323634d8c61be01b65f77418210092192e5685336d255b9052965060c64a598e

General

Target

MetaWorld/Meta World Launcher beta.exe
Size

714.9MB
MD5

96d65eabe7288c7590f44795a9822823
SHA1

080df69b94e4e7afcafd935c71098ba62aafad4d
SHA256

6cddbdcb02b77f840aa179df779d702c805fe48cf5b6425d062ade87450e705e
SHA512

b3b84c329a85f1ac9c70927bab5df924c1306ee6907ae483396c85705bf86211941b8d7423acc15a4f90cfeee69d5ae7a04504d4391e0225ba70f44318e84a40
SSDEEP

98304:MJmvB+wUnhopFNE8yCE+8t7PxBTylOqtKQCHb/i+E:gYin6pU8yCE+8FxBTH9QC7d

Score

6^/10

persistence spyware

Malware Config

Signatures

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

AppLaunch.exemsedge.exemsedge.exeAppLaunch.exe

pid	process
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
4156	AppLaunch.exe
1204	msedge.exe
1204	msedge.exe
4612	msedge.exe
4612	msedge.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe
4940	AppLaunch.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid process

4612 msedge.exe
4612 msedge.exe
4612 msedge.exe
4612 msedge.exe
4612 msedge.exe

pid	process
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

AppLaunch.exeAUDIODG.EXEAppLaunch.exe

description	pid	process
Token: SeDebugPrivilege	4156	AppLaunch.exe
Token: 33	1036	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1036	AUDIODG.EXE
Token: SeDebugPrivilege	4940	AppLaunch.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

helppane.exemsedge.exe

pid process

4676 helppane.exe
4612 msedge.exe
4612 msedge.exe
4612 msedge.exe
4612 msedge.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

helppane.exe

pid process

4676 helppane.exe
4676 helppane.exe

pid	process
4676	helppane.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe

pid	process
4676	helppane.exe
4676	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Meta World Launcher beta.exehelppane.exemsedge.exe

description	pid	process	target process
PID 1980 wrote to memory of 4156	1980	Meta World Launcher beta.exe	AppLaunch.exe
PID 1980 wrote to memory of 4156	1980	Meta World Launcher beta.exe	AppLaunch.exe
PID 1980 wrote to memory of 4156	1980	Meta World Launcher beta.exe	AppLaunch.exe
PID 1980 wrote to memory of 4156	1980	Meta World Launcher beta.exe	AppLaunch.exe
PID 1980 wrote to memory of 4156	1980	Meta World Launcher beta.exe	AppLaunch.exe
PID 1980 wrote to memory of 4156	1980	Meta World Launcher beta.exe	AppLaunch.exe
PID 1980 wrote to memory of 4156	1980	Meta World Launcher beta.exe	AppLaunch.exe
PID 1980 wrote to memory of 4156	1980	Meta World Launcher beta.exe	AppLaunch.exe
PID 1980 wrote to memory of 4156	1980	Meta World Launcher beta.exe	AppLaunch.exe
PID 4676 wrote to memory of 4612	4676	helppane.exe	msedge.exe
PID 4676 wrote to memory of 4612	4676	helppane.exe	msedge.exe
PID 4612 wrote to memory of 1328	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 1328	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3904	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 1204	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 1204	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3760	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3760	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3760	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3760	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3760	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3760	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3760	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3760	4612	msedge.exe	msedge.exe
PID 4612 wrote to memory of 3760	4612	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\MetaWorld\Meta World Launcher beta.exe
"C:\Users\Admin\AppData\Local\Temp\MetaWorld\Meta World Launcher beta.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4156

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
2⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff814f346f8,0x7ff814f34708,0x7ff814f34718
3⤵
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16019993880064529594,18085324450751587094,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
3⤵
PID:3904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,16019993880064529594,18085324450751587094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1204

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,16019993880064529594,18085324450751587094,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
3⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16019993880064529594,18085324450751587094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3980 /prefetch:1
3⤵
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16019993880064529594,18085324450751587094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
3⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,16019993880064529594,18085324450751587094,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5292 /prefetch:8
3⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16019993880064529594,18085324450751587094,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
3⤵
PID:4168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16019993880064529594,18085324450751587094,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
3⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,16019993880064529594,18085324450751587094,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4328 /prefetch:8
3⤵
PID:4652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16019993880064529594,18085324450751587094,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
3⤵
PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f0 0x2cc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2224

C:\Users\Admin\AppData\Local\Temp\MetaWorld\Meta World Launcher beta.exe
"C:\Users\Admin\AppData\Local\Temp\MetaWorld\Meta World Launcher beta.exe"
1⤵
PID:4160

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
Filesize
2KB

MD5
c895c67ab1eebc160551541ddc852d83

SHA1
bbcb903655b859cb22e72e99f380ca896273edff

SHA256
66db2106de25f4874dbce0c27e8e614f5a91451648b4b3b6108bb43ba21bed51

SHA512
4da210842464d541cea259f4f8b827d1bcb5df0264ed44ff7f17e7001c29fadc99fde801aced78707216317adc92ec478773ea7ebc25525de065ab57fb2476f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies
Filesize
20KB

MD5
46333bd6df24a6e953590a53aee5deab

SHA1
42eabb52d803469a3c151c6b924c6b5034803b77

SHA256
62255867d19b2a3828ac58c9b7f7b855b28085c1a627fbe60da7fc1cd045e88e

SHA512
aedbae6aa6fbd91e0a81fcb1b724203cc043d6290ce3eef6ae8257f7a845c3cfc07cc82c2528b38348839a0020cedf1a372133e54e48eb73d46d42a3d52c7f8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Filesize
116KB

MD5
0da20a2551ba970fb4ee3811b6534090

SHA1
57c87f303f811da846ede577618af6c2975846fa

SHA256
5d4e5f8db42f19aadcfbeb1019e1e5e5b2d78062c335a29b013d1b509f88c33f

SHA512
5b77d62e0a51328ca4794a8c39b415cd020e7e1a8dadf468345c8597816bf8728b4a19b971fb6532e719f0d8005fed2b62e281e08f0857b93e65d2ce56da3249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
9KB

MD5
78ea3ae5418416ab7ec75a2fd95bffb7

SHA1
53a1749e288934a36169655ca30d3d994012221c

SHA256
a11d7a4e489bfe648937e136e69f0affd46cefc826c56fec5e468a3b58cd0804

SHA512
54cfb1591e25688e410aa73e4dc552b4de333344d3a3b044102063127784c7bacbf173e7b48bf6f7765fbb128e76648e85ed144f0e45c007b7bdf823288c0883

Download Submit
\??\pipe\LOCAL\crashpad_4612_MPIMQBSFHPHYHJUH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1204-152-0x0000000000000000-mapping.dmp

Download
memory/1328-149-0x0000000000000000-mapping.dmp

Download
memory/1980-132-0x0000000000360000-0x00000000009D5000-memory.dmp

Filesize
6.5MB

Download
memory/2208-157-0x0000000000000000-mapping.dmp

Download
memory/3488-165-0x0000000000000000-mapping.dmp

Download
memory/3760-155-0x0000000000000000-mapping.dmp

Download
memory/3904-151-0x0000000000000000-mapping.dmp

Download
memory/3944-161-0x0000000000000000-mapping.dmp

Download
memory/4156-143-0x0000000005AE0000-0x0000000005B46000-memory.dmp

Filesize
408KB

Download
memory/4156-146-0x0000000006F80000-0x0000000006FF6000-memory.dmp

Filesize
472KB

Download
memory/4156-135-0x0000000000000000-mapping.dmp

Download
memory/4156-136-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/4156-139-0x0000000005640000-0x0000000005652000-memory.dmp

Filesize
72KB

Download
memory/4156-142-0x00000000061B0000-0x0000000006242000-memory.dmp

Filesize
584KB

Download
memory/4156-141-0x0000000006760000-0x0000000006D04000-memory.dmp

Filesize
5.6MB

Download
memory/4156-140-0x00000000056A0000-0x00000000056DC000-memory.dmp

Filesize
240KB

Download
memory/4156-137-0x0000000005B90000-0x00000000061A8000-memory.dmp

Filesize
6.1MB

Download
memory/4156-147-0x0000000006F30000-0x0000000006F4E000-memory.dmp

Filesize
120KB

Download
memory/4156-145-0x0000000008380000-0x00000000088AC000-memory.dmp

Filesize
5.2MB

Download
memory/4156-138-0x0000000005700000-0x000000000580A000-memory.dmp

Filesize
1.0MB

Download
memory/4156-144-0x0000000007C80000-0x0000000007E42000-memory.dmp

Filesize
1.8MB

Download
memory/4160-170-0x0000000000360000-0x00000000009D5000-memory.dmp

Filesize
6.5MB

Download
memory/4168-163-0x0000000000000000-mapping.dmp

Download
memory/4508-159-0x0000000000000000-mapping.dmp

Download
memory/4612-148-0x0000000000000000-mapping.dmp

Download
memory/4652-167-0x0000000000000000-mapping.dmp

Download
memory/4668-169-0x0000000000000000-mapping.dmp

Download
memory/4940-173-0x0000000000000000-mapping.dmp

Download
memory/4940-177-0x0000000006AE0000-0x0000000006B30000-memory.dmp

Filesize
320KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads