5eb593054a94c8659016624eea048e279fcf374c4043e6d121587d01ef506835

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 19:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Size 57KB
Sample261012-yc84dset7s
SHA256 5eb593054a94c8659016624eea048e279fcf374c4043e6d121587d01ef506835
MD5 2837ea31b7f68770350fd185c0604e2b
SHA1 fdaf4b8d0cb05cc003e9b559df38228cf2be7edf
SHA512 7f9dbaf25246aa925a306450fbf3e974d67da8704615ce1548736f46525a019d5a22eee26066dfa94e989b99eabbccf3cca7910d60730b2119812ac3934b6006
SSDEEP 768:/kRmosl06cA28DqSV8WnR1EQgz5pDZLhRWLhuHIf4qBkptr6W8U1ZJXhw13Q:sRmex8mSVpRIDZdZD7ptr/ZNxw1A
TLSH
T12E43E0A367442881F0DAAD7220E29D5D1428B913651CBB9677C06A7FBC33CEFB56601F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Sets file to hidden 1 TTPs 2 IoCs

Modifies file attributes to stop it showing in Explorer etc.

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4680	attrib.exe
464	attrib.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	inl2E6.tmp

Executes dropped EXE 1 IoCs

pid	Process
4704	inl2E6.tmp

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\hsdfasd = "\"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\tmp.\\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}\" hh.exe"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe
File opened for modification	C:\PROGRA~1\INTERN~1\ieframe.dll	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4908	cmd.exe
1808	cmd.exe
2792	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	inl2E6.tmp
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	inl2E6.tmp

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	inl2E6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000838c765fc5677a49bc2c0d1578ce33c300000000020000000000106600000001000020000000f51b91e469865f714fe100d47ba3073f41b9c61115047919fe72065727db1d27000000000e80000000020000200000004e12d549f7567ce57555fb40f9db4277ef30c1e112ae77a95d127f3044e1b5b3200000006565f5b28aa09ea4c03680aba01eb1898b65f06ad578ef64828a3ced11c7834e40000000ccbeebaf41f8822cccdb35d0a87bd971bb646068eb880b3f2f84a0ef6ecd771a8c8e47c797f11b5bb0f51c74cced1293251c781d598c9224b32f2d2e96a63873	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 603a43f0895add01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	reg.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000838c765fc5677a49bc2c0d1578ce33c30000000002000000000010660000000100002000000047205a9b376b43764a9e9334e9762dddcb9d3ccffadd88ba1d4ca483f8e1140e000000000e8000000002000020000000b887caf027399e78beaa02bf4afd0993cf8a6b97bbc4d36122a35871862bdcfd20000000249bc85de6cc6eb30d323a70be6ac878924931ae44b73c23f88fcc66e3259dcc4000000062d2f2a9b9db16fd99caebc0dc99c863f991716088fd2e3a5d31e3633eb608c99cd12099d4abc24c5dfc81601e4c6ba9e41e63b8f0a69e3a318a8336f325db8b	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 805337f0895add01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2365834585"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "498598979"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283841"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{B7B091CF-C674-11F1-A0CA-7A0C86DD99A0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2355521344"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31283841"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?o"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.82133.com/?o"	reg.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\IsShortCut	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command\ = "wscript -e:vbs \"C:\\Users\\Admin\\AppData\\Roaming\\PPLive\\3.bat\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)	reg.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2228	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
Token: SeIncBasePriorityPrivilege	4704	inl2E6.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5064	iexplore.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5064	iexplore.exe
5064	iexplore.exe
208	IEXPLORE.EXE
208	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 4908	2228	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe	99
PID 4908 wrote to memory of 1808	4908	cmd.exe	101
PID 1808 wrote to memory of 5064	1808	cmd.exe	103
PID 1808 wrote to memory of 4968	1808	cmd.exe	104
PID 1808 wrote to memory of 2792	1808	cmd.exe	105
PID 2228 wrote to memory of 4704	2228	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe	107
PID 2228 wrote to memory of 2276	2228	jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe	108
PID 5064 wrote to memory of 208	5064	iexplore.exe	109
PID 2792 wrote to memory of 1084	2792	cmd.exe	111
PID 2792 wrote to memory of 1736	2792	cmd.exe	112
PID 2792 wrote to memory of 3724	2792	cmd.exe	113
PID 2792 wrote to memory of 4856	2792	cmd.exe	114
PID 2792 wrote to memory of 1232	2792	cmd.exe	115
PID 2792 wrote to memory of 4680	2792	cmd.exe	116
PID 2792 wrote to memory of 464	2792	cmd.exe	117
PID 2792 wrote to memory of 4996	2792	cmd.exe	118
PID 2792 wrote to memory of 4124	2792	cmd.exe	119
PID 4996 wrote to memory of 1632	4996	rundll32.exe	120
PID 1632 wrote to memory of 228	1632	runonce.exe	121
PID 4704 wrote to memory of 3468	4704	inl2E6.tmp	129

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
464	attrib.exe
4680	attrib.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Dropper.Win32.Agent.bjrmwt.exe"
1⤵
- Checks computer location settings
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\comeback_197.bat" "
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\1.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1808
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      C:\PROGRA~1\INTERN~1\IEXPLORE.EXE http://WWw.cnkankan.com/?82133
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5064
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5064 CREDAT:17410 /prefetch:2
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:208
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\1.inf
      4⤵
      System Location Discovery: System Language Discovery
      PID:4968
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Roaming\PPLive\2.bat
      4⤵
      Drops file in Program Files directory
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2792
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:1084
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Internet Explorer\Main" /v "Start Page" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:1736
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\tmp" /v "key" /d ""http://www.82133.com/?o"" /f
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3724
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}" /v "IsShortCut" /d "" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:4856
    - - C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCR\CLSID\{971C5380-92A0-5A69-B3EE-C3002B33309E}\Shell\open(&H)\Command" /v "" /d "wscript -e:vbs ""C:\Users\Admin\AppData\Roaming\PPLive\3.bat""" /f
        5⤵
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:1232
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp\a.{971C5380-92A0-5A69-B3EE-C3002B33309E}
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:4680
    - - C:\Windows\SysWOW64\attrib.exe
        
        attrib +s +h C:\Users\Admin\AppData\Roaming\PPLive\tmp
        5⤵
        Sets file to hidden
        System Location Discovery: System Language Discovery
        Views/modifies file attributes
        
        PID:464
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 syssetup,SetupInfObjectInstallAction DefaultInstall 128 C:\Users\Admin\AppData\Roaming\PPLive\2.inf
        5⤵
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4996
      - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious use of WriteProcessMemory
        
        PID:1632
        
        C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:228
    - - C:\Windows\SysWOW64\rundll32.exe
        
        rundll32 D:\VolumeDH\inj.dat,MainLoad
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4124
- C:\Users\Admin\AppData\Local\Temp\inl2E6.tmp
  C:\Users\Admin\AppData\Local\Temp\inl2E6.tmp
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\inl2E6.tmp > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3468
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\JAFFAC~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2276

C:\Windows\system32\grpconv.exe
grpconv -o
1⤵
PID:2032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 471B
SHA256 77f092574df221fef3caa5611bcc1a8c78381ec8c0c54bb107e6cc5355c4840f
MD5 5163274101cd2a42b5ea54c9cb7602ff
SHA1 60b5fde304e075da3de47020d42f3bfd5c322f52
SHA512 df38a3009056658dd88ffbb976737d1bd9258f76ab6e6bef8af1654e7ec233d041b4ed4c913734796d3be5635e2b80c93e1da128d63e2269be61d7205c7195f8
TLSH
T132F0D4D5A03EF8602D5798FC62712B4B603191E62C61147435781DFD48567773E5E035
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_430EA0912164D1B129D6E1DC07C63959
Size 416B
SHA256 b4fbfdd4ef0667c3021b5f196d493936cbca624fcea1b1985eae2a8486eab8a4
MD5 a34f82af026a32790e82ada1b99abe2e
SHA1 d9d751c3cd4058278a9db24950f39cbc64eb7296
SHA512 de0cf232b350a521e696ae46c237a1ec8fa424884e1efabe8915547034f17f00e891ffa6f81b7d7bec4cd3237dbe1c4ea2a8e5affa0cbdd1165d2083ed3b9518
TLSH
T15DE0C03411FA831FF5E4E1394BD9742194A9F02B241DA2B43BD49B04BB02A009C0392A
MD5 SHA1 SHA512 TLSH

Submit Download

jm_setup_qvod[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9ITXMUND\jm_setup_qvod[1].htm
Size 11KB
SHA256 b5bc80c286321d117d4faf28c8ecd32cd4499e926034205f6fbcd181c5c39469
MD5 80cd854c562c25dfac65c15726ef2253
SHA1 1cf7c23c94524fb604a99aa5b37e568fbdb435dd
SHA512 61f9886f813763f507bbb496a9361c7a239e5e4a3f9545f1741797469e2bb42e42cc73176766c9219578c5cfa79bf95e4de5c22581a9f7016a570785e80d7e72
SSDEEP 96:gORGfADiML/HlXsjFPkIQlvZPy4REyJ5W+GW+oW+JidFkl6a0VUSN0ELXp+E6yL:ZgYDiMLPlshkIQlvxyXyJskGSELXp0yL
TLSH
T1B732B71696F702206517C4998BBF77287774E043D80BC96DBACE1398CF8C9CAC46366C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

suggestions[1].en-US

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\U3DRQ2XJ\suggestions[1].en-US
Size 17KB
SHA256 c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
MD5 5a34cb996293fde2cb7a4ac89587393a
SHA1 3c96c993500690d1a77873cd62bc639b3a10653f
SHA512 e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
SSDEEP 384:K4gN8sGygaEKfWYSJUKbO7UckxtBjCdY7mO3D0C5l+piEieDSV126ry1/XSGKwG3:K4gNFXiKfWfJ1Kockxbd7mAt5Mp5ie2F
TLSH
T13A823E4E61D88F57EA47B6B2D9084EA702E0C8794716DB93D62CFE63CDE33B25D02161
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

comeback_197.bat

Path C:\Users\Admin\AppData\Local\Temp\comeback_197.bat
Size 53B
SHA256 1abcea214b9b2bd76cc04be07ae2d4d70371e6ca443d99f4f1327afe7a5fc647
MD5 23962a245f75fe25510051582203aff1
SHA1 20832a3a1179bb2730194d2f7738d41d5d669a43
SHA512 dc36b64f2dbb710652900a31295c148760b0c44eae13515aa29613916c9dffe3d8e55ba61568f7c27b43bf0c341f7dcd4b9c721f81627fc6bb915b15c358fe80
TLSH
T15D90022415DDD75D5511445317B9944C516446902EA9361487805A4853C1C05B892002
MD5 SHA1 SHA512 TLSH

Submit Download

winrar_config.tmp

Path C:\Users\Admin\AppData\Local\Temp\winrar_config.tmp
Size 660B
SHA256 b1a31a74cc88d0f8e39aaebf58a724b89391dc3fbac733953790edf8ded8172c
MD5 c40ea8f677b3f48bfb7f4cfc6d3f03ab
SHA1 10b94afd8e6ea98a3c8a955304f9ce660b0c380a
SHA512 409b8a45576bf08e185446b13a512c115df7483ff8ec30ea51ee93ee1ac8153ae3b615650ff69a5d1e41fa0cd57fcdc4c5d03b4b4453431114ac018f48e194d9
TLSH
T1D301DDCECC068802246DDE62B3BE0804C347B2CF8A80D8B1C7615F442E4221322D32B7
MD5 SHA1 SHA512 TLSH

Submit Download

1.bat

Path C:\Users\Admin\AppData\Roaming\PPLive\1.bat
Size 3KB
SHA256 f1a2f9fdebb3cac24756e53fa5e1628b2bd1cc130480c1878e3b3bc880575cd1
MD5 b7c5e3b416b1d1b5541ef44662e1a764
SHA1 8bff7ea2be2f3cf29f2381d8007198b5991ca3ae
SHA512 65dbd6a7a7cf6fec00e6b0f1d7d5655769e6087ad09cad74c91c5a3395e675ac8f9df5c7185327e6f8dd03ddb60504400f54237d9e4b53c8b08e7e3d41ee61fc
TLSH
T150719ACE3846C00AB40E14C4DB7469A7F95DA0EB85E29C05B10B9BB109C47C13F8EA6E
MD5 SHA1 SHA512 TLSH

Submit Download

1.inf

Path C:\Users\Admin\AppData\Roaming\PPLive\1.inf
Size 382B
SHA256 2981c144ae25f6568fe87d4c068e6324888ad56a7ae7cefc1378e8c03ac078eb
MD5 e02d326cc33274582c68c7e42e65ec53
SHA1 7a245d756597182c34051fac96e2cc4929c5d1ca
SHA512 6cb6c9d85e12b5c64910ed18af9ecc056c739faef31e7d67a8ce0396daa972ceb5ce9d064d40655d2fed0090d980d4490ad30ab31fa2b72d75a698b1239aa7dd
TLSH
T128E01A8E9F1962CCF1113800A6338B65FA799861B530B61CB18ED5040E10EC51DA6EF7
MD5 SHA1 SHA512 TLSH

Submit Download

1.inf

Path C:\Users\Admin\AppData\Roaming\PPLive\1.inf
Size 420B
SHA256 2197f5d1c5ed4fea53f7417e16e9442f3c6e2f63bd8ca18f10543821e85b08d9
MD5 9d3fca001c7dd56688ed65a0812c537f
SHA1 66009cd9206d48295b2cb3dca2197a653e6466af
SHA512 b61cf4b1ba39b353b3f1b8d78c7bc0a34c53479a3d57700a83818da2d8aff303ba9a927177e9af78c7de720a68bc91a70dfcb0b406f117de530f25d3b1590e42
TLSH
T1D9E06D8D5F1962CCF1123400A632DB69BA755461B530B51DB18AC5050F10AC52EAAEF7
MD5 SHA1 SHA512 TLSH

Submit Download

1.inf

Path C:\Users\Admin\AppData\Roaming\PPLive\1.inf
Size 492B
SHA256 fe0dfb3458bfe2a3632d365e00765fa10f14d62e7dfa8b70a055c7eb9fdb6713
MD5 34c14b8530e1094e792527f7a474fe77
SHA1 f71c4e9091140256b34c18220d1dd1efab1f301d
SHA512 25bb09b526e1e9f5c6052f1f7c36b37c956c1b5649936af8df3abfcf120c931f3d2603e17a061cb99d8c8074bfb1973a5423cce89762fca53cd46aeb3e8944a2
TLSH
T1B7F0E25D5B1461CDF0127400AA32DEB5AB655411F971751DF08EC9050F10AC52FAABFA
MD5 SHA1 SHA512 TLSH

Submit Download

2.bat

Path C:\Users\Admin\AppData\Roaming\PPLive\2.bat
Size 3KB
SHA256 81f64f42edfac2863a55db8fabd528c4eefc67f7e658cad6a57eeec862e444e3
MD5 6b78cb8ced798ca5df5612dd62ce0965
SHA1 5a9c299393b96b0bf8f6770e3c7b0318a9e2e0cf
SHA512 b387ba10021f3284d1406d520a2c8b3ba0c87922d67c79394c1aa50c631194519ac6bb5b898956533f040d48e1c7b202734e0075f8fc8c8bfab82c8ef359b28e
TLSH
T1D97159D1A811D4CBD90F85E3CB602253B90EE9C706D26B5CE65347B828F1F8157EC69D
MD5 SHA1 SHA512 TLSH

Submit Download

2.inf

Path C:\Users\Admin\AppData\Roaming\PPLive\2.inf
Size 247B
SHA256 6cdfa9b7f0e1e4ee16bc8ce5d7448d47ea8866c1f55f3e56be5c2a4d183ca534
MD5 ca436f6f187bc049f9271ecdcbf348fa
SHA1 bf8a548071cfc150f7affb802538edf03d281106
SHA512 d19e20aabddad6b0284f8c1d473e9180f30b49d4d8b54f26e7c8630228e16b1f6ba04023c5e8b1993d8a10d97adcfff683b216f79b9981bf16181641aebdd591
TLSH
T1E0D02E3A2A08A829F2602A2002277CC8AAE62A8620C8FA0C22941004A380518E4AE0D3
MD5 SHA1 SHA512 TLSH

Submit Download

4.bat

Path C:\Users\Admin\AppData\Roaming\PPLive\4.bat
Size 5.8MB
SHA256 c3a3b671127a45607a3ae3277597abcfd3b93e9420fd10dc9930b3619b3a9536
MD5 89e92682d42cdfa57faa1f6d1d9181ed
SHA1 d87fc5c41ad288a1120b7d1cb1b6f72c4d76bc1e
SHA512 2a85025b3ddd1d53ae3f691728f484933e6f071bcfbc6a68437eb46502b44964095065b0c1547a9d35205d33dd53384fd0b981938ddb1807ac41f2bbb3e872d7
SSDEEP 98304:9sjEZDoJbVKEhxuxjuQHXiwkIZuBckUryuLfJtF5:9ZAbVKogsSUqkUFJtF5
TLSH
T1D1566C212648D462D6F32537157CB77391AFE5706B3008EB8212FAB92D325C25E3A79F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

┐┤┐┤╡τ╙░.url

Path C:\Users\Admin\AppData\Roaming\PPLive\┐┤┐┤╡τ╙░.url
Size 123B
SHA256 91ee23b4056ad4a95816d271e10f14655c75a30c88927508f9821a70bb46e110
MD5 e9da364d2bfac6d38868f780f3dd8ddd
SHA1 ddc6c4cbed064d0ed7f26687b72b23d702144a09
SHA512 db825b8df823339a6759133853e8bc2837e1040cc2153c03425fe24335642b982190ac6a756ff45012c8249d539a8b767ca3a61d5cf11d6924acdfb0173082bf
TLSH
T1DDB02B34054EC01EA847C43F09308848D85033D0954BCD4082408A680E44004ECC4D00
MD5 SHA1 SHA512 TLSH

Submit Download

╟º═┼═┼╣║.url

Path C:\Users\Admin\AppData\Roaming\PPLive\╟º═┼═┼╣║.url
Size 133B
SHA256 0618514dd267eb9e3b3b2ac246a5052bfb852647724603d8becdade30c5662e0
MD5 4226b56a3c3f8c7a95287c2e21d4a000
SHA1 a161b2a8038fd5bfa11a75d22c75a3a030df3267
SHA512 aef1dca5c8f28fc99754e31ad46a84d787005d6790e0e8ea0bf171f11955eacff310878f808de126d6e32cb54405afbaeeb125d864e64eaf505c8c6b708ec2f9
TLSH
T154C02B20056FD15DC063842F0D708C0DCE1030C4E68EFD4482014A083E4E8007CC4301
MD5 SHA1 SHA512 TLSH

Submit Download

░╦╪╘╔½═╝.url

Path C:\Users\Admin\AppData\Roaming\PPLive\░╦╪╘╔½═╝.url
Size 118B
SHA256 09dd2f0512224f9b035ea73c05e7baace47a6187c9fef9027a008083f08585e7
MD5 0c8d441e4a5f649b3f57e042e2d32d3c
SHA1 5cb3debced6674de14503ff23044373c1a0b1477
SHA512 95a2d68aaed2612e3c1ac3b1c7827544065ee43623f6358af9957ddd5536b4eacde2c27eae0aede7f0125c639950e6d15bba2f90a6df74a60f7530f4e4305bf2
TLSH
T147B09B24468DD15E5447456F49794854DC5125D4695FDA44C3414E5C15814416DD9643
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2228-6-0x0000000000BB0000-0x0000000000BB3000-memory.dmp

Download

memory/2228-5-0x00000000004D0000-0x00000000004F7000-memory.dmp

Download

memory/2228-1-0x0000000000BB0000-0x0000000000BB3000-memory.dmp

Download

memory/2228-0-0x00000000004D0000-0x00000000004F7000-memory.dmp

Download

memory/2228-104-0x00000000004D0000-0x00000000004F7000-memory.dmp

Download

memory/5064-95-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-71-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-90-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-88-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-87-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-83-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-80-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-79-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-76-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-94-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-101-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-105-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-77-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-102-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-97-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-100-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-99-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-70-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-106-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-73-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-109-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-108-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-110-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-115-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-114-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-75-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-72-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-124-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-132-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-92-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-141-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-146-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-155-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-156-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-159-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-157-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-160-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-166-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-170-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-165-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-154-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-153-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-171-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-174-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-178-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-180-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-179-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-181-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-175-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-177-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-67-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-69-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-187-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-196-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-198-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-197-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-66-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

memory/5064-206-0x00007FFA7CA70000-0x00007FFA7CADE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads