emotet | 3ed3759a7759fd6cffc0bddfc01d262f1a8a47b10ee5c4c2192547f7f47683d1

General

Target

5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Size

596KB
MD5

2c4d542a55d21e92352d798b47f5fada
SHA1

5b08375c935c2e2b2b8f59583dabe7ecc301a65f
SHA256

3ed3759a7759fd6cffc0bddfc01d262f1a8a47b10ee5c4c2192547f7f47683d1
SHA512

25ba8b1f48bd9e5ef7f293cb9afb53c2e399c119317eb1cde934ce55337d75986aeecbc1001e536cf1bfd765f757d3241294ee5f55596d383cd1a5f2a3a23a21
SSDEEP

12288:XOznWAlABfLGB5kvtjV7uikFgXLNJ7HCxH5:mSoB5wdlubgXLNJCxH5

Score

10^/10

emotet epoch1 banker trojan

Malware Config

Extracted

Family

emotet

Botnet

Epoch1

C2

125.99.61.162:7080

94.183.71.206:7080

91.83.93.105:8080

216.98.148.181:8080

68.183.190.199:8080

170.84.133.72:7080

139.5.237.27:443

5.77.13.70:80

46.29.183.211:8080

46.41.151.103:8080

182.188.39.68:80

170.84.133.72:8443

186.83.133.253:8080

46.28.111.142:7080

62.75.160.178:8080

178.79.163.131:8080

190.104.253.234:990

149.62.173.247:8080

178.249.187.151:8080

81.169.140.14:443

rsa_pubkey.plain

Signatures

Emotet
Emotet is a trojan that is primarily spread through spam emails.
trojan banker emotet

Drops file in System32 directory 1 IoCs

Processes:

reswcmp.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	reswcmp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 21 IoCs

Processes:

reswcmp.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0049000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	reswcmp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD753BD-71FA-4E3A-BD6B-797187802FCD}\WpadDecision = "0"	reswcmp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-ad-c4-39-9f-1b\WpadDecision = "0"	reswcmp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	reswcmp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	reswcmp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	reswcmp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD753BD-71FA-4E3A-BD6B-797187802FCD}\WpadDecisionTime = 500d9f7fa404d901	reswcmp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-ad-c4-39-9f-1b	reswcmp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD753BD-71FA-4E3A-BD6B-797187802FCD}\36-ad-c4-39-9f-1b	reswcmp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-ad-c4-39-9f-1b\WpadDecisionTime = 500d9f7fa404d901	reswcmp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	reswcmp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	reswcmp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	reswcmp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	reswcmp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	reswcmp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	reswcmp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	reswcmp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD753BD-71FA-4E3A-BD6B-797187802FCD}	reswcmp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD753BD-71FA-4E3A-BD6B-797187802FCD}\WpadDecisionReason = "1"	reswcmp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{DCD753BD-71FA-4E3A-BD6B-797187802FCD}\WpadNetworkName = "Network 2"	reswcmp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\36-ad-c4-39-9f-1b\WpadDecisionReason = "1"	reswcmp.exe

Modifies registry class 64 IoCs

Processes:

5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exereswcmp.exereswcmp.exe5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command\ = "C:\\Windows\\SysWOW64\\reswcmp.exe /dde"	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Windows\\SysWOW64\\reswcmp.exe /dde"	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5B0837~1.EXE /dde"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5B0837~1.EXE /dde"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5B0837~1.EXE,0"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5B0837~1.EXE,0"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec\ = "[print(\"%1\")]"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5B0837~1.EXE /dde"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\command	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon\ = "C:\\Windows\\SysWOW64\\reswcmp.exe,0"	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print\ddeexec	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\print	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5B0837~1.EXE /dde"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\DefaultIcon	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew\NullFile	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec\ = "[open(\"%1\")]"	reswcmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\ = "Recalc Document"	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ShellNew	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\ddeexec	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\command	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL	reswcmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.RCL\ = "Recalc.Document.1"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\printto\ddeexec\ = "[printto(\"%1\",\"%2\",\"%3\",\"%4\")]"	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Recalc.Document.1\shell\open\command	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

reswcmp.exe

pid process

832 reswcmp.exe
832 reswcmp.exe
Suspicious behavior: RenamesItself 1 IoCs

Processes:

5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

pid process

604 5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

pid	process
832	reswcmp.exe
832	reswcmp.exe

pid	process
604	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exereswcmp.exereswcmp.exe

pid	process
1760	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
1760	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
604	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
604	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
268	reswcmp.exe
268	reswcmp.exe
832	reswcmp.exe
832	reswcmp.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exereswcmp.exe

description	pid	process	target process
PID 1760 wrote to memory of 604	1760	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
PID 1760 wrote to memory of 604	1760	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
PID 1760 wrote to memory of 604	1760	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
PID 1760 wrote to memory of 604	1760	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe	5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
PID 268 wrote to memory of 832	268	reswcmp.exe	reswcmp.exe
PID 268 wrote to memory of 832	268	reswcmp.exe	reswcmp.exe
PID 268 wrote to memory of 832	268	reswcmp.exe	reswcmp.exe
PID 268 wrote to memory of 832	268	reswcmp.exe	reswcmp.exe

C:\Users\Admin\AppData\Local\Temp\5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
"C:\Users\Admin\AppData\Local\Temp\5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1760

C:\Users\Admin\AppData\Local\Temp\5b08375c935c2e2b2b8f59583dabe7ecc301a65f.exe
--86b673f4
2⤵
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:604

C:\Windows\SysWOW64\reswcmp.exe
"C:\Windows\SysWOW64\reswcmp.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:268

C:\Windows\SysWOW64\reswcmp.exe
--5fb82365
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:832

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-69-0x0000000000370000-0x0000000000387000-memory.dmp

Filesize
92KB

Download
memory/604-60-0x0000000000000000-mapping.dmp

Download
memory/604-63-0x0000000000340000-0x0000000000357000-memory.dmp

Filesize
92KB

Download
memory/832-74-0x0000000000000000-mapping.dmp

Download
memory/832-76-0x00000000003A0000-0x00000000003B7000-memory.dmp

Filesize
92KB

Download
memory/1760-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1760-55-0x0000000000290000-0x00000000002A7000-memory.dmp

Filesize
92KB

Download
memory/1760-61-0x0000000000270000-0x0000000000280000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads