acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a

General

Target

acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe
Size

284KB
MD5

40c157e8302e1cf6af387b5f88a89ea3
SHA1

22bf5f8acc26244c374835b8bb53d9de4becebbd
SHA256

acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a
SHA512

490e3449868c2db741360b036b0ee8621668c5fae75b972ae411713ec612fc1ceaf83a8526924ab5715a525e9d5ff5a180e290ceb383eadf7466441a2bc97abf

Score

9^/10

discovery persistence

Malware Config

Signatures

ServiceHost packer 1 IoCs

Detects ServiceHost packer used for .NET malware

Processes:

resource	yara_rule
behavioral2/memory/184-52-0x0000000000000000-mapping.dmp	servicehost

Executes dropped EXE 1 IoCs

Processes:

syime.exe

pid process

3988 syime.exe

pid	process
3988	syime.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\dwpoo = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Syimey\\syime.exe\""	explorer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exesyime.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	syime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	syime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	syime.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\DeviceDesc	syime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_SANU&PROD_SANU_DVD-ROM\4&37CE57BA&0&010000	acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&37ce57ba&0&010000\DeviceDesc	acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_&PROD_HEARTDISK\4&37CE57BA&0&000000	acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

3724 PING.EXE

pid	process
3724	PING.EXE

Suspicious behavior: EnumeratesProcesses 38 IoCs

Processes:

explorer.exe

pid	process
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe
1568	explorer.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

syime.exe

pid process

3988 syime.exe

pid	process
3988	syime.exe

Suspicious use of AdjustPrivilegeToken 801 IoCs

Processes:

explorer.exe

description	pid	process
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe
Token: SeDebugPrivilege	1568	explorer.exe

Suspicious use of WriteProcessMemory 418 IoCs

Processes:

acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.execmd.exesyime.exeexplorer.exe

description	pid	process	target process
PID 984 wrote to memory of 3988	984	acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe	syime.exe
PID 984 wrote to memory of 3988	984	acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe	syime.exe
PID 984 wrote to memory of 3988	984	acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe	syime.exe
PID 984 wrote to memory of 184	984	acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe	cmd.exe
PID 984 wrote to memory of 184	984	acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe	cmd.exe
PID 984 wrote to memory of 184	984	acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe	cmd.exe
PID 184 wrote to memory of 3724	184	cmd.exe	PING.EXE
PID 184 wrote to memory of 3724	184	cmd.exe	PING.EXE
PID 184 wrote to memory of 3724	184	cmd.exe	PING.EXE
PID 3988 wrote to memory of 1568	3988	syime.exe	explorer.exe
PID 3988 wrote to memory of 1568	3988	syime.exe	explorer.exe
PID 3988 wrote to memory of 1568	3988	syime.exe	explorer.exe
PID 3988 wrote to memory of 1568	3988	syime.exe	explorer.exe
PID 1568 wrote to memory of 2772	1568	explorer.exe	sihost.exe
PID 1568 wrote to memory of 2772	1568	explorer.exe	sihost.exe
PID 1568 wrote to memory of 2772	1568	explorer.exe	sihost.exe
PID 1568 wrote to memory of 2888	1568	explorer.exe	taskhostw.exe
PID 1568 wrote to memory of 2888	1568	explorer.exe	taskhostw.exe
PID 1568 wrote to memory of 2888	1568	explorer.exe	taskhostw.exe
PID 1568 wrote to memory of 2260	1568	explorer.exe	Explorer.EXE
PID 1568 wrote to memory of 2260	1568	explorer.exe	Explorer.EXE
PID 1568 wrote to memory of 2260	1568	explorer.exe	Explorer.EXE
PID 1568 wrote to memory of 3252	1568	explorer.exe	ShellExperienceHost.exe
PID 1568 wrote to memory of 3252	1568	explorer.exe	ShellExperienceHost.exe
PID 1568 wrote to memory of 3252	1568	explorer.exe	ShellExperienceHost.exe
PID 1568 wrote to memory of 3260	1568	explorer.exe	SearchUI.exe
PID 1568 wrote to memory of 3260	1568	explorer.exe	SearchUI.exe
PID 1568 wrote to memory of 3260	1568	explorer.exe	SearchUI.exe
PID 1568 wrote to memory of 3456	1568	explorer.exe	RuntimeBroker.exe
PID 1568 wrote to memory of 3456	1568	explorer.exe	RuntimeBroker.exe
PID 1568 wrote to memory of 3456	1568	explorer.exe	RuntimeBroker.exe
PID 1568 wrote to memory of 3756	1568	explorer.exe	DllHost.exe
PID 1568 wrote to memory of 3756	1568	explorer.exe	DllHost.exe
PID 1568 wrote to memory of 3756	1568	explorer.exe	DllHost.exe
PID 1568 wrote to memory of 184	1568	explorer.exe	cmd.exe
PID 1568 wrote to memory of 184	1568	explorer.exe	cmd.exe
PID 1568 wrote to memory of 184	1568	explorer.exe	cmd.exe
PID 1568 wrote to memory of 208	1568	explorer.exe	Conhost.exe
PID 1568 wrote to memory of 208	1568	explorer.exe	Conhost.exe
PID 1568 wrote to memory of 208	1568	explorer.exe	Conhost.exe
PID 1568 wrote to memory of 2772	1568	explorer.exe	sihost.exe
PID 1568 wrote to memory of 2772	1568	explorer.exe	sihost.exe
PID 1568 wrote to memory of 2772	1568	explorer.exe	sihost.exe
PID 1568 wrote to memory of 2888	1568	explorer.exe	taskhostw.exe
PID 1568 wrote to memory of 2888	1568	explorer.exe	taskhostw.exe
PID 1568 wrote to memory of 2888	1568	explorer.exe	taskhostw.exe
PID 1568 wrote to memory of 2260	1568	explorer.exe	Explorer.EXE
PID 1568 wrote to memory of 2260	1568	explorer.exe	Explorer.EXE
PID 1568 wrote to memory of 2260	1568	explorer.exe	Explorer.EXE
PID 1568 wrote to memory of 3252	1568	explorer.exe	ShellExperienceHost.exe
PID 1568 wrote to memory of 3252	1568	explorer.exe	ShellExperienceHost.exe
PID 1568 wrote to memory of 3252	1568	explorer.exe	ShellExperienceHost.exe
PID 1568 wrote to memory of 3260	1568	explorer.exe	SearchUI.exe
PID 1568 wrote to memory of 3260	1568	explorer.exe	SearchUI.exe
PID 1568 wrote to memory of 3260	1568	explorer.exe	SearchUI.exe
PID 1568 wrote to memory of 3456	1568	explorer.exe	RuntimeBroker.exe
PID 1568 wrote to memory of 3456	1568	explorer.exe	RuntimeBroker.exe
PID 1568 wrote to memory of 3456	1568	explorer.exe	RuntimeBroker.exe
PID 1568 wrote to memory of 3756	1568	explorer.exe	DllHost.exe
PID 1568 wrote to memory of 3756	1568	explorer.exe	DllHost.exe
PID 1568 wrote to memory of 3756	1568	explorer.exe	DllHost.exe
PID 1568 wrote to memory of 2772	1568	explorer.exe	sihost.exe
PID 1568 wrote to memory of 2772	1568	explorer.exe	sihost.exe
PID 1568 wrote to memory of 2772	1568	explorer.exe	sihost.exe

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2772

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2888

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2260

C:\Users\Admin\AppData\Local\Temp\acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe
"C:\Users\Admin\AppData\Local\Temp\acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe"
2⤵
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:984

C:\Users\Admin\AppData\Roaming\Microsoft\Syimey\syime.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Syimey\syime.exe
3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3988

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c ping.exe -n 6 127.0.0.1 & type "C:\Windows\\System32\\autoconv.exe" > "C:\Users\Admin\AppData\Local\Temp\acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a.exe" & del /F /Q "C:\Users\Admin\AppData\Local\Temp\acfe5824e57eb300d1328c68e7ba
3⤵
- Suspicious use of WriteProcessMemory
PID:184

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
4⤵
PID:208

C:\Windows\SysWOW64\PING.EXE
ping.exe -n 6 127.0.0.1
4⤵
- Runs ping.exe
PID:3724

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3252

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3260

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3456

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3756

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Syimey\syim.dll
MD5
7ceb99928d56047ae689f13e68ef56e7

SHA1
3063b51dc1b09ffa870afaa32943ae7b290d6df8

SHA256
7e7c0c1aeb7ca21dc57e92a4bd495a2934befe354ec4ac89ece5429160cd70b0

SHA512
2ff135d26aa31d94fd209f1f9030030e74f66762820ad5db58f41fe691975bfc049901abd7c68540f1e37e8597cf1642e675e65dd511b29878527aa5baa9b689

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Syimey\syime.exe
MD5
40c157e8302e1cf6af387b5f88a89ea3

SHA1
22bf5f8acc26244c374835b8bb53d9de4becebbd

SHA256
acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a

SHA512
490e3449868c2db741360b036b0ee8621668c5fae75b972ae411713ec612fc1ceaf83a8526924ab5715a525e9d5ff5a180e290ceb383eadf7466441a2bc97abf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Syimey\syime.exe
MD5
40c157e8302e1cf6af387b5f88a89ea3

SHA1
22bf5f8acc26244c374835b8bb53d9de4becebbd

SHA256
acfe5824e57eb300d1328c68e7ba188dba19666ec1e6bfa77fff6ce2420ce99a

SHA512
490e3449868c2db741360b036b0ee8621668c5fae75b972ae411713ec612fc1ceaf83a8526924ab5715a525e9d5ff5a180e290ceb383eadf7466441a2bc97abf

Download Submit
memory/184-3-0x0000000000000000-mapping.dmp

Download
memory/184-52-0x0000000000000000-mapping.dmp

Download
memory/184-51-0x0000000002F70000-0x0000000002F71000-memory.dmp

Filesize
4KB

Download
memory/1568-181-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-485-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-8-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/1568-14-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/1568-21-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/1568-6-0x0000000000000000-mapping.dmp

Download
memory/1568-48-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-47-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-807-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-765-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-53-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-92-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-120-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-177-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-727-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-219-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-265-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-303-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-345-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-349-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-350-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-387-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-429-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-471-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-475-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-7-0x0000000005390000-0x0000000005391000-memory.dmp

Filesize
4KB

Download
memory/1568-555-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-597-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-639-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-681-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-685-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-723-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/1568-724-0x0000000005E00000-0x0000000005E01000-memory.dmp

Filesize
4KB

Download
memory/3724-4-0x0000000000000000-mapping.dmp

Download
memory/3988-0-0x0000000000000000-mapping.dmp

Download
memory/3988-5-0x00000000020B0000-0x00000000020E5000-memory.dmp

Filesize
212KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads