahvoas.exe
File opened for modification	C:\Windows\SysWOW64\pid.exe	mfc120ita.exe
File opened for modification	C:\Windows\SysWOW64\xpssvcs.exe	fdpnp.exe
File created	C:\Windows\SysWOW64\wshelper.exe	sqmapi.exe
File created	C:\Windows\SysWOW64\kbdfa.exe	kbdusr.exe
File opened for modification	C:\Windows\SysWOW64\shimgvw.exe	iprtrmgr.exe
File opened for modification	C:\Windows\SysWOW64\kbdmlt48.exe	taskcomp.exe
File opened for modification	C:\Windows\SysWOW64\eapqec.exe	racengn.exe
File created	C:\Windows\SysWOW64\api-ms-win-security-sddl-l1-1-0.exe	xpssvcs.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.exe	wshelper.exe
File opened for modification	C:\Windows\SysWOW64\sechost.exe	jsintl.exe
File opened for modification	C:\Windows\SysWOW64\magnification.exe	kbdmlt48.exe
File created	C:\Windows\SysWOW64\msafd.exe	vdsbas.exe
File created	C:\Windows\SysWOW64\oleacc.exe	msvcp140_1.exe
File created	C:\Windows\SysWOW64\puiapi.exe	oleacc.exe
File created	C:\Windows\SysWOW64\rdpendp.exe	wkscli.exe
File opened for modification	C:\Windows\SysWOW64\mfc120ita.exe	eapqec.exe
File opened for modification	C:\Windows\SysWOW64\mfc100.exe	rdpendp.exe
File created	C:\Windows\SysWOW64\vdsbas.exe	mfc100.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
1760	2388	WerFault.exe	40
1344	1580	WerFault.exe	77
2024	1556	WerFault.exe	143
1284	2156	WerFault.exe	190

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eapqec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	puiapi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kbdfa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	actioncentercpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fdpnp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	samcli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	duser.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jsintl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winsrpc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	odbc32gt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mfc100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	catsrvps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dpwsockx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	searchfolder.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	dpnhpast.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sechost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	catsrvps.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rdpendp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nlslexicons0003.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wshelper.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kbdlt2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	api-ms-win-crt-utility-l1-1-0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	oleacchooks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kbd101a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vdsbas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cryptbase.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskcomp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uianimation.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	radarrs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	racengn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmdmlog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2220	3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	31
PID 3024 wrote to memory of 2220	3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	31
PID 3024 wrote to memory of 2220	3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	31
PID 3024 wrote to memory of 2220	3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	31
PID 3024 wrote to memory of 2284	3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	32
PID 3024 wrote to memory of 2284	3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	32
PID 3024 wrote to memory of 2284	3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	32
PID 3024 wrote to memory of 2284	3024	4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe	32
PID 2220 wrote to memory of 2192	2220	msfeeds.exe	34
PID 2220 wrote to memory of 2192	2220	msfeeds.exe	34
PID 2220 wrote to memory of 2192	2220	msfeeds.exe	34
PID 2220 wrote to memory of 2192	2220	msfeeds.exe	34
PID 2220 wrote to memory of 2740	2220	msfeeds.exe	35
PID 2220 wrote to memory of 2740	2220	msfeeds.exe	35
PID 2220 wrote to memory of 2740	2220	msfeeds.exe	35
PID 2220 wrote to memory of 2740	2220	msfeeds.exe	35
PID 2192 wrote to memory of 484	2192	uianimation.exe	37
PID 2192 wrote to memory of 484	2192	uianimation.exe	37
PID 2192 wrote to memory of 484	2192	uianimation.exe	37
PID 2192 wrote to memory of 484	2192	uianimation.exe	37
PID 2192 wrote to memory of 2364	2192	uianimation.exe	38
PID 2192 wrote to memory of 2364	2192	uianimation.exe	38
PID 2192 wrote to memory of 2364	2192	uianimation.exe	38
PID 2192 wrote to memory of 2364	2192	uianimation.exe	38
PID 484 wrote to memory of 2388	484	samcli.exe	40
PID 484 wrote to memory of 2388	484	samcli.exe	40
PID 484 wrote to memory of 2388	484	samcli.exe	40
PID 484 wrote to memory of 2388	484	samcli.exe	40
PID 484 wrote to memory of 1452	484	samcli.exe	41
PID 484 wrote to memory of 1452	484	samcli.exe	41
PID 484 wrote to memory of 1452	484	samcli.exe	41
PID 484 wrote to memory of 1452	484	samcli.exe	41
PID 2388 wrote to memory of 1944	2388	kbdusr.exe	44
PID 2388 wrote to memory of 1944	2388	kbdusr.exe	44
PID 2388 wrote to memory of 1944	2388	kbdusr.exe	44
PID 2388 wrote to memory of 1944	2388	kbdusr.exe	44
PID 2388 wrote to memory of 968	2388	kbdusr.exe	45
PID 2388 wrote to memory of 968	2388	kbdusr.exe	45
PID 2388 wrote to memory of 968	2388	kbdusr.exe	45
PID 2388 wrote to memory of 968	2388	kbdusr.exe	45
PID 2388 wrote to memory of 1760	2388	kbdusr.exe	47
PID 2388 wrote to memory of 1760	2388	kbdusr.exe	47
PID 2388 wrote to memory of 1760	2388	kbdusr.exe	47
PID 2388 wrote to memory of 1760	2388	kbdusr.exe	47
PID 1944 wrote to memory of 536	1944	kbdfa.exe	49
PID 1944 wrote to memory of 536	1944	kbdfa.exe	49
PID 1944 wrote to memory of 536	1944	kbdfa.exe	49
PID 1944 wrote to memory of 536	1944	kbdfa.exe	49
PID 1944 wrote to memory of 2128	1944	kbdfa.exe	50
PID 1944 wrote to memory of 2128	1944	kbdfa.exe	50
PID 1944 wrote to memory of 2128	1944	kbdfa.exe	50
PID 1944 wrote to memory of 2128	1944	kbdfa.exe	50
PID 536 wrote to memory of 2180	536	cryptbase.exe	52
PID 536 wrote to memory of 2180	536	cryptbase.exe	52
PID 536 wrote to memory of 2180	536	cryptbase.exe	52
PID 536 wrote to memory of 2180	536	cryptbase.exe	52
PID 536 wrote to memory of 1256	536	cryptbase.exe	53
PID 536 wrote to memory of 1256	536	cryptbase.exe	53
PID 536 wrote to memory of 1256	536	cryptbase.exe	53
PID 536 wrote to memory of 1256	536	cryptbase.exe	53
PID 2180 wrote to memory of 2676	2180	duser.exe	56
PID 2180 wrote to memory of 2676	2180	duser.exe	56
PID 2180 wrote to memory of 2676	2180	duser.exe	56
PID 2180 wrote to memory of 2676	2180	duser.exe	56

C:\Users\Admin\AppData\Local\Temp\4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe
"C:\Users\Admin\AppData\Local\Temp\4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\SysWOW64\msfeeds.exe
  "C:\Windows\system32\msfeeds.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\SysWOW64\uianimation.exe
    "C:\Windows\system32\uianimation.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2192
  - - C:\Windows\SysWOW64\samcli.exe
      "C:\Windows\system32\samcli.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:484
    - - C:\Windows\SysWOW64\kbdusr.exe
        
        "C:\Windows\system32\kbdusr.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2388
      - C:\Windows\SysWOW64\kbdfa.exe
        
        "C:\Windows\system32\kbdfa.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Windows\SysWOW64\cryptbase.exe
        
        "C:\Windows\system32\cryptbase.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:536
        
        C:\Windows\SysWOW64\duser.exe
        
        "C:\Windows\system32\duser.exe"
        8⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2180
        
        C:\Windows\SysWOW64\netcenter.exe
        
        "C:\Windows\system32\netcenter.exe"
        9⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2676
        
        C:\Windows\SysWOW64\dpnhpast.exe
        
        "C:\Windows\system32\dpnhpast.exe"
        10⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Windows\SysWOW64\kbd101a.exe
        
        "C:\Windows\system32\kbd101a.exe"
        11⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:796
        
        C:\Windows\SysWOW64\tvratings.exe
        
        "C:\Windows\system32\tvratings.exe"
        12⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:1288
        
        C:\Windows\SysWOW64\jsintl.exe
        
        "C:\Windows\system32\jsintl.exe"
        13⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Windows\SysWOW64\sechost.exe
        
        "C:\Windows\system32\sechost.exe"
        14⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1796
        
        C:\Windows\SysWOW64\f3ahvoas.exe
        
        "C:\Windows\system32\f3ahvoas.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2056
        
        C:\Windows\SysWOW64\api-ms-win-crt-utility-l1-1-0.exe
        
        "C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.exe"
        16⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1580
        
        C:\Windows\SysWOW64\radarrs.exe
        
        "C:\Windows\system32\radarrs.exe"
        17⤵
        Executes dropped EXE
        
        PID:2412
        
        C:\Windows\SysWOW64\iprtrmgr.exe
        
        "C:\Windows\system32\iprtrmgr.exe"
        18⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2780
        
        C:\Windows\SysWOW64\shimgvw.exe
        
        "C:\Windows\system32\shimgvw.exe"
        19⤵
        Executes dropped EXE
        
        PID:2676
        
        C:\Windows\SysWOW64\taskcomp.exe
        
        "C:\Windows\system32\taskcomp.exe"
        20⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Windows\SysWOW64\kbdmlt48.exe
        
        "C:\Windows\system32\kbdmlt48.exe"
        21⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2540
        
        C:\Windows\SysWOW64\magnification.exe
        
        "C:\Windows\system32\magnification.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1700
        
        C:\Windows\SysWOW64\odexl32.exe
        
        "C:\Windows\system32\odexl32.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2988
        
        C:\Windows\SysWOW64\oleacchooks.exe
        
        "C:\Windows\system32\oleacchooks.exe"
        24⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2388
        
        C:\Windows\SysWOW64\wmdmlog.exe
        
        "C:\Windows\system32\wmdmlog.exe"
        25⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2056
        
        C:\Windows\SysWOW64\wkscli.exe
        
        "C:\Windows\system32\wkscli.exe"
        26⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1532
        
        C:\Windows\SysWOW64\rdpendp.exe
        
        "C:\Windows\system32\rdpendp.exe"
        27⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Windows\SysWOW64\mfc100.exe
        
        "C:\Windows\system32\mfc100.exe"
        28⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Windows\SysWOW64\vdsbas.exe
        
        "C:\Windows\system32\vdsbas.exe"
        29⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1012
        
        C:\Windows\SysWOW64\msafd.exe
        
        "C:\Windows\system32\msafd.exe"
        30⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:444
        
        C:\Windows\SysWOW64\radarrs.exe
        
        "C:\Windows\system32\radarrs.exe"
        31⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:644
        
        C:\Windows\SysWOW64\dpwsockx.exe
        
        "C:\Windows\system32\dpwsockx.exe"
        32⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2628
        
        C:\Windows\SysWOW64\racengn.exe
        
        "C:\Windows\system32\racengn.exe"
        33⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1636
        
        C:\Windows\SysWOW64\eapqec.exe
        
        "C:\Windows\system32\eapqec.exe"
        34⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2912
        
        C:\Windows\SysWOW64\mfc120ita.exe
        
        "C:\Windows\system32\mfc120ita.exe"
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1376
        
        C:\Windows\SysWOW64\pid.exe
        
        "C:\Windows\system32\pid.exe"
        36⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2488
        
        C:\Windows\SysWOW64\wscproxystub.exe
        
        "C:\Windows\system32\wscproxystub.exe"
        37⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1556
        
        C:\Windows\SysWOW64\fthsvc.exe
        
        "C:\Windows\system32\fthsvc.exe"
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1684
        
        C:\Windows\SysWOW64\catsrvps.exe
        
        "C:\Windows\system32\catsrvps.exe"
        39⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3036
        
        C:\Windows\SysWOW64\cmutil.exe
        
        "C:\Windows\system32\cmutil.exe"
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2372
        
        C:\Windows\SysWOW64\winsrpc.exe
        
        "C:\Windows\system32\winsrpc.exe"
        41⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1044
        
        C:\Windows\SysWOW64\catsrvps.exe
        
        "C:\Windows\system32\catsrvps.exe"
        42⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:780
        
        C:\Windows\SysWOW64\msieftp.exe
        
        "C:\Windows\system32\msieftp.exe"
        43⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:844
        
        C:\Windows\SysWOW64\actioncentercpl.exe
        
        "C:\Windows\system32\actioncentercpl.exe"
        44⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2348
        
        C:\Windows\SysWOW64\dinput.exe
        
        "C:\Windows\system32\dinput.exe"
        45⤵
        Executes dropped EXE
        
        PID:1376
        
        C:\Windows\SysWOW64\nlslexicons0003.exe
        
        "C:\Windows\system32\nlslexicons0003.exe"
        46⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2600
        
        C:\Windows\SysWOW64\resampledmo.exe
        
        "C:\Windows\system32\resampledmo.exe"
        47⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1504
        
        C:\Windows\SysWOW64\searchfolder.exe
        
        "C:\Windows\system32\searchfolder.exe"
        48⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2316
        
        C:\Windows\SysWOW64\expsrv.exe
        
        "C:\Windows\system32\expsrv.exe"
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1368
        
        C:\Windows\SysWOW64\fdpnp.exe
        
        "C:\Windows\system32\fdpnp.exe"
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2556
        
        C:\Windows\SysWOW64\xpssvcs.exe
        
        "C:\Windows\system32\xpssvcs.exe"
        51⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2128
        
        C:\Windows\SysWOW64\api-ms-win-security-sddl-l1-1-0.exe
        
        "C:\Windows\system32\api-ms-win-security-sddl-l1-1-0.exe"
        52⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2156
        
        C:\Windows\SysWOW64\msdmo.exe
        
        "C:\Windows\system32\msdmo.exe"
        53⤵
        Executes dropped EXE
        
        PID:2684
        
        C:\Windows\SysWOW64\msvcp140_1.exe
        
        "C:\Windows\system32\msvcp140_1.exe"
        54⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2840
        
        C:\Windows\SysWOW64\oleacc.exe
        
        "C:\Windows\system32\oleacc.exe"
        55⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2364
        
        C:\Windows\SysWOW64\puiapi.exe
        
        "C:\Windows\system32\puiapi.exe"
        56⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1040
        
        C:\Windows\SysWOW64\sqmapi.exe
        
        "C:\Windows\system32\sqmapi.exe"
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1596
        
        C:\Windows\SysWOW64\wshelper.exe
        
        "C:\Windows\system32\wshelper.exe"
        58⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:1144
        
        C:\Windows\SysWOW64\vccorlib140.exe
        
        "C:\Windows\system32\vccorlib140.exe"
        59⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:2260
        
        C:\Windows\SysWOW64\kbdlt2.exe
        
        "C:\Windows\system32\kbdlt2.exe"
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2356
        
        C:\Windows\SysWOW64\loghours.exe
        
        "C:\Windows\system32\loghours.exe"
        61⤵
        Executes dropped EXE
        Drops file in System32 directory
        
        PID:1584
        
        C:\Windows\SysWOW64\odbc32gt.exe
        
        "C:\Windows\system32\odbc32gt.exe"
        62⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\loghours.exe"
        62⤵
        
        PID:1732
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\kbdlt2.exe"
        61⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\vccorlib140.exe"
        60⤵
        System Location Discovery: System Language Discovery
        
        PID:1880
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wshelper.exe"
        59⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\sqmapi.exe"
        58⤵
        
        PID:2072
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\puiapi.exe"
        57⤵
        
        PID:236
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\oleacc.exe"
        56⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\msvcp140_1.exe"
        55⤵
        System Location Discovery: System Language Discovery
        
        PID:864
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\msdmo.exe"
        54⤵
        System Location Discovery: System Language Discovery
        
        PID:2804
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\api-ms-win-security-sddl-l1-1-0.exe"
        53⤵
        
        PID:2588
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 180
        53⤵
        Program crash
        
        PID:1284
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\xpssvcs.exe"
        52⤵
        System Location Discovery: System Language Discovery
        
        PID:2824
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\fdpnp.exe"
        51⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\expsrv.exe"
        50⤵
        
        PID:1728
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\searchfolder.exe"
        49⤵
        
        PID:920
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\resampledmo.exe"
        48⤵
        System Location Discovery: System Language Discovery
        
        PID:2188
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\nlslexicons0003.exe"
        47⤵
        System Location Discovery: System Language Discovery
        
        PID:1132
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\dinput.exe"
        46⤵
        System Location Discovery: System Language Discovery
        
        PID:2488
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\actioncentercpl.exe"
        45⤵
        
        PID:2096
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\msieftp.exe"
        44⤵
        
        PID:2736
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\catsrvps.exe"
        43⤵
        System Location Discovery: System Language Discovery
        
        PID:2760
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\winsrpc.exe"
        42⤵
        System Location Discovery: System Language Discovery
        
        PID:400
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\cmutil.exe"
        41⤵
        System Location Discovery: System Language Discovery
        
        PID:2544
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\catsrvps.exe"
        40⤵
        
        PID:108
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\fthsvc.exe"
        39⤵
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wscproxystub.exe"
        38⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 548
        38⤵
        Program crash
        
        PID:2024
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\pid.exe"
        37⤵
        System Location Discovery: System Language Discovery
        
        PID:2572
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\mfc120ita.exe"
        36⤵
        
        PID:2144
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\eapqec.exe"
        35⤵
        
        PID:2004
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\racengn.exe"
        34⤵
        System Location Discovery: System Language Discovery
        
        PID:1440
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\dpwsockx.exe"
        33⤵
        
        PID:2464
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\radarrs.exe"
        32⤵
        System Location Discovery: System Language Discovery
        
        PID:1288
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\msafd.exe"
        31⤵
        
        PID:1816
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\vdsbas.exe"
        30⤵
        System Location Discovery: System Language Discovery
        
        PID:2404
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\mfc100.exe"
        29⤵
        
        PID:2580
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\rdpendp.exe"
        28⤵
        System Location Discovery: System Language Discovery
        
        PID:2720
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wkscli.exe"
        27⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\wmdmlog.exe"
        26⤵
        
        PID:2216
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\oleacchooks.exe"
        25⤵
        
        PID:2308
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\odexl32.exe"
        24⤵
        
        PID:1584
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\magnification.exe"
        23⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\kbdmlt48.exe"
        22⤵
        
        PID:2744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\taskcomp.exe"
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\shimgvw.exe"
        20⤵
        
        PID:1632
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\iprtrmgr.exe"
        19⤵
        
        PID:1704
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\radarrs.exe"
        18⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\api-ms-win-crt-utility-l1-1-0.exe"
        17⤵
        System Location Discovery: System Language Discovery
        
        PID:2764
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 180
        17⤵
        Program crash
        
        PID:1344
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\f3ahvoas.exe"
        16⤵
        
        PID:1744
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\sechost.exe"
        15⤵
        System Location Discovery: System Language Discovery
        
        PID:1892
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\jsintl.exe"
        14⤵
        
        PID:980
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\tvratings.exe"
        13⤵
        
        PID:1956
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\kbd101a.exe"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:2992
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\dpnhpast.exe"
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:1096
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\netcenter.exe"
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\duser.exe"
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2680
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\cryptbase.exe"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1256
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\kbdfa.exe"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
      - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\kbdusr.exe"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:968
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2388 -s 48
        6⤵
        Loads dropped DLL
        Program crash
        
        PID:1760
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\samcli.exe"
        5⤵
        
        PID:1452
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\uianimation.exe"
      4⤵
      PID:2364
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\system32\msfeeds.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del "C:\Users\Admin\AppData\Local\Temp\4d2e23a579e1cac93ec8986e9dd88f6b640b36aa918952eed78ec7c62b8c79bfN.exe"
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:2284

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

install[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\D6V88JEY\install[1].htm
Size 7KB
SHA256 d5319a00eb7542e02c1e76cb20e2073c0411cd918e32094bc66f9147a0bfae6d
MD5 9463ba07743e8a9aca3b55373121b7c5
SHA1 4fdd121b2d2afd98881ab4cdb2d2a513ff5bb26f
SHA512 6a1a97f37a5e607a3dc7f5fae343911a7f75d371a34ec27deb2971ee47388891f001d80959d37609d1c909af1674b4962da739e8a2cfce07e3d2ce6abf0c6ad7
SSDEEP 96:ks9dbMQuTRg0ZbiWfhKfwVb3BLMoe94ewZelHNI9uvFaLFPB9M3wVZI/Sr:FR8pKfsTxcYoHSlF59M3sZn
MD5 SHA1 SHA512 SSDEEP

Submit Download

0XEF8RNY.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\0XEF8RNY.txt
Size 132B
SHA256 85da0e984e791f7259db4b1bdd897756a1c64f0e73022f010ec34746ab7de9ba
MD5 be41ac1bb8fc21bd45d1b059b297a420
SHA1 dfc6b6990c4de2d6205081adef8d24fc40b75103
SHA512 c609b12221282e735507815602580f6256fe1c2f4c852ddb069ca1f0be5c940ccb391dcee5cbc49a8ee5ecf056f6fdbc9da3dfb332c13fcc510ed911933190c1
MD5 SHA1 SHA512

Submit Download

4HEIPII3.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\4HEIPII3.txt
Size 99B
SHA256 67322f1f1f4415c9f91b4c228e26b3a4c7dedd19707d359e5efc986f87f4e87c
MD5 2c4e3886f351e67b636f195b21c5fec8
SHA1 d112c6862783307ba59b55d13b8b5d75d845ecac
SHA512 0a6e6dce2975667a76fa20c72e75050588d0e062171640fbf6daf36e98d79331f45a5a275e4914facbcab69c0e9261cd7dbbf65ce7d2bf6f0c2327729b93e6ee
MD5 SHA1 SHA512

Submit Download

G7TUPXNY.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\G7TUPXNY.txt
Size 132B
SHA256 3e4d3de4fc7309c41bb8dd2d68d975213a432fa3b51c79ccdfca45382409a9f6
MD5 f2fbf6f723b14416be2b080e4512744f
SHA1 7789b815f93177d7439d3240352cf64e7cec53da
SHA512 bd201703b852d581c677d380513c78ee08155ccd560408ef555bd037cbb1e5be0761ccb2ab68571c30e18b73a1c862620cc526f34270eff99090862a7bc08111
MD5 SHA1 SHA512

Submit Download

M9UKJPG1.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\M9UKJPG1.txt
Size 132B
SHA256 f6c8e17aefb1500706ba5458a33cf0ac15dd1551f9618868ad8e5fcdddf2473b
MD5 07df445db7b0a81eeafbe243dc02747f
SHA1 2cd09dce93482341fe91b18557b1965f5e2452c8
SHA512 cc07f6d648b04e0d69ebd9f8be28cbce9ccfcc6b3a8219feed9c86d677000dca49ff22e10f48645dc838db31680f9b028cf1ea61f3290466e4cf03ed4a0efd79
MD5 SHA1 SHA512

Submit Download

RQXRNJSM.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\RQXRNJSM.txt
Size 132B
SHA256 6f9b1e7984896a941c18d17166e01e4d6acd5705d852689654863f4ed673d74b
MD5 15ed9c206e89f11fbd3cf5f99b94384b
SHA1 7c6b80ce651d09fbedb53df5c1a27bebf624d23b
SHA512 65bcc0c691c2de986508bb1860fb4e1f63c290c101a4fb4e8c038ff179813c732fe3dddff4907aef39601ca52c336c160348d4f0943248f3b7a1ce23a6997370
MD5 SHA1 SHA512

Submit Download

ZL76BRXQ.txt

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ZL76BRXQ.txt
Size 132B
SHA256 434451400d6cb8e79e16e79443f96f6bfbe9e14ee47f7f5334ff154b81386e02
MD5 672f0451bee5a718ca52d109d79d73bf
SHA1 1d8e7940fc660650462621a1f8641c80fb7a09a1
SHA512 dd9345a8ff8c7f32439fe6c44ac240ce121402cf7b2ecb1c5ac732895d70cbb6de2762c7470544b1ae1fe15af20caa0615ed6d4f8d551904e00f22c3ac1b1218
MD5 SHA1 SHA512

Submit Download

msfeeds.exe

Path C:\Windows\SysWOW64\msfeeds.exe
Size 61KB
SHA256 a6c02ddecfeb3b9ec88d30fdb246ad2ffd9b6184eff21c48791601c5a1a237be
MD5 a726763ce1c6542d5a0c44b53c9b96e4
SHA1 ff46ef97a85a3a646eb2349636cd323efb5ac71a
SHA512 a922ab4f52382a349be8b910459ce1f996ba091dfb449753478c91132a73d2dae3b6b376cf4f41653fdb6270cf09d35dd73bb4c9a8c1dc2cb0635e7d52091107
SSDEEP 1536:UE3HjO+qAAM0ib/fY9npdwLMKcTbImrvcBsFWMmj:jDY9pqLnc9rUBumj
MD5 SHA1 SHA512 SSDEEP

Submit Download

cryptbase.exe

Path \Windows\SysWOW64\cryptbase.exe
Size 61KB
SHA256 8c6add07b1d86829757bb6c3af348fc7f59cc04da6db876add636f35747ddba8
MD5 029eaf890c453cae6c60cd48b98abaf0
SHA1 a18c321b57197127558ff2515ff2ef80b29534db
SHA512 7db928365cc543f5d3013e1e9204ac4251a60bd8b2ff12769c813fd4f5829fd0c1d2918d64acafa504de2d92c99166309b838ab1837e2998d32f5ed97a3ffbd4
SSDEEP 1536:UE3HjO+qAAM0ib/fY9npdwLMKcTbImrvcBsFWMmY:jDY9pqLnc9rUBumY
MD5 SHA1 SHA512 SSDEEP

Submit Download

duser.exe

Path \Windows\SysWOW64\duser.exe
Size 61KB
SHA256 b28d2dbb805b4c070ce03cee396a61219989adec36350ae728b22b745ec4a0bb
MD5 96a09a8b2c1fa687add65cb4c147b954
SHA1 be9feb244c7948b33253bc441ad9aed874c8c14e
SHA512 98d45d19d1ebd76a551639979f2b4c0fa410c503b3972b75ac6ea7e06f994269da9428daeb182894bbb5b8c9b43c74ca00f71d47d863f2f21c64d07b74c0f850
SSDEEP 1536:UE3HjO+qAAM0ib/fY9npdwLMKcTbImrvcBsFWMmL:jDY9pqLnc9rUBumL
MD5 SHA1 SHA512 SSDEEP

Submit Download

kbdfa.exe

Path \Windows\SysWOW64\kbdfa.exe
Size 61KB
SHA256 fd5bf78bc6d26f534d20b6451c655324e97c8eee3e95ec13ae3ab8be4c19f8ab
MD5 ab147374768f8bb700d019b05b4bec09
SHA1 11a5248818173b9119c84c3b4107a6e7ece63811
SHA512 a905fff81a57547dcddc57c4cd09b93aeb77efe306ec34037f3a8af3bd92db3b757909f44062d2a78dd9311d20dc6547331f664769a42216ba7a2ab72d319401
SSDEEP 1536:UE3HjO+qAAM0ib/fY9npdwLMKcTbImrvcBsFWMmY:jDY9pqLnc9rUBumY
MD5 SHA1 SHA512 SSDEEP

Submit Download

kbdusr.exe

Path \Windows\SysWOW64\kbdusr.exe
Size 61KB
SHA256 45c0730ff0959777944d80eac0783ce0db9e1a414fc9d7c4541621f7be2805ed
MD5 11790866f948b664e01fa02d8ae3fa63
SHA1 10928d577ff48841c31854654bb9e3f143544fa2
SHA512 9f2d2f8a0c8466fb342cc65924f25814547f2a2385b9cce613a7f5cbdc363363d3337b8e2bae786e49c19258d80af0198ef8c55ffa80abcfe35681214fe25596
SSDEEP 1536:UE3HjO+qAAM0ib/fY9npdwLMKcTbImrvcBsFWMmL:jDY9pqLnc9rUBumL
MD5 SHA1 SHA512 SSDEEP

Submit Download

netcenter.exe

Path \Windows\SysWOW64\netcenter.exe
Size 61KB
SHA256 2ca274b59d90861c988ce699b3341f6f5bc7199a079d60d3545fcfb3c266d89b
MD5 ee57504adb4874db9e18924883950630
SHA1 aaf6873cec0eee59af441fc3d48563ed7d81a005
SHA512 6a2a10b7c4a2f498339e0a351f7621d4db340fbce4ac6cb1bc2ba492421cea344141cd79717758319b861c7a084a23d43f8b88e65b2777fd4cb718a5d9e9c065
SSDEEP 1536:UE3HjO+qAAM0ib/fY9npdwLMKcTbImrvcBsFWMmq:jDY9pqLnc9rUBumq
MD5 SHA1 SHA512 SSDEEP

Submit Download

samcli.exe

Path \Windows\SysWOW64\samcli.exe
Size 61KB
SHA256 41e78f3e5fb63d3851ad2709477270656fa69716db3dcdcd43a79ade40a8618b
MD5 05724841383f8ebaf2418ae3091d29e1
SHA1 9e2182e2a4ac404479d6a8dc8ad36b225e6c4852
SHA512 2ed90a959c9cfcd0bc074cf1d83fe922ca02d706b71a33013781073ddd9ddca0c87820cad7417685026b3dea5d52fc277573505374fca9e0909753aa20acb2b9
SSDEEP 1536:UE3HjO+qAAM0ib/fY9npdwLMKcTbImrvcBsFWMm7:jDY9pqLnc9rUBum7
MD5 SHA1 SHA512 SSDEEP

Submit Download

uianimation.exe

Path \Windows\SysWOW64\uianimation.exe
Size 61KB
SHA256 15700f4a2ef1db155acf48ebf174e087252ae2d6da92dd984d887876a9300634
MD5 3e9e1ef3420ba1e964099994eea8cbd5
SHA1 0855aa87fcb462c11b9b2bd12d1f9bee65288e59
SHA512 ad85a9b85992cb1414ba07cef075fdde9cd6bf1f2ffd371ce77746d9df25dc3458afafb7089b46260934f93737b42ae44c1df36f38d89f63e1b29953a372c4eb
SSDEEP 1536:UE3HjO+qAAM0ib/fY9npdwLMKcTbImrvcBsFWMmc:jDY9pqLnc9rUBumc
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/484-95-0x0000000003620000-0x0000000003633000-memory.dmp

Download

memory/484-99-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/484-94-0x0000000003620000-0x0000000003633000-memory.dmp

Download

memory/484-93-0x0000000003620000-0x0000000003633000-memory.dmp

Download

memory/484-98-0x0000000003620000-0x0000000003630000-memory.dmp

Download

memory/484-74-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/536-167-0x0000000003D20000-0x0000000003D33000-memory.dmp

Download

memory/536-153-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/536-178-0x0000000003D30000-0x0000000003D40000-memory.dmp

Download

memory/536-179-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/796-252-0x0000000003520000-0x0000000003533000-memory.dmp

Download

memory/796-256-0x0000000003520000-0x0000000003533000-memory.dmp

Download

memory/796-255-0x0000000003520000-0x0000000003533000-memory.dmp

Download

memory/796-258-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/796-257-0x0000000003520000-0x0000000003530000-memory.dmp

Download

memory/1288-269-0x0000000000560000-0x0000000000573000-memory.dmp

Download

memory/1288-273-0x0000000000560000-0x0000000000573000-memory.dmp

Download

memory/1288-274-0x0000000000560000-0x0000000000573000-memory.dmp

Download

memory/1288-276-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1288-275-0x0000000000560000-0x0000000000570000-memory.dmp

Download

memory/1580-344-0x00000000005C0000-0x00000000005D3000-memory.dmp

Download

memory/1580-349-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1580-348-0x00000000005D0000-0x00000000005E0000-memory.dmp

Download

memory/1580-345-0x0000000003230000-0x0000000003243000-memory.dmp

Download

memory/1580-346-0x0000000003230000-0x0000000003243000-memory.dmp

Download

memory/1580-347-0x00000000005C0000-0x00000000005D3000-memory.dmp

Download

memory/1624-291-0x0000000000AC0000-0x0000000000AD3000-memory.dmp

Download

memory/1624-295-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1624-294-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/1624-292-0x0000000000AC0000-0x0000000000AD3000-memory.dmp

Download

memory/1624-287-0x0000000000AC0000-0x0000000000AD3000-memory.dmp

Download

memory/1776-238-0x0000000003CE0000-0x0000000003CF3000-memory.dmp

Download

memory/1776-239-0x0000000003690000-0x00000000036A0000-memory.dmp

Download

memory/1776-240-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1776-221-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1776-237-0x0000000003CE0000-0x0000000003CF3000-memory.dmp

Download

memory/1796-310-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1796-305-0x00000000005D0000-0x00000000005E3000-memory.dmp

Download

memory/1796-328-0x0000000003940000-0x0000000003953000-memory.dmp

Download

memory/1796-309-0x0000000003940000-0x0000000003953000-memory.dmp

Download

memory/1796-293-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1944-156-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/1944-148-0x00000000021F0000-0x0000000002203000-memory.dmp

Download

memory/1944-154-0x0000000002200000-0x0000000002210000-memory.dmp

Download

memory/1944-149-0x0000000002200000-0x0000000002213000-memory.dmp

Download

memory/1944-150-0x0000000002200000-0x0000000002213000-memory.dmp

Download

memory/1944-137-0x00000000021F0000-0x0000000002203000-memory.dmp

Download

memory/2056-370-0x0000000002300000-0x0000000002310000-memory.dmp

Download

memory/2056-326-0x00000000035B0000-0x00000000035C3000-memory.dmp

Download

memory/2056-322-0x00000000035B0000-0x00000000035C3000-memory.dmp

Download

memory/2056-320-0x00000000035B0000-0x00000000035C3000-memory.dmp

Download

memory/2056-327-0x00000000035B0000-0x00000000035C3000-memory.dmp

Download

memory/2056-330-0x0000000002300000-0x0000000002310000-memory.dmp

Download

memory/2056-329-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2180-200-0x0000000004130000-0x0000000004143000-memory.dmp

Download

memory/2180-194-0x0000000004130000-0x0000000004143000-memory.dmp

Download

memory/2180-201-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2180-205-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2180-204-0x00000000040E0000-0x00000000040F0000-memory.dmp

Download

memory/2192-73-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2192-65-0x0000000002280000-0x0000000002293000-memory.dmp

Download

memory/2220-50-0x0000000000BE0000-0x0000000000BF0000-memory.dmp

Download

memory/2220-47-0x0000000003190000-0x00000000031A3000-memory.dmp

Download

memory/2220-22-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2220-51-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2220-40-0x0000000000BD0000-0x0000000000BE3000-memory.dmp

Download

memory/2220-39-0x0000000000BD0000-0x0000000000BE3000-memory.dmp

Download

memory/2388-129-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2388-124-0x00000000035B0000-0x00000000035C0000-memory.dmp

Download

memory/2388-114-0x00000000035B0000-0x00000000035C3000-memory.dmp

Download

memory/2388-116-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2388-121-0x00000000035B0000-0x00000000035C3000-memory.dmp

Download

memory/2412-364-0x0000000004260000-0x0000000004273000-memory.dmp

Download

memory/2412-368-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2412-367-0x0000000004260000-0x0000000004270000-memory.dmp

Download

memory/2412-363-0x0000000004260000-0x0000000004273000-memory.dmp

Download

memory/2412-366-0x0000000004260000-0x0000000004273000-memory.dmp

Download

memory/2412-365-0x0000000004260000-0x0000000004273000-memory.dmp

Download

memory/2676-222-0x00000000035F0000-0x0000000003600000-memory.dmp

Download

memory/2676-402-0x00000000031F0000-0x0000000003203000-memory.dmp

Download

memory/2676-403-0x00000000031F0000-0x0000000003203000-memory.dmp

Download

memory/2676-223-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2676-387-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/2676-220-0x0000000003CE0000-0x0000000003CF3000-memory.dmp

Download

memory/2780-384-0x00000000031C0000-0x00000000031D3000-memory.dmp

Download

memory/2780-386-0x00000000031C0000-0x00000000031D3000-memory.dmp

Download

memory/2780-385-0x00000000031C0000-0x00000000031D3000-memory.dmp

Download

memory/2780-383-0x00000000031C0000-0x00000000031D3000-memory.dmp

Download

memory/2780-388-0x0000000002480000-0x0000000002490000-memory.dmp

Download

memory/2780-389-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3024-13-0x00000000035B0000-0x00000000035C3000-memory.dmp

Download

memory/3024-12-0x00000000035B0000-0x00000000035C3000-memory.dmp

Download

memory/3024-0-0x0000000000400000-0x0000000000413000-memory.dmp

Download

memory/3024-20-0x00000000035B0000-0x00000000035C3000-memory.dmp

Download

memory/3024-23-0x00000000032B0000-0x00000000032C0000-memory.dmp

Download

memory/3024-25-0x0000000000400000-0x0000000000413000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads