a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26

Analysis

max time kernel
151s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-11-2022 18:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Size

202KB
MD5

01e5e010bef7c10fe7dd883e699f4eac
SHA1

2f419d25f05fdde66e34eb226bf7f5fb9a9bfeaa
SHA256

a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26
SHA512

fc5c2e90bb5964e4b6dd1632e5eedca831d17d1ed6a74a3d9858bded3f3cf6b6397a5652569c4463aec0cad92db62bb10ca687fe45f9d6d999d76fbe5b693520
SSDEEP

6144:uJkgf0fCW3Nk+FF8VHsCIbRgS1m92wql+czAhr0+B:uJ+acNkyFoHs1Ns2v+wGr0+

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 8 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\ZBS.exe = "C:\\Users\\Admin\\AppData\\Roaming\\ZBS.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\ZBS.exe"	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe

Loads dropped DLL 1 IoCs

pid	Process
1872	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\ZBS.exe"	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Users\\Admin\\AppData\\Roaming\\ZBS.exe"	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1872 set thread context of 1684	1872	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	27
PID 1684 set thread context of 1980	1684	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	28

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
988	reg.exe
1760	reg.exe
1528	reg.exe
1944	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeCreateTokenPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeAssignPrimaryTokenPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeLockMemoryPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeIncreaseQuotaPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeMachineAccountPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeTcbPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeSecurityPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeTakeOwnershipPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeLoadDriverPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeSystemProfilePrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeSystemtimePrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeProfSingleProcessPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeIncBasePriorityPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeCreatePagefilePrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeCreatePermanentPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeBackupPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeRestorePrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeShutdownPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeDebugPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeAuditPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeSystemEnvironmentPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeChangeNotifyPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeRemoteShutdownPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeUndockPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeSyncAgentPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeEnableDelegationPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeManageVolumePrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeImpersonatePrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeCreateGlobalPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: 31	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: 32	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: 33	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: 34	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: 35	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
Token: SeDebugPrivilege	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1872	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1872 wrote to memory of 1684	1872	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	27
PID 1872 wrote to memory of 1684	1872	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	27
PID 1872 wrote to memory of 1684	1872	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	27
PID 1872 wrote to memory of 1684	1872	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	27
PID 1872 wrote to memory of 1684	1872	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	27
PID 1872 wrote to memory of 1684	1872	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	27
PID 1872 wrote to memory of 1684	1872	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	27
PID 1872 wrote to memory of 1684	1872	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	27
PID 1684 wrote to memory of 1980	1684	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	28
PID 1684 wrote to memory of 1980	1684	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	28
PID 1684 wrote to memory of 1980	1684	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	28
PID 1684 wrote to memory of 1980	1684	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	28
PID 1684 wrote to memory of 1980	1684	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	28
PID 1684 wrote to memory of 1980	1684	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	28
PID 1684 wrote to memory of 1980	1684	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	28
PID 1684 wrote to memory of 1980	1684	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	28
PID 1980 wrote to memory of 388	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	29
PID 1980 wrote to memory of 388	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	29
PID 1980 wrote to memory of 388	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	29
PID 1980 wrote to memory of 388	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	29
PID 1980 wrote to memory of 908	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	30
PID 1980 wrote to memory of 908	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	30
PID 1980 wrote to memory of 908	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	30
PID 1980 wrote to memory of 908	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	30
PID 1980 wrote to memory of 1420	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	33
PID 1980 wrote to memory of 1420	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	33
PID 1980 wrote to memory of 1420	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	33
PID 1980 wrote to memory of 1420	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	33
PID 1980 wrote to memory of 436	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	35
PID 1980 wrote to memory of 436	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	35
PID 1980 wrote to memory of 436	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	35
PID 1980 wrote to memory of 436	1980	a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe	35
PID 388 wrote to memory of 988	388	cmd.exe	38
PID 388 wrote to memory of 988	388	cmd.exe	38
PID 388 wrote to memory of 988	388	cmd.exe	38
PID 388 wrote to memory of 988	388	cmd.exe	38
PID 436 wrote to memory of 1528	436	cmd.exe	40
PID 436 wrote to memory of 1528	436	cmd.exe	40
PID 436 wrote to memory of 1528	436	cmd.exe	40
PID 436 wrote to memory of 1528	436	cmd.exe	40
PID 1420 wrote to memory of 1760	1420	cmd.exe	39
PID 1420 wrote to memory of 1760	1420	cmd.exe	39
PID 1420 wrote to memory of 1760	1420	cmd.exe	39
PID 1420 wrote to memory of 1760	1420	cmd.exe	39
PID 908 wrote to memory of 1944	908	cmd.exe	37
PID 908 wrote to memory of 1944	908	cmd.exe	37
PID 908 wrote to memory of 1944	908	cmd.exe	37
PID 908 wrote to memory of 1944	908	cmd.exe	37

C:\Users\Admin\AppData\Local\Temp\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
"C:\Users\Admin\AppData\Local\Temp\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1872
- C:\Users\Admin\AppData\Local\Temp\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
  "C:\Users\Admin\AppData\Local\Temp\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Users\Admin\AppData\Local\Temp\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe
    "C:\Users\Admin\AppData\Local\Temp\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe"
    3⤵
    - Adds policy Run key to start application
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1980
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:388
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:988
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:908
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\a075708e22f9516638363f162c5c13c15edc9ff228715b3f23eeec329806fa26.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:1944
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1420
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:1760
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ZBS.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ZBS.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:436
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\ZBS.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\ZBS.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:1528

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\M6cG8hfMDbj1.txt

Filesize
2KB

MD5
7d789ed47fe14ba828e907e46035499d

SHA1
7b5fe9025f5fffc1639c604b3784db333de2c459

SHA256
b286ea5967864bdd4188e60d22830ebd92cedb7ba1f5119b313eb03b2b174a19

SHA512
afc27bbc66b740d8dc8e82639ab1487d486e2fd002c21edfd78e791877569168906243048ee23e86a9cd1cd365579e279340221b9181d055b1334f90053d4541

Download Submit
memory/1684-58-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1684-57-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1684-69-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1684-60-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1684-62-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1684-65-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/1980-67-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1980-71-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1980-70-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1980-66-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1980-86-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download
memory/1980-87-0x0000000000400000-0x0000000000459000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads