neshta | e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b

General

Target

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
Size

240KB
MD5

2c2bfeb1570ca4c967b35e1ec4258120
SHA1

3d9163169b1f720b4cf376e874a8301ebed3b3cc
SHA256

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b
SHA512

02845962616c583ededed2a8478d0179396d11d9e077673fd8adabce0bec245effec0c0c0c1558550fcfe20af06fdbd3be0adc9cc3b2bb77292fd421a5fb801a
SSDEEP

6144:k9usRwlH2/8UcR10g+YLLwSOQ6ZmkWkr9eZXW:Zow2/8UcH0yLL/OkBS9eZXW

Score

10^/10

neshta persistence spyware stealer

Malware Config

Signatures

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1042

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta
Executes dropped EXE 1 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

pid process

1520 e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Loads dropped DLL 2 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

pid	process
1492	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
1492	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops file in Program Files directory 64 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORE.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\NAMECO~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\setup_wm.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\Setup.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\SOURCE~1\OSE.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\WMPDMC.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmplayer.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\FLTLDR.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\INFOPATH.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ONENOTEM.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\POWERPNT.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\PPTICO.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ADOBEC~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBEU~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\OFFICE~1\ODeploy.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\TextConv\WksConv\Wkconv.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\BCSSync.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\Updater6\ADOBE_~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSTORDB.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WINWORD.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\WinMail.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpconfig.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\A3DUTI~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\1033\ONELEV.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CLVIEW.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\XLICONS.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\misc.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\VPREVIEW.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOXMLED.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\ACCICONS.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\wabmig.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\ACCESS~1\wordpad.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\ADOBEA~1\Versions\1.0\ADOBEA~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\EQUATION\EQNEDT32.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\CNFNOT32.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmlaunch.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WI54FB~1\wmpshare.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\DW\DWTRIG20.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Oarpmany.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOSYNC.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\ImagingDevices.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\SELFCERT.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\WORDICON.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\ACROBR~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\MSOICONS.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~3.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GO664E~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\GRAPH.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Office14\MSOUC.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\WI4223~1\sidebar.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
File opened for modification	C:\PROGRA~2\Adobe\READER~1.0\Reader\AcroRd32.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Drops file in Windows directory 1 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

description ioc process

File opened for modification C:\Windows\svchost.com e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File opened for modification	C:\Windows\svchost.com	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Modifies registry class 1 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

pid	process
1520	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
1520	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
1520	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

pid	process
1520	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
1520	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
1520	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

description	pid	process	target process
PID 1492 wrote to memory of 1520	1492	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
PID 1492 wrote to memory of 1520	1492	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
PID 1492 wrote to memory of 1520	1492	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
PID 1492 wrote to memory of 1520	1492	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
PID 1492 wrote to memory of 1520	1492	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
PID 1492 wrote to memory of 1520	1492	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
PID 1492 wrote to memory of 1520	1492	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe	e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

C:\Users\Admin\AppData\Local\Temp\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
"C:\Users\Admin\AppData\Local\Temp\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe"
1⤵
- Modifies system executable filetype association
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1492

C:\Users\Admin\AppData\Local\Temp\3582-490\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe
"C:\Users\Admin\AppData\Local\Temp\3582-490\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe"
2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1520

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Change Default File Association

1

T1042

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\3582-490\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Filesize
200KB

MD5
0364c992a9016ca485d525057f4b198a

SHA1
ee659561ddc81c8380dd3cda86b2bd0f5c1ca77c

SHA256
2a1f5d8842b642892c4e2075a7ba0e4a1602f0f759a3a3816859aa7633d63bbd

SHA512
f7d24eb9f5f9e4228c5161690fbf6ef25756ce8756fcca3638f5e0af20db6b1437e9a3dfd688ac3c8923e8313fc584179e9c5431ad71b612977e01b706381cd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Filesize
200KB

MD5
0364c992a9016ca485d525057f4b198a

SHA1
ee659561ddc81c8380dd3cda86b2bd0f5c1ca77c

SHA256
2a1f5d8842b642892c4e2075a7ba0e4a1602f0f759a3a3816859aa7633d63bbd

SHA512
f7d24eb9f5f9e4228c5161690fbf6ef25756ce8756fcca3638f5e0af20db6b1437e9a3dfd688ac3c8923e8313fc584179e9c5431ad71b612977e01b706381cd1

Download Submit
\PROGRA~2\Adobe\READER~1.0\Reader\LOGTRA~1.EXE

Filesize
252KB

MD5
9e2b9928c89a9d0da1d3e8f4bd96afa7

SHA1
ec66cda99f44b62470c6930e5afda061579cde35

SHA256
8899b4ed3446b7d55b54defbc1acb7c5392a4b3bc8ec2cdc7c31171708965043

SHA512
2ca5ad1d0e12a8049de885b90b7f56fe77c868e0d6dae4ec4b6f3bc0bf7b2e73295cc9b1328c2b45357ffb0d7804622ab3f91a56140b098e93b691032d508156

Download Submit
\Users\Admin\AppData\Local\Temp\3582-490\e5eaa0ff0be00a0bc2f312e9b3a03832334250377947d2131717db0601f4da3b.exe

Filesize
200KB

MD5
0364c992a9016ca485d525057f4b198a

SHA1
ee659561ddc81c8380dd3cda86b2bd0f5c1ca77c

SHA256
2a1f5d8842b642892c4e2075a7ba0e4a1602f0f759a3a3816859aa7633d63bbd

SHA512
f7d24eb9f5f9e4228c5161690fbf6ef25756ce8756fcca3638f5e0af20db6b1437e9a3dfd688ac3c8923e8313fc584179e9c5431ad71b612977e01b706381cd1

Download Submit
memory/1492-54-0x0000000075001000-0x0000000075003000-memory.dmp

Filesize
8KB

Download
memory/1492-61-0x0000000002660000-0x0000000002721000-memory.dmp

Filesize
772KB

Download
memory/1520-56-0x0000000000000000-mapping.dmp

Download
memory/1520-62-0x0000000000400000-0x00000000004C1000-memory.dmp

Filesize
772KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads