669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1

Analysis

max time kernel
172s
max time network
176s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2022, 14:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1.exe
Size 306KB
Sample221121-rxbkasdf89
SHA256 669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1
MD5 09d18b9a9e18257371c2610f99fe472a
SHA1 75e6633f48e4b57879c8f69017a6d94200394bb7
SHA512 83fd0a345b80f1a1e01e7b5605035caf83ed5b7b6694ec1d3ce27005b4a8d4c5aa2eebd72c77b1a3086bbc0e92406c74ae062797570702d926912e96dc80ee9d
SSDEEP 6144:xfNdLF0ocp0dyd+97C6H8nnMHPer11XgUfcgxFomgXHsMjoS/:xFdLF9S0deQJ8n7RkgxFZgXxoS/
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

evasion persistence upx

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Windows Updater.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Windows Updater.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Executes dropped EXE 3 IoCs

pid	Process
700	winupdt2.exe
3952	winupdt2.exe
5096	winupdt2.exe

UPX packed file 18 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
	upx
behavioral2/memory/2220-134-0x0000000000400000-0x00000000005C9000-memory.dmp	upx
behavioral2/files/0x0008000000022e16-139.dat	upx
behavioral2/files/0x0008000000022e16-140.dat	upx
behavioral2/memory/2220-141-0x0000000000400000-0x00000000005C9000-memory.dmp	upx
behavioral2/memory/3952-145-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/files/0x0008000000022e16-146.dat	upx
behavioral2/memory/700-148-0x0000000000400000-0x00000000005C9000-memory.dmp	upx
behavioral2/memory/3952-150-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/5096-152-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3952-151-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/files/0x0008000000022e16-153.dat	upx
behavioral2/memory/5096-157-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/700-159-0x0000000000400000-0x00000000005C9000-memory.dmp	upx
behavioral2/memory/5096-161-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/5096-171-0x0000000000400000-0x0000000000409000-memory.dmp	upx
behavioral2/memory/3952-172-0x0000000000400000-0x000000000045C000-memory.dmp	upx
behavioral2/memory/3952-173-0x0000000000400000-0x000000000045C000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Control Panel\International\Geo\Nation	669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdt = "C:\\Users\\Admin\\AppData\\Roaming\\Window Updates\\winupdt2.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 700 set thread context of 3952	700	winupdt2.exe	89
PID 700 set thread context of 5096	700	winupdt2.exe	90

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3820	reg.exe
3140	reg.exe
4920	reg.exe
3440	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	3952	winupdt2.exe
Token: SeCreateTokenPrivilege	3952	winupdt2.exe
Token: SeAssignPrimaryTokenPrivilege	3952	winupdt2.exe
Token: SeLockMemoryPrivilege	3952	winupdt2.exe
Token: SeIncreaseQuotaPrivilege	3952	winupdt2.exe
Token: SeMachineAccountPrivilege	3952	winupdt2.exe
Token: SeTcbPrivilege	3952	winupdt2.exe
Token: SeSecurityPrivilege	3952	winupdt2.exe
Token: SeTakeOwnershipPrivilege	3952	winupdt2.exe
Token: SeLoadDriverPrivilege	3952	winupdt2.exe
Token: SeSystemProfilePrivilege	3952	winupdt2.exe
Token: SeSystemtimePrivilege	3952	winupdt2.exe
Token: SeProfSingleProcessPrivilege	3952	winupdt2.exe
Token: SeIncBasePriorityPrivilege	3952	winupdt2.exe
Token: SeCreatePagefilePrivilege	3952	winupdt2.exe
Token: SeCreatePermanentPrivilege	3952	winupdt2.exe
Token: SeBackupPrivilege	3952	winupdt2.exe
Token: SeRestorePrivilege	3952	winupdt2.exe
Token: SeShutdownPrivilege	3952	winupdt2.exe
Token: SeDebugPrivilege	3952	winupdt2.exe
Token: SeAuditPrivilege	3952	winupdt2.exe
Token: SeSystemEnvironmentPrivilege	3952	winupdt2.exe
Token: SeChangeNotifyPrivilege	3952	winupdt2.exe
Token: SeRemoteShutdownPrivilege	3952	winupdt2.exe
Token: SeUndockPrivilege	3952	winupdt2.exe
Token: SeSyncAgentPrivilege	3952	winupdt2.exe
Token: SeEnableDelegationPrivilege	3952	winupdt2.exe
Token: SeManageVolumePrivilege	3952	winupdt2.exe
Token: SeImpersonatePrivilege	3952	winupdt2.exe
Token: SeCreateGlobalPrivilege	3952	winupdt2.exe
Token: 31	3952	winupdt2.exe
Token: 32	3952	winupdt2.exe
Token: 33	3952	winupdt2.exe
Token: 34	3952	winupdt2.exe
Token: 35	3952	winupdt2.exe
Token: SeDebugPrivilege	5096	winupdt2.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2220	669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1.exe
700	winupdt2.exe
3952	winupdt2.exe
3952	winupdt2.exe
5096	winupdt2.exe
3952	winupdt2.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 1320	2220	669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1.exe	84
PID 2220 wrote to memory of 1320	2220	669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1.exe	84
PID 2220 wrote to memory of 1320	2220	669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1.exe	84
PID 1320 wrote to memory of 4332	1320	cmd.exe	87
PID 1320 wrote to memory of 4332	1320	cmd.exe	87
PID 1320 wrote to memory of 4332	1320	cmd.exe	87
PID 2220 wrote to memory of 700	2220	669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1.exe	88
PID 2220 wrote to memory of 700	2220	669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1.exe	88
PID 2220 wrote to memory of 700	2220	669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1.exe	88
PID 700 wrote to memory of 3952	700	winupdt2.exe	89
PID 700 wrote to memory of 3952	700	winupdt2.exe	89
PID 700 wrote to memory of 3952	700	winupdt2.exe	89
PID 700 wrote to memory of 3952	700	winupdt2.exe	89
PID 700 wrote to memory of 3952	700	winupdt2.exe	89
PID 700 wrote to memory of 3952	700	winupdt2.exe	89
PID 700 wrote to memory of 3952	700	winupdt2.exe	89
PID 700 wrote to memory of 3952	700	winupdt2.exe	89
PID 700 wrote to memory of 5096	700	winupdt2.exe	90
PID 700 wrote to memory of 5096	700	winupdt2.exe	90
PID 700 wrote to memory of 5096	700	winupdt2.exe	90
PID 700 wrote to memory of 5096	700	winupdt2.exe	90
PID 700 wrote to memory of 5096	700	winupdt2.exe	90
PID 700 wrote to memory of 5096	700	winupdt2.exe	90
PID 700 wrote to memory of 5096	700	winupdt2.exe	90
PID 700 wrote to memory of 5096	700	winupdt2.exe	90
PID 3952 wrote to memory of 2864	3952	winupdt2.exe	91
PID 3952 wrote to memory of 2864	3952	winupdt2.exe	91
PID 3952 wrote to memory of 2864	3952	winupdt2.exe	91
PID 3952 wrote to memory of 2496	3952	winupdt2.exe	94
PID 3952 wrote to memory of 2496	3952	winupdt2.exe	94
PID 3952 wrote to memory of 2496	3952	winupdt2.exe	94
PID 3952 wrote to memory of 4932	3952	winupdt2.exe	92
PID 3952 wrote to memory of 4932	3952	winupdt2.exe	92
PID 3952 wrote to memory of 4932	3952	winupdt2.exe	92
PID 3952 wrote to memory of 3688	3952	winupdt2.exe	97
PID 3952 wrote to memory of 3688	3952	winupdt2.exe	97
PID 3952 wrote to memory of 3688	3952	winupdt2.exe	97
PID 2864 wrote to memory of 4920	2864	cmd.exe	99
PID 2864 wrote to memory of 4920	2864	cmd.exe	99
PID 2864 wrote to memory of 4920	2864	cmd.exe	99
PID 2496 wrote to memory of 3440	2496	cmd.exe	100
PID 2496 wrote to memory of 3440	2496	cmd.exe	100
PID 2496 wrote to memory of 3440	2496	cmd.exe	100
PID 4932 wrote to memory of 3820	4932	cmd.exe	101
PID 4932 wrote to memory of 3820	4932	cmd.exe	101
PID 4932 wrote to memory of 3820	4932	cmd.exe	101
PID 3688 wrote to memory of 3140	3688	cmd.exe	102
PID 3688 wrote to memory of 3140	3688	cmd.exe	102
PID 3688 wrote to memory of 3140	3688	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1.exe
"C:\Users\Admin\AppData\Local\Temp\669a8a3ed205d316851d7d65587d062ad6a534df0959c8ad1675d0933ebf72a1.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\kGuyq.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WinUpdt" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /f
    3⤵
    - Adds Run key to start application
    PID:4332
- C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
  "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
    "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3952
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2864
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:4920
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4932
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:3820
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2496
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:3440
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3688
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Windows Updater.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Windows Updater.exe:*:Enabled:Windows Messanger" /f
        5⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:3140
- - C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
    "C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:5096

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

kGuyq.bat

Path C:\Users\Admin\AppData\Local\Temp\kGuyq.bat
Size 152B
SHA256 734c4f48449a118dbdfbbe4971ecf112b26b2b45d1889678c01dea98eb5767d8
MD5 49bb161b07149b1bda99901c71d98b1f
SHA1 e5e3b389c09d551bd8f3a4cf71ee30e566fdf6e2
SHA512 da09a2af9b7f9528916ab719ed97ee8b61179bba92016eaed64b3e7d6bf08646801aeeb0eb332bdde175eb64b48106f7cf2fe2bf01ea6128753e4ce1d48707be
MD5 SHA1 SHA512

Submit Download

winupdt2.exe

Path C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
Size 306KB
SHA256 3f07e960ceee8ee1078e0ed66bdb052c5d19f84761801739f3396eb2515e0e19
MD5 cbb148430b8d7388572a795b3db9177e
SHA1 77e1fb3af0968e86951bda6e99a2a4e09d697237
SHA512 813f0eb583c1627bf546b86dab78ed76d8312f04b37763c5ec9ef435d4784c8e0d600df891cc82d4f1e69cc668dd14a476e8759b5008a521b9de379259be030d
SSDEEP 6144:xfNdLF0ocp0dyd+97C6H8nnMHPer11XgUfcgxFomgXHsMjoS0:xFdLF9S0deQJ8n7RkgxFZgXxoS0
MD5 SHA1 SHA512 SSDEEP

Submit Download

winupdt2.exe

Path C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
Size 306KB
SHA256 3f07e960ceee8ee1078e0ed66bdb052c5d19f84761801739f3396eb2515e0e19
MD5 cbb148430b8d7388572a795b3db9177e
SHA1 77e1fb3af0968e86951bda6e99a2a4e09d697237
SHA512 813f0eb583c1627bf546b86dab78ed76d8312f04b37763c5ec9ef435d4784c8e0d600df891cc82d4f1e69cc668dd14a476e8759b5008a521b9de379259be030d
SSDEEP 6144:xfNdLF0ocp0dyd+97C6H8nnMHPer11XgUfcgxFomgXHsMjoS0:xFdLF9S0deQJ8n7RkgxFZgXxoS0
MD5 SHA1 SHA512 SSDEEP

Submit Download

winupdt2.exe

Path C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
Size 306KB
SHA256 3f07e960ceee8ee1078e0ed66bdb052c5d19f84761801739f3396eb2515e0e19
MD5 cbb148430b8d7388572a795b3db9177e
SHA1 77e1fb3af0968e86951bda6e99a2a4e09d697237
SHA512 813f0eb583c1627bf546b86dab78ed76d8312f04b37763c5ec9ef435d4784c8e0d600df891cc82d4f1e69cc668dd14a476e8759b5008a521b9de379259be030d
SSDEEP 6144:xfNdLF0ocp0dyd+97C6H8nnMHPer11XgUfcgxFomgXHsMjoS0:xFdLF9S0deQJ8n7RkgxFZgXxoS0
MD5 SHA1 SHA512 SSDEEP

Submit Download

winupdt2.exe

Path C:\Users\Admin\AppData\Roaming\Window Updates\winupdt2.exe
Size 306KB
SHA256 3f07e960ceee8ee1078e0ed66bdb052c5d19f84761801739f3396eb2515e0e19
MD5 cbb148430b8d7388572a795b3db9177e
SHA1 77e1fb3af0968e86951bda6e99a2a4e09d697237
SHA512 813f0eb583c1627bf546b86dab78ed76d8312f04b37763c5ec9ef435d4784c8e0d600df891cc82d4f1e69cc668dd14a476e8759b5008a521b9de379259be030d
SSDEEP 6144:xfNdLF0ocp0dyd+97C6H8nnMHPer11XgUfcgxFomgXHsMjoS0:xFdLF9S0deQJ8n7RkgxFZgXxoS0
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/700-159-0x0000000000400000-0x00000000005C9000-memory.dmp

Download

memory/700-148-0x0000000000400000-0x00000000005C9000-memory.dmp

Download

memory/2220-134-0x0000000000400000-0x00000000005C9000-memory.dmp

Download

memory/2220-141-0x0000000000400000-0x00000000005C9000-memory.dmp

Download

memory/3952-151-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3952-150-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3952-173-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3952-145-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/3952-172-0x0000000000400000-0x000000000045C000-memory.dmp

Download

memory/5096-161-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5096-157-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5096-152-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/5096-171-0x0000000000400000-0x0000000000409000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads