77cd566108bdf69dbf6a2a52438a0dc20c3d66f2c2b5c4ad20556656e5593794

Analysis

max time kernel
256s
max time network
333s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 13:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

hookah.exe
Size

1.3MB
MD5

2486632d0b7d3b3ee39fabeebecd260e
SHA1

30329c9819f31fb0a4801190a87b63a5d6743bf2
SHA256

64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6
SHA512

7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50
SSDEEP

24576:AHKa+YuQLuDEICljs6a+oN0NxoblUIgBkKAvrMOgQjaEefuCjfV7nUVGP:AHr2jDEBahNux7dBkKAvQxRnUV

Score

8^/10

themida

Malware Config

Signatures

Executes dropped EXE 7 IoCs

Processes:

aim.exeaim.exeaim.exeaim.exeaim.exeaim.exeaim.exe

pid process

1704 aim.exe
552 aim.exe
1272 aim.exe
1088 aim.exe
1960 aim.exe
836 aim.exe
848 aim.exe

pid	process
1704	aim.exe
552	aim.exe
1272	aim.exe
1088	aim.exe
1960	aim.exe
836	aim.exe
848	aim.exe

Loads dropped DLL 14 IoCs

Processes:

hookah.exeaim.exeaim.exeaim.exeaim.exeaim.exeaim.exe

pid	process
596	hookah.exe
596	hookah.exe
1704	aim.exe
1704	aim.exe
552	aim.exe
552	aim.exe
1272	aim.exe
1272	aim.exe
1088	aim.exe
1088	aim.exe
1960	aim.exe
1960	aim.exe
836	aim.exe
836	aim.exe

Themida packer 44 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral3/memory/596-55-0x0000000000400000-0x000000000065D000-memory.dmp	themida
\Windows\SysWOW64\aim.exe	themida
behavioral3/memory/596-57-0x0000000000400000-0x000000000065D000-memory.dmp	themida
\Windows\SysWOW64\aim.exe	themida
C:\Windows\SysWOW64\aim.exe	themida
C:\Windows\SysWOW64\aim.exe	themida
behavioral3/memory/596-63-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/1704-64-0x0000000000400000-0x000000000065D000-memory.dmp	themida
\Windows\SysWOW64\aim.exe	themida
\Windows\SysWOW64\aim.exe	themida
C:\Windows\SysWOW64\aim.exe	themida
behavioral3/memory/1704-70-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/552-71-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/1704-72-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/552-73-0x0000000000400000-0x000000000065D000-memory.dmp	themida
\Windows\SysWOW64\aim.exe	themida
\Windows\SysWOW64\aim.exe	themida
C:\Windows\SysWOW64\aim.exe	themida
behavioral3/memory/1272-79-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/552-80-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/1272-81-0x0000000000400000-0x000000000065D000-memory.dmp	themida
\Windows\SysWOW64\aim.exe	themida
\Windows\SysWOW64\aim.exe	themida
C:\Windows\SysWOW64\aim.exe	themida
behavioral3/memory/1272-87-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/1088-88-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/1088-89-0x0000000000400000-0x000000000065D000-memory.dmp	themida
\Windows\SysWOW64\aim.exe	themida
\Windows\SysWOW64\aim.exe	themida
C:\Windows\SysWOW64\aim.exe	themida
behavioral3/memory/1088-95-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/1960-96-0x0000000000400000-0x000000000065D000-memory.dmp	themida
\Windows\SysWOW64\aim.exe	themida
\Windows\SysWOW64\aim.exe	themida
C:\Windows\SysWOW64\aim.exe	themida
behavioral3/memory/1960-102-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/836-103-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/1960-104-0x0000000000400000-0x000000000065D000-memory.dmp	themida
\Windows\SysWOW64\aim.exe	themida
\Windows\SysWOW64\aim.exe	themida
C:\Windows\SysWOW64\aim.exe	themida
behavioral3/memory/836-108-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/836-111-0x0000000000400000-0x000000000065D000-memory.dmp	themida
behavioral3/memory/848-112-0x0000000000400000-0x000000000065D000-memory.dmp	themida

Drops file in System32 directory 16 IoCs

Processes:

aim.exeaim.exeaim.exeaim.exeaim.exeaim.exeaim.exehookah.exe

description	ioc	process
File created	C:\Windows\SysWOW64\aim.exe	aim.exe
File created	C:\Windows\SysWOW64\aim.exe	aim.exe
File created	C:\Windows\SysWOW64\aim.exe	aim.exe
File opened for modification	C:\Windows\SysWOW64\aim.exe	aim.exe
File opened for modification	C:\Windows\SysWOW64\aim.exe	aim.exe
File created	C:\Windows\SysWOW64\aim.exe	aim.exe
File created	C:\Windows\SysWOW64\aim.exe	aim.exe
File opened for modification	C:\Windows\SysWOW64\aim.exe	hookah.exe
File created	C:\Windows\SysWOW64\aim.exe	aim.exe
File opened for modification	C:\Windows\SysWOW64\aim.exe	aim.exe
File created	C:\Windows\SysWOW64\aim.exe	aim.exe
File opened for modification	C:\Windows\SysWOW64\aim.exe	aim.exe
File opened for modification	C:\Windows\SysWOW64\aim.exe	aim.exe
File opened for modification	C:\Windows\SysWOW64\aim.exe	aim.exe
File created	C:\Windows\SysWOW64\aim.exe	hookah.exe
File opened for modification	C:\Windows\SysWOW64\aim.exe	aim.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

hookah.exeaim.exeaim.exeaim.exeaim.exeaim.exeaim.exe

description	pid	process	target process
PID 596 wrote to memory of 1704	596	hookah.exe	aim.exe
PID 596 wrote to memory of 1704	596	hookah.exe	aim.exe
PID 596 wrote to memory of 1704	596	hookah.exe	aim.exe
PID 596 wrote to memory of 1704	596	hookah.exe	aim.exe
PID 1704 wrote to memory of 552	1704	aim.exe	aim.exe
PID 1704 wrote to memory of 552	1704	aim.exe	aim.exe
PID 1704 wrote to memory of 552	1704	aim.exe	aim.exe
PID 1704 wrote to memory of 552	1704	aim.exe	aim.exe
PID 552 wrote to memory of 1272	552	aim.exe	aim.exe
PID 552 wrote to memory of 1272	552	aim.exe	aim.exe
PID 552 wrote to memory of 1272	552	aim.exe	aim.exe
PID 552 wrote to memory of 1272	552	aim.exe	aim.exe
PID 1272 wrote to memory of 1088	1272	aim.exe	aim.exe
PID 1272 wrote to memory of 1088	1272	aim.exe	aim.exe
PID 1272 wrote to memory of 1088	1272	aim.exe	aim.exe
PID 1272 wrote to memory of 1088	1272	aim.exe	aim.exe
PID 1088 wrote to memory of 1960	1088	aim.exe	aim.exe
PID 1088 wrote to memory of 1960	1088	aim.exe	aim.exe
PID 1088 wrote to memory of 1960	1088	aim.exe	aim.exe
PID 1088 wrote to memory of 1960	1088	aim.exe	aim.exe
PID 1960 wrote to memory of 836	1960	aim.exe	aim.exe
PID 1960 wrote to memory of 836	1960	aim.exe	aim.exe
PID 1960 wrote to memory of 836	1960	aim.exe	aim.exe
PID 1960 wrote to memory of 836	1960	aim.exe	aim.exe
PID 836 wrote to memory of 848	836	aim.exe	aim.exe
PID 836 wrote to memory of 848	836	aim.exe	aim.exe
PID 836 wrote to memory of 848	836	aim.exe	aim.exe
PID 836 wrote to memory of 848	836	aim.exe	aim.exe

C:\Users\Admin\AppData\Local\Temp\hookah.exe
"C:\Users\Admin\AppData\Local\Temp\hookah.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\aim.exe
C:\Windows\system32\aim.exe 668 "C:\Users\Admin\AppData\Local\Temp\hookah.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1704

C:\Windows\SysWOW64\aim.exe
C:\Windows\system32\aim.exe 692 "C:\Windows\SysWOW64\aim.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:552

C:\Windows\SysWOW64\aim.exe
C:\Windows\system32\aim.exe 704 "C:\Windows\SysWOW64\aim.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1272

C:\Windows\SysWOW64\aim.exe
C:\Windows\system32\aim.exe 716 "C:\Windows\SysWOW64\aim.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1088

C:\Windows\SysWOW64\aim.exe
C:\Windows\system32\aim.exe 708 "C:\Windows\SysWOW64\aim.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\SysWOW64\aim.exe
C:\Windows\system32\aim.exe 696 "C:\Windows\SysWOW64\aim.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:836

C:\Windows\SysWOW64\aim.exe
C:\Windows\system32\aim.exe 720 "C:\Windows\SysWOW64\aim.exe"
8⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:848

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
C:\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
C:\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
C:\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
C:\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
C:\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
C:\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
C:\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
\Windows\SysWOW64\aim.exe
Filesize
1.3MB

MD5
2486632d0b7d3b3ee39fabeebecd260e

SHA1
30329c9819f31fb0a4801190a87b63a5d6743bf2

SHA256
64cba5bbb90c2ad81d9db115714c3f0a9c5e083a2554eb2ef0aee752fff05ae6

SHA512
7544cfac631e8ca09d0687f6b9f704b25fbc9d2ab8170827ee899ce9c7332e06ee44900e0b141a97236124c802707de61cd664784490cf94a45672985cca7d50

Download Submit
memory/552-80-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/552-67-0x0000000000000000-mapping.dmp

Download
memory/552-73-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/552-71-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/596-57-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/596-54-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/596-63-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/596-55-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/836-111-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/836-103-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/836-108-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/836-99-0x0000000000000000-mapping.dmp

Download
memory/848-107-0x0000000000000000-mapping.dmp

Download
memory/848-112-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1088-95-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1088-88-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1088-84-0x0000000000000000-mapping.dmp

Download
memory/1088-89-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1272-87-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1272-79-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1272-76-0x0000000000000000-mapping.dmp

Download
memory/1272-81-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1704-70-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1704-64-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1704-59-0x0000000000000000-mapping.dmp

Download
memory/1704-72-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1960-92-0x0000000000000000-mapping.dmp

Download
memory/1960-102-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1960-104-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1960-96-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads