dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5

General

Target

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Size

328KB
MD5

2699986e741ba577ae2217661e60b0ba
SHA1

66da102297cf31f2622341e2a178df6219c0e76c
SHA256

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5
SHA512

74e4f842c688638dde64a3963de326a0f6e7f29d3b4e62a6081fc293dbeccd9a37b9b208eee67680f12f8475ac2a2b3b0ae136275f59fb6bff51ba3ad45af48b
SSDEEP

6144:byWOeLm+tkxoGQvT+W4+HMc+MEGRQ6saHSMf3z0AzbLUG50Tpm+MmvbWdlL0d5aU:bCemx0vN3HKGi6sYjJLUGGtedud5tr7

Score

8^/10

adware discovery exploit persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description ioc process

File created C:\Windows\SysWOW64\drivers\273554c4.sys dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Possible privilege escalation attempt 4 IoCs
exploit

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

876 takeown.exe
1444 icacls.exe
568 takeown.exe
944 icacls.exe

description	ioc	process
File created	C:\Windows\SysWOW64\drivers\273554c4.sys	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

pid	process
876	takeown.exe
1444	icacls.exe
568	takeown.exe
944	icacls.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\273554c4\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\273554c4.sys"	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1680 cmd.exe
Modifies file permissions 1 TTPs 4 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

568 takeown.exe
944 icacls.exe
876 takeown.exe
1444 icacls.exe

pid	process
1680	cmd.exe

pid	process
568	takeown.exe
944	icacls.exe
876	takeown.exe
1444	icacls.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF}	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Drops file in System32 directory 4 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description	ioc	process
File created	C:\Windows\SysWOW64\ws2tcpip.dll	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
File opened for modification	C:\Windows\SysWOW64\ws2tcpip.dll	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
File created	C:\Windows\SysWOW64\midimap.dll	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Modifies registry class 4 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\HOOK_ID\name = "dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe"	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\SYS_DLL\name = "uuwyLDHt.dll"	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

pid	process
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

pid process

472
1288 dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

pid	process
472
1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exetakeown.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
Token: SeTakeOwnershipPrivilege	568	takeown.exe
Token: SeTakeOwnershipPrivilege	876	takeown.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.execmd.execmd.exe

description	pid	process	target process
PID 1288 wrote to memory of 1672	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe
PID 1288 wrote to memory of 1672	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe
PID 1288 wrote to memory of 1672	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe
PID 1288 wrote to memory of 1672	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe
PID 1672 wrote to memory of 568	1672	cmd.exe	takeown.exe
PID 1672 wrote to memory of 568	1672	cmd.exe	takeown.exe
PID 1672 wrote to memory of 568	1672	cmd.exe	takeown.exe
PID 1672 wrote to memory of 568	1672	cmd.exe	takeown.exe
PID 1672 wrote to memory of 944	1672	cmd.exe	icacls.exe
PID 1672 wrote to memory of 944	1672	cmd.exe	icacls.exe
PID 1672 wrote to memory of 944	1672	cmd.exe	icacls.exe
PID 1672 wrote to memory of 944	1672	cmd.exe	icacls.exe
PID 1288 wrote to memory of 1056	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe
PID 1288 wrote to memory of 1056	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe
PID 1288 wrote to memory of 1056	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe
PID 1288 wrote to memory of 1056	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe
PID 1056 wrote to memory of 876	1056	cmd.exe	takeown.exe
PID 1056 wrote to memory of 876	1056	cmd.exe	takeown.exe
PID 1056 wrote to memory of 876	1056	cmd.exe	takeown.exe
PID 1056 wrote to memory of 876	1056	cmd.exe	takeown.exe
PID 1056 wrote to memory of 1444	1056	cmd.exe	icacls.exe
PID 1056 wrote to memory of 1444	1056	cmd.exe	icacls.exe
PID 1056 wrote to memory of 1444	1056	cmd.exe	icacls.exe
PID 1056 wrote to memory of 1444	1056	cmd.exe	icacls.exe
PID 1288 wrote to memory of 1680	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe
PID 1288 wrote to memory of 1680	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe
PID 1288 wrote to memory of 1680	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe
PID 1288 wrote to memory of 1680	1288	dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe
"C:\Users\Admin\AppData\Local\Temp\dbb678e2a66e25f48621cbbfce539c0fe6533f0935238f7e7e2e86a5736c80e5.exe"
1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1288

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:1672

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:568

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:944

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
2⤵
- Suspicious use of WriteProcessMemory
PID:1056

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\midimap.dll
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:876

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1444

C:\Windows\SysWOW64\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
2⤵
- Deletes itself
PID:1680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ahnmove.bat

Filesize
181B

MD5
b73686a130731538d01fcd975f8c3d00

SHA1
d527569ae522580ca0c46146cb82478b2f94bf4d

SHA256
8cd6804532c0d8a6e21e3f76abeab37136698be89a2be9ddbc853eff7679f12c

SHA512
952dcb256f6f596b4ae4adc17a9ad8a271964a642d066e8e1f7ab75c3a112fefa8df8b4d90e11d472397a348a75ed7baf240188c95a0b52e749080f7edb0e1bb

Download Submit
memory/568-59-0x0000000000000000-mapping.dmp

Download
memory/876-62-0x0000000000000000-mapping.dmp

Download
memory/944-60-0x0000000000000000-mapping.dmp

Download
memory/1056-61-0x0000000000000000-mapping.dmp

Download
memory/1288-57-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/1288-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1288-56-0x0000000000220000-0x0000000000240000-memory.dmp

Filesize
128KB

Download
memory/1288-65-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/1288-55-0x0000000001000000-0x000000000116A000-memory.dmp

Filesize
1.4MB

Download
memory/1444-63-0x0000000000000000-mapping.dmp

Download
memory/1672-58-0x0000000000000000-mapping.dmp

Download
memory/1680-64-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads