83bf9f870b3195dc3ca0a92211489aa353348f7581759e3c93d594327e194849

General

Target

83bf9f870b3195dc3ca0a92211489aa353348f7581759e3c93d594327e194849.exe
Size

936KB
MD5

d398d699709ad400db9e7555cb4cfde9
SHA1

5cc4f248595268a0c9988daee3f0f8f9f5ac0a7f
SHA256

83bf9f870b3195dc3ca0a92211489aa353348f7581759e3c93d594327e194849
SHA512

3d9812f07f1cb25fb4aa7cc996614de00956d0f69f815a0f821b32b529ed8bb510aacb8d71c3baf2ce4628ea349f32e752e90c9aa67d6af17d373dc54da60724

Score

4^/10

link pdf

Malware Config

Signatures

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Zakon.pdf	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

83bf9f870b3195dc3ca0a92211489aa353348f7581759e3c93d594327e194849.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000_Classes\Local Settings	83bf9f870b3195dc3ca0a92211489aa353348f7581759e3c93d594327e194849.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe
3732	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

3732 AcroRd32.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

3732 AcroRd32.exe
3732 AcroRd32.exe
3732 AcroRd32.exe
3732 AcroRd32.exe
3732 AcroRd32.exe
3732 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

83bf9f870b3195dc3ca0a92211489aa353348f7581759e3c93d594327e194849.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2416 wrote to memory of 3732	2416	83bf9f870b3195dc3ca0a92211489aa353348f7581759e3c93d594327e194849.exe	AcroRd32.exe
PID 2416 wrote to memory of 3732	2416	83bf9f870b3195dc3ca0a92211489aa353348f7581759e3c93d594327e194849.exe	AcroRd32.exe
PID 2416 wrote to memory of 3732	2416	83bf9f870b3195dc3ca0a92211489aa353348f7581759e3c93d594327e194849.exe	AcroRd32.exe
PID 3732 wrote to memory of 4016	3732	AcroRd32.exe	RdrCEF.exe
PID 3732 wrote to memory of 4016	3732	AcroRd32.exe	RdrCEF.exe
PID 3732 wrote to memory of 4016	3732	AcroRd32.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 3780	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe
PID 4016 wrote to memory of 1364	4016	RdrCEF.exe	RdrCEF.exe

C:\Users\Admin\AppData\Local\Temp\83bf9f870b3195dc3ca0a92211489aa353348f7581759e3c93d594327e194849.exe
"C:\Users\Admin\AppData\Local\Temp\83bf9f870b3195dc3ca0a92211489aa353348f7581759e3c93d594327e194849.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2416

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Zakon.pdf"
2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3732

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
- Suspicious use of WriteProcessMemory
PID:4016

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AE8F35701A480EACECB854852FA4B38D --mojo-platform-channel-handle=1668 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:3780

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9B7662E63DEC98FD71262826D7B9469E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9B7662E63DEC98FD71262826D7B9469E --renderer-client-id=2 --mojo-platform-channel-handle=1680 --allow-no-sandbox-job /prefetch:1
4⤵
PID:1364

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B60B6710A56BBA632776684E0092D577 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B60B6710A56BBA632776684E0092D577 --renderer-client-id=4 --mojo-platform-channel-handle=2140 --allow-no-sandbox-job /prefetch:1
4⤵
PID:3576

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1991BE06928EE46809FFD21068106C98 --mojo-platform-channel-handle=1812 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:3668

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=76D3105F347F81E7A013D43072EAC7B1 --mojo-platform-channel-handle=2628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2188

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3E427CD854216A696F323B8EFE4DC39A --mojo-platform-channel-handle=1964 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:3340

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Zakon.pdf
MD5
fdcf34d0d0e7a4adba4a40faa10d0b07

SHA1
1e0c4a5f0ff2e835d12c3b6571ae6000e81a014b

SHA256
5ced3780b8875351b8d69bef2c6da3ad696a2e3c69d6c1ef4e457dbcf1494292

SHA512
f4296b49e1b3828c3adfca219b2d634ecf00ad534382eae7f4a61f743cbf70e0420789bf7864212bd9830743b66414cb71707e14dce99f462408f5342cd512d7

Download Submit
memory/1364-256-0x0000000077EB2000-0x0000000077EB3000-memory.dmp

Filesize
4KB

Download
memory/2188-270-0x0000000077EB2000-0x0000000077EB3000-memory.dmp

Filesize
4KB

Download
memory/3340-273-0x0000000077EB2000-0x0000000077EB3000-memory.dmp

Filesize
4KB

Download
memory/3576-262-0x0000000077EB2000-0x0000000077EB3000-memory.dmp

Filesize
4KB

Download
memory/3668-267-0x0000000077EB2000-0x0000000077EB3000-memory.dmp

Filesize
4KB

Download
memory/3780-254-0x0000000077EB2000-0x0000000077EB3000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads