f1d5c9333e628e717b4967995db7a9f4b8dc1e602ff954e57a17ef2513f2db83

Analysis

max time kernel
130s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-GameThief.Win32.Nilage.ags.exe
Size 33KB
Sample261011-18m7xaaa53
SHA256 f1d5c9333e628e717b4967995db7a9f4b8dc1e602ff954e57a17ef2513f2db83
MD5 753c80d3801f0259734af3bf1bc4f657
SHA1 05898ff44e0392c2d30751af1b89daa3973598c5
SHA512 430216ae91b62b2e57e7ea42c2003c2bb6541ef57f7131940589ff2ce22efce1f58b78ff1bf1d39822cf016265618a06e15d78233d1c9abcc80d77f6918ebf64
SSDEEP 768:Loi4qZOkQfSKFyU41Ordnt3V1AYl7/aXaUrF:Lv4qZdQ/yUYG/l7CXF
TLSH
T17FE22B83F592C8B1C000CCF89DB6C365BA3B79641DA69797B9FE6BCDEC6A351450C089
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5076	internat.exe
6036	internat.exe
2168	internat.exe
692	internat.exe
2912	internat.exe
2832	internat.exe
5756	internat.exe
3240	internat.exe
5052	internat.exe
5116	internat.exe
4136	internat.exe
5832	internat.exe
5900	internat.exe
3936	internat.exe
6024	internat.exe
1620	internat.exe
4632	internat.exe
3848	internat.exe
2956	internat.exe
2408	internat.exe
4624	internat.exe
4308	internat.exe
3544	internat.exe
468	internat.exe
5216	internat.exe
5636	internat.exe
4036	internat.exe
5336	internat.exe
4472	internat.exe
3328	internat.exe
1916	internat.exe
5300	internat.exe
2212	internat.exe
4688	internat.exe
244	internat.exe
5360	internat.exe
6128	internat.exe
4568	internat.exe
4148	internat.exe
4512	internat.exe
4684	internat.exe
4060	internat.exe
3292	internat.exe
5436	internat.exe
3116	internat.exe
4360	internat.exe
5932	internat.exe
3036	internat.exe
5312	internat.exe
5936	internat.exe
2724	internat.exe
2432	internat.exe
6132	internat.exe
2332	internat.exe
5628	internat.exe
1900	internat.exe
5812	internat.exe
1028	internat.exe
2732	internat.exe
1240	internat.exe
2276	internat.exe
6052	internat.exe
2692	internat.exe
4496	internat.exe

Adds Run key to start application 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	jaffacakes118_Trojan-GameThief.Win32.Nilage.ags.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\internat = "C:\\Windows\\system32\\internat.exe"	internat.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File created	C:\Windows\SysWOW64\internat.exe	internat.exe
File opened for modification	C:\Windows\SysWOW64\ls.txt	internat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-GameThief.Win32.Nilage.ags.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	internat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5684	jaffacakes118_Trojan-GameThief.Win32.Nilage.ags.exe
5684	jaffacakes118_Trojan-GameThief.Win32.Nilage.ags.exe
5076	internat.exe
5076	internat.exe
6036	internat.exe
6036	internat.exe
2168	internat.exe
2168	internat.exe
692	internat.exe
692	internat.exe
2912	internat.exe
2912	internat.exe
2832	internat.exe
2832	internat.exe
5756	internat.exe
5756	internat.exe
3240	internat.exe
3240	internat.exe
5052	internat.exe
5052	internat.exe
5116	internat.exe
5116	internat.exe
4136	internat.exe
4136	internat.exe
5832	internat.exe
5832	internat.exe
5900	internat.exe
5900	internat.exe
3936	internat.exe
3936	internat.exe
6024	internat.exe
6024	internat.exe
1620	internat.exe
1620	internat.exe
4632	internat.exe
4632	internat.exe
3848	internat.exe
3848	internat.exe
2956	internat.exe
2956	internat.exe
2408	internat.exe
2408	internat.exe
4624	internat.exe
4624	internat.exe
4308	internat.exe
4308	internat.exe
3544	internat.exe
3544	internat.exe
468	internat.exe
468	internat.exe
5216	internat.exe
5216	internat.exe
5636	internat.exe
5636	internat.exe
4036	internat.exe
4036	internat.exe
5336	internat.exe
5336	internat.exe
4472	internat.exe
4472	internat.exe
3328	internat.exe
3328	internat.exe
1916	internat.exe
1916	internat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5684 wrote to memory of 5076	5684	jaffacakes118_Trojan-GameThief.Win32.Nilage.ags.exe	90
PID 5076 wrote to memory of 6036	5076	internat.exe	91
PID 6036 wrote to memory of 2168	6036	internat.exe	92
PID 2168 wrote to memory of 692	2168	internat.exe	93
PID 692 wrote to memory of 2912	692	internat.exe	94
PID 2912 wrote to memory of 2832	2912	internat.exe	95
PID 2832 wrote to memory of 5756	2832	internat.exe	96
PID 5756 wrote to memory of 3240	5756	internat.exe	97
PID 3240 wrote to memory of 5052	3240	internat.exe	98
PID 5052 wrote to memory of 5116	5052	internat.exe	99
PID 5116 wrote to memory of 4136	5116	internat.exe	100
PID 4136 wrote to memory of 5832	4136	internat.exe	101
PID 5832 wrote to memory of 5900	5832	internat.exe	102
PID 5900 wrote to memory of 3936	5900	internat.exe	103
PID 3936 wrote to memory of 6024	3936	internat.exe	104
PID 6024 wrote to memory of 1620	6024	internat.exe	105
PID 1620 wrote to memory of 4632	1620	internat.exe	106
PID 4632 wrote to memory of 3848	4632	internat.exe	107
PID 3848 wrote to memory of 2956	3848	internat.exe	108
PID 2956 wrote to memory of 2408	2956	internat.exe	109
PID 2408 wrote to memory of 4624	2408	internat.exe	110
PID 4624 wrote to memory of 4308	4624	internat.exe	111
PID 4308 wrote to memory of 3544	4308	internat.exe	112
PID 3544 wrote to memory of 468	3544	internat.exe	113
PID 468 wrote to memory of 5216	468	internat.exe	114
PID 5216 wrote to memory of 5636	5216	internat.exe	115
PID 5636 wrote to memory of 4036	5636	internat.exe	116
PID 4036 wrote to memory of 5336	4036	internat.exe	117
PID 5336 wrote to memory of 4472	5336	internat.exe	118
PID 4472 wrote to memory of 3328	4472	internat.exe	119
PID 3328 wrote to memory of 1916	3328	internat.exe	120
PID 1916 wrote to memory of 5300	1916	internat.exe	121
PID 5300 wrote to memory of 2212	5300	internat.exe	122
PID 2212 wrote to memory of 4688	2212	internat.exe	123
PID 4688 wrote to memory of 244	4688	internat.exe	124
PID 244 wrote to memory of 5360	244	internat.exe	125
PID 5360 wrote to memory of 6128	5360	internat.exe	126
PID 6128 wrote to memory of 4568	6128	internat.exe	127
PID 4568 wrote to memory of 4148	4568	internat.exe	128
PID 4148 wrote to memory of 4512	4148	internat.exe	129
PID 4512 wrote to memory of 4684	4512	internat.exe	130
PID 4684 wrote to memory of 4060	4684	internat.exe	131
PID 4060 wrote to memory of 3292	4060	internat.exe	132
PID 3292 wrote to memory of 5436	3292	internat.exe	133
PID 5436 wrote to memory of 3116	5436	internat.exe	135
PID 3116 wrote to memory of 4360	3116	internat.exe	136
PID 4360 wrote to memory of 5932	4360	internat.exe	137
PID 5932 wrote to memory of 3036	5932	internat.exe	138
PID 3036 wrote to memory of 5312	3036	internat.exe	139
PID 5312 wrote to memory of 5936	5312	internat.exe	140
PID 5936 wrote to memory of 2724	5936	internat.exe	141
PID 2724 wrote to memory of 2432	2724	internat.exe	142
PID 2432 wrote to memory of 6132	2432	internat.exe	143
PID 6132 wrote to memory of 2332	6132	internat.exe	144
PID 2332 wrote to memory of 5628	2332	internat.exe	145
PID 5628 wrote to memory of 1900	5628	internat.exe	146
PID 1900 wrote to memory of 5812	1900	internat.exe	147
PID 5812 wrote to memory of 1028	5812	internat.exe	148
PID 1028 wrote to memory of 2732	1028	internat.exe	149
PID 2732 wrote to memory of 1240	2732	internat.exe	150
PID 1240 wrote to memory of 2276	1240	internat.exe	151
PID 2276 wrote to memory of 6052	2276	internat.exe	152
PID 6052 wrote to memory of 2692	6052	internat.exe	153
PID 2692 wrote to memory of 4496	2692	internat.exe	154

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Nilage.ags.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Nilage.ags.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5684
- C:\Windows\SysWOW64\internat.exe
  "C:\Windows\system32\internat.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\internat.exe
    "C:\Windows\system32\internat.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:6036
  - - C:\Windows\SysWOW64\internat.exe
      "C:\Windows\system32\internat.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2168
    - - C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:692
      - C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        6⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2912
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2832
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        8⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5756
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3240
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        10⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5052
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        11⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5116
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4136
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        13⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5832
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        14⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5900
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        15⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3936
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        16⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:6024
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1620
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        18⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4632
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3848
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        20⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2956
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        21⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2408
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        22⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4624
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        23⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4308
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        24⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3544
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        25⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:468
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        26⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5216
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        27⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5636
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        28⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4036
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        29⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:5336
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        30⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:4472
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        31⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:3328
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        32⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1916
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        33⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5300
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        34⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2212
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        35⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:4688
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        36⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:244
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        37⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5360
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        38⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:6128
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        39⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4568
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        40⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4148
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        41⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4512
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        42⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4684
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        43⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4060
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        44⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3292
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        45⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5436
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        46⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3116
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        47⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:4360
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        48⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:5932
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        49⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:3036
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        50⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:5312
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        51⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5936
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        52⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2724
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        53⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2432
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        54⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of WriteProcessMemory
        
        PID:6132
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        55⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2332
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        56⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5628
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        57⤵
        Executes dropped EXE
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1900
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        58⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5812
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        59⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1028
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        60⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2732
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        61⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1240
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        62⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2276
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        63⤵
        Executes dropped EXE
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6052
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        64⤵
        Executes dropped EXE
        Drops file in System32 directory
        Suspicious use of WriteProcessMemory
        
        PID:2692
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        65⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        66⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:6016
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        67⤵
        Adds Run key to start application
        
        PID:3776
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        68⤵
        Drops file in System32 directory
        
        PID:3800
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        69⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:836
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        70⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2788
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        71⤵
        
        PID:4672
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        72⤵
        Drops file in System32 directory
        
        PID:4948
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        73⤵
        
        PID:3000
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        74⤵
        
        PID:2948
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        75⤵
        System Location Discovery: System Language Discovery
        
        PID:3104
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        76⤵
        Adds Run key to start application
        
        PID:2768
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        77⤵
        Adds Run key to start application
        
        PID:2548
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        78⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5072
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        79⤵
        
        PID:1560
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        80⤵
        
        PID:2936
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        81⤵
        System Location Discovery: System Language Discovery
        
        PID:1632
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        82⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        83⤵
        Drops file in System32 directory
        
        PID:5296
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        84⤵
        
        PID:4888
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        85⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3332
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        86⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4240
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        87⤵
        Drops file in System32 directory
        
        PID:3436
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        88⤵
        System Location Discovery: System Language Discovery
        
        PID:3468
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        89⤵
        Drops file in System32 directory
        
        PID:3312
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        90⤵
        
        PID:4972
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        91⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2036
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        92⤵
        
        PID:3296
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        93⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3084
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        94⤵
        Adds Run key to start application
        
        PID:4404
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        95⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2136
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        96⤵
        Adds Run key to start application
        
        PID:2564
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        97⤵
        Drops file in System32 directory
        
        PID:5768
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        98⤵
        Adds Run key to start application
        
        PID:5372
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        99⤵
        System Location Discovery: System Language Discovery
        
        PID:3412
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        100⤵
        Drops file in System32 directory
        
        PID:5952
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        101⤵
        Drops file in System32 directory
        
        PID:5188
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        102⤵
        
        PID:3540
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        103⤵
        Drops file in System32 directory
        
        PID:4976
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        104⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3816
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        105⤵
        System Location Discovery: System Language Discovery
        
        PID:996
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        106⤵
        
        PID:3364
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        107⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3360
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        108⤵
        Adds Run key to start application
        
        PID:552
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        109⤵
        
        PID:3392
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        110⤵
        System Location Discovery: System Language Discovery
        
        PID:6092
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        111⤵
        Drops file in System32 directory
        
        PID:1232
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        112⤵
        System Location Discovery: System Language Discovery
        
        PID:2988
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        113⤵
        System Location Discovery: System Language Discovery
        
        PID:248
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        114⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5064
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        115⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        116⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3552
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        117⤵
        Adds Run key to start application
        
        PID:4584
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        118⤵
        
        PID:4728
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        119⤵
        Adds Run key to start application
        
        PID:5080
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        120⤵
        
        PID:5292
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        121⤵
        
        PID:5968
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        122⤵
        
        PID:2064
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        123⤵
        
        PID:5416
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        124⤵
        
        PID:2976
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        125⤵
        
        PID:3648
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        126⤵
        Drops file in System32 directory
        
        PID:2752
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        127⤵
        Adds Run key to start application
        
        PID:928
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        128⤵
        
        PID:5468
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        129⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        130⤵
        
        PID:3792
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        131⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1312
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        132⤵
        Adds Run key to start application
        
        PID:2828
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        133⤵
        Adds Run key to start application
        
        PID:5024
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        134⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:4280
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        135⤵
        
        PID:4772
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        136⤵
        
        PID:4228
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        137⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        138⤵
        
        PID:2444
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        139⤵
        Drops file in System32 directory
        
        PID:2068
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        140⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:3180
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        141⤵
        System Location Discovery: System Language Discovery
        
        PID:5128
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        142⤵
        System Location Discovery: System Language Discovery
        
        PID:4784
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        143⤵
        Adds Run key to start application
        
        PID:5488
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        144⤵
        System Location Discovery: System Language Discovery
        
        PID:2784
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        145⤵
        Drops file in System32 directory
        
        PID:4816
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        146⤵
        System Location Discovery: System Language Discovery
        
        PID:2300
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        147⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1056
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        148⤵
        
        PID:2448
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        149⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2428
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        150⤵
        
        PID:4700
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        151⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        152⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:2008
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        153⤵
        Drops file in System32 directory
        
        PID:1012
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        154⤵
        Adds Run key to start application
        
        PID:5924
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        155⤵
        Adds Run key to start application
        
        PID:612
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        156⤵
        Drops file in System32 directory
        
        PID:5992
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        157⤵
        Drops file in System32 directory
        
        PID:4872
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        158⤵
        System Location Discovery: System Language Discovery
        
        PID:1948
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        159⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        160⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1600
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        161⤵
        Adds Run key to start application
        
        PID:2336
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        162⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1568
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        163⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        164⤵
        
        PID:5180
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        165⤵
        
        PID:1628
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        166⤵
        System Location Discovery: System Language Discovery
        
        PID:3864
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        167⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:4056
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        168⤵
        System Location Discovery: System Language Discovery
        
        PID:2396
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        169⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:5980
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        170⤵
        
        PID:2876
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        171⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2672
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        172⤵
        System Location Discovery: System Language Discovery
        
        PID:4608
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        173⤵
        
        PID:708
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        174⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        175⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:824
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        176⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:2888
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        177⤵
        System Location Discovery: System Language Discovery
        
        PID:4956
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        178⤵
        
        PID:4300
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        179⤵
        
        PID:3724
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        180⤵
        
        PID:3880
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        181⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        
        PID:1908
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        182⤵
        Drops file in System32 directory
        
        PID:2924
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        183⤵
        
        PID:3428
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        184⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        185⤵
        Drops file in System32 directory
        
        PID:1136
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        186⤵
        Drops file in System32 directory
        
        PID:3060
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        187⤵
        
        PID:4732
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        188⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:3900
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        189⤵
        
        PID:2560
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        190⤵
        System Location Discovery: System Language Discovery
        
        PID:3288
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        191⤵
        
        PID:1668
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        192⤵
        
        PID:1316
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        193⤵
        Drops file in System32 directory
        
        PID:2904
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        194⤵
        
        PID:2088
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        195⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:5920
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        196⤵
        Adds Run key to start application
        
        PID:3256
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        197⤵
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:3336
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        198⤵
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        
        PID:2940
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        199⤵
        Adds Run key to start application
        
        PID:1796
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        200⤵
        Adds Run key to start application
        Drops file in System32 directory
        
        PID:1504
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        201⤵
        
        PID:5524
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        202⤵
        
        PID:1120
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        203⤵
        
        PID:5268
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        204⤵
        
        PID:1756
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        205⤵
        
        PID:588
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        206⤵
        
        PID:1516
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        207⤵
        
        PID:1272
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        208⤵
        
        PID:5088
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        209⤵
        
        PID:5648
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        210⤵
        
        PID:4892
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        211⤵
        
        PID:6096
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        212⤵
        
        PID:6068
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        213⤵
        
        PID:1104
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        214⤵
        
        PID:1820
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        215⤵
        
        PID:6040
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        216⤵
        
        PID:4324
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        217⤵
        
        PID:4160
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        218⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        219⤵
        
        PID:1320
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        220⤵
        
        PID:2280
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        221⤵
        
        PID:4392
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        222⤵
        
        PID:6056
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        223⤵
        
        PID:360
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        224⤵
        
        PID:4908
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        225⤵
        
        PID:1536
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        226⤵
        
        PID:3520
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        227⤵
        
        PID:2360
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        228⤵
        
        PID:2324
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        229⤵
        
        PID:1164
        
        C:\Windows\SysWOW64\internat.exe
        
        "C:\Windows\system32\internat.exe"
        230⤵
        
        PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

internat.exe

Path C:\Windows\SysWOW64\internat.exe
Size 33KB
SHA256 f1d5c9333e628e717b4967995db7a9f4b8dc1e602ff954e57a17ef2513f2db83
MD5 753c80d3801f0259734af3bf1bc4f657
SHA1 05898ff44e0392c2d30751af1b89daa3973598c5
SHA512 430216ae91b62b2e57e7ea42c2003c2bb6541ef57f7131940589ff2ce22efce1f58b78ff1bf1d39822cf016265618a06e15d78233d1c9abcc80d77f6918ebf64
SSDEEP 768:Loi4qZOkQfSKFyU41Ordnt3V1AYl7/aXaUrF:Lv4qZdQ/yUYG/l7CXF
TLSH
T17FE22B83F592C8B1C000CCF89DB6C365BA3B79641DA69797B9FE6BCDEC6A351450C089
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ls.txt

Path C:\Windows\SysWOW64\ls.txt
Size 32B
SHA256 a642f62b4bffdc39b301b3c296386e28d95bbeec739d38f5a1aaac4f4c543c2a
MD5 332eb279c5009f3ae739dda04b408f5f
SHA1 f1d448c969e003e58bed887f0f0de52ab93e0ba0
SHA512 e9dc3498e922b93f08a74994003859db491b3972bb5c50245ffbf69ba9670b03ff86f27c59814b665d93eb46e8b4640f23df220ef9cf8be3711734329ca0b004
MD5 SHA1 SHA512

Submit Download

memory/244-135-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/468-98-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/692-18-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1028-181-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1240-185-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1620-66-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1900-177-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1916-126-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2168-14-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2212-131-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2276-187-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2332-173-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2408-82-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2432-169-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2692-191-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2724-167-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2732-183-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2832-26-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2912-22-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/2956-78-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3036-161-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3116-155-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3240-34-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3292-151-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3328-122-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3544-94-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3848-74-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3936-58-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4036-110-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4060-149-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4136-46-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4148-143-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4308-90-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4360-157-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4472-118-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4512-145-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4568-141-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4624-86-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4632-70-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4684-147-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4688-133-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5052-38-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5076-6-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5116-42-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5216-102-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5300-129-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5312-163-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5336-114-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5360-137-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5436-153-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5628-175-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5636-106-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5684-2-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5756-30-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5812-179-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5832-50-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5900-54-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5932-159-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5936-165-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/6024-62-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/6036-10-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/6052-189-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/6128-139-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/6132-171-0x0000000000400000-0x0000000000410000-memory.dmp

Download