c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14

Analysis

max time kernel
135s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03-12-2022 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Size

70KB
MD5

4a9e537690c47b80219ef48d07dfcd86
SHA1

2357224b7f59940c77015ca600e02615b5128cfc
SHA256

c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14
SHA512

55ec63e95f7760bd313395e32bae7ed9e7475a0e7e39f5d08b255c6ffd71f2afddaaa27fd38c70f53d90b2ab628fa4ca74d3ab736dc82aa992431d80744b7782
SSDEEP

768:QkpLA8BtBV0QJcW5wqInmNSfyvwx+BKXCJW+trdvsWCJn66kvOR:tkQJcqwmIfj+ECJG/kvO

Score

9^/10

collection spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Executes dropped EXE 1 IoCs

pid	Process
4220	wmimgmt.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	reg.exe

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
1356	net.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
2980	tasklist.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1644	ipconfig.exe
1268	NETSTAT.EXE
4572	NETSTAT.EXE

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3132	systeminfo.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

description	pid	Process
Token: SeBackupPrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeBackupPrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeBackupPrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeRestorePrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeBackupPrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeBackupPrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeBackupPrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeRestorePrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeBackupPrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeRestorePrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeBackupPrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeRestorePrivilege	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeRestorePrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeDebugPrivilege	2980	tasklist.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeRestorePrivilege	4220	wmimgmt.exe
Token: SeDebugPrivilege	1268	NETSTAT.EXE
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe
Token: SeBackupPrivilege	4220	wmimgmt.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4384 wrote to memory of 4220	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe	80
PID 4384 wrote to memory of 4220	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe	80
PID 4384 wrote to memory of 4220	4384	c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe	80
PID 4220 wrote to memory of 432	4220	wmimgmt.exe	81
PID 4220 wrote to memory of 432	4220	wmimgmt.exe	81
PID 4220 wrote to memory of 432	4220	wmimgmt.exe	81
PID 432 wrote to memory of 5052	432	cmd.exe	83
PID 432 wrote to memory of 5052	432	cmd.exe	83
PID 432 wrote to memory of 5052	432	cmd.exe	83
PID 432 wrote to memory of 1252	432	cmd.exe	89
PID 432 wrote to memory of 1252	432	cmd.exe	89
PID 432 wrote to memory of 1252	432	cmd.exe	89
PID 432 wrote to memory of 1184	432	cmd.exe	91
PID 432 wrote to memory of 1184	432	cmd.exe	91
PID 432 wrote to memory of 1184	432	cmd.exe	91
PID 1184 wrote to memory of 1144	1184	net.exe	92
PID 1184 wrote to memory of 1144	1184	net.exe	92
PID 1184 wrote to memory of 1144	1184	net.exe	92
PID 432 wrote to memory of 872	432	cmd.exe	94
PID 432 wrote to memory of 872	432	cmd.exe	94
PID 432 wrote to memory of 872	432	cmd.exe	94
PID 872 wrote to memory of 1052	872	net.exe	95
PID 872 wrote to memory of 1052	872	net.exe	95
PID 872 wrote to memory of 1052	872	net.exe	95
PID 432 wrote to memory of 2980	432	cmd.exe	96
PID 432 wrote to memory of 2980	432	cmd.exe	96
PID 432 wrote to memory of 2980	432	cmd.exe	96
PID 432 wrote to memory of 3132	432	cmd.exe	98
PID 432 wrote to memory of 3132	432	cmd.exe	98
PID 432 wrote to memory of 3132	432	cmd.exe	98
PID 432 wrote to memory of 928	432	cmd.exe	101
PID 432 wrote to memory of 928	432	cmd.exe	101
PID 432 wrote to memory of 928	432	cmd.exe	101
PID 432 wrote to memory of 3840	432	cmd.exe	102
PID 432 wrote to memory of 3840	432	cmd.exe	102
PID 432 wrote to memory of 3840	432	cmd.exe	102
PID 432 wrote to memory of 2800	432	cmd.exe	103
PID 432 wrote to memory of 2800	432	cmd.exe	103
PID 432 wrote to memory of 2800	432	cmd.exe	103
PID 432 wrote to memory of 3800	432	cmd.exe	104
PID 432 wrote to memory of 3800	432	cmd.exe	104
PID 432 wrote to memory of 3800	432	cmd.exe	104
PID 432 wrote to memory of 4944	432	cmd.exe	105
PID 432 wrote to memory of 4944	432	cmd.exe	105
PID 432 wrote to memory of 4944	432	cmd.exe	105
PID 432 wrote to memory of 1072	432	cmd.exe	106
PID 432 wrote to memory of 1072	432	cmd.exe	106
PID 432 wrote to memory of 1072	432	cmd.exe	106
PID 432 wrote to memory of 4996	432	cmd.exe	107
PID 432 wrote to memory of 4996	432	cmd.exe	107
PID 432 wrote to memory of 4996	432	cmd.exe	107
PID 432 wrote to memory of 4952	432	cmd.exe	108
PID 432 wrote to memory of 4952	432	cmd.exe	108
PID 432 wrote to memory of 4952	432	cmd.exe	108
PID 432 wrote to memory of 4244	432	cmd.exe	109
PID 432 wrote to memory of 4244	432	cmd.exe	109
PID 432 wrote to memory of 4244	432	cmd.exe	109
PID 432 wrote to memory of 4540	432	cmd.exe	110
PID 432 wrote to memory of 4540	432	cmd.exe	110
PID 432 wrote to memory of 4540	432	cmd.exe	110
PID 432 wrote to memory of 4440	432	cmd.exe	111
PID 432 wrote to memory of 4440	432	cmd.exe	111
PID 432 wrote to memory of 4440	432	cmd.exe	111
PID 432 wrote to memory of 2640	432	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe
"C:\Users\Admin\AppData\Local\Temp\c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4384
- C:\ProgramData\Application Data\wmimgmt.exe
  "C:\ProgramData\Application Data\wmimgmt.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /v:on /c C:\Users\Admin\AppData\Local\Temp\ghi.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /s "YM.CGP_" "C:\Users\Admin"\..\*.txt
      4⤵
      PID:5052
  - - C:\Windows\SysWOW64\chcp.com
      chcp
      4⤵
      PID:1252
  - - C:\Windows\SysWOW64\net.exe
      net user
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1184
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user
        5⤵
        
        PID:1144
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      Suspicious use of WriteProcessMemory
      PID:872
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1052
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:2980
  - - C:\Windows\SysWOW64\systeminfo.exe
      systeminfo
      4⤵
      Gathers system information
      PID:3132
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer"
      4⤵
      PID:928
  - - C:\Windows\SysWOW64\find.exe
      find "REG_"
      4⤵
      PID:3840
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office
      4⤵
      PID:2800
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\8.0\Common\UserInfo
      4⤵
      PID:3800
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Common\UserInfo
      4⤵
      PID:4944
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\10.0\Common\UserInfo
      4⤵
      PID:1072
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\11.0\Common\UserInfo
      4⤵
      PID:4996
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\12.0\Common\UserInfo
      4⤵
      PID:4952
  - - C:\Windows\SysWOW64\reg.exe
      reg query HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Common\UserInfo
      4⤵
      PID:4244
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_CURRENT_USER\Software\Microsoft\Internet Account Manager\Accounts" /s
      4⤵
      PID:4540
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts" /s
      4⤵
      Accesses Microsoft Outlook accounts
      PID:4440
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_CURRENT_USER\Software\Mirabilis\ICQ" /s
      4⤵
      PID:2640
  - - C:\Windows\SysWOW64\reg.exe
      reg query "HKEY_CURRENT_USER\Software\Microsoft\MSNMessenger" /s
      4⤵
      PID:2732
  - - C:\Windows\SysWOW64\net.exe
      net user Admin
      4⤵
      PID:2976
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Admin
        5⤵
        
        PID:5072
  - - C:\Windows\SysWOW64\net.exe
      net user Admin /domain
      4⤵
      PID:1896
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user Admin /domain
        5⤵
        
        PID:3380
  - - C:\Windows\SysWOW64\net.exe
      net group
      4⤵
      PID:2468
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group
        5⤵
        
        PID:2808
  - - C:\Windows\SysWOW64\net.exe
      net group /domain
      4⤵
      PID:1888
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group /domain
        5⤵
        
        PID:1860
  - - C:\Windows\SysWOW64\net.exe
      net group "domain admins"
      4⤵
      PID:4700
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain admins"
        5⤵
        
        PID:4744
  - - C:\Windows\SysWOW64\net.exe
      net group "domain admins" /domain
      4⤵
      PID:1708
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain admins" /domain
        5⤵
        
        PID:4020
  - - C:\Windows\SysWOW64\net.exe
      net group "domain computers"
      4⤵
      PID:1332
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain computers"
        5⤵
        
        PID:2792
  - - C:\Windows\SysWOW64\net.exe
      net group "domain computers" /domain
      4⤵
      PID:820
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain computers" /domain
        5⤵
        
        PID:344
  - - C:\Windows\SysWOW64\net.exe
      net group "domain controllers"
      4⤵
      PID:216
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain controllers"
        5⤵
        
        PID:3732
  - - C:\Windows\SysWOW64\net.exe
      net group "domain controllers" /domain
      4⤵
      PID:2000
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain controllers" /domain
        5⤵
        
        PID:2196
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1644
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -ano
      4⤵
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:1268
  - - C:\Windows\SysWOW64\ARP.EXE
      arp -a
      4⤵
      PID:484
  - - C:\Windows\SysWOW64\NETSTAT.EXE
      netstat -r
      4⤵
      Gathers network information
      PID:4572
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Windows\system32\route.exe" print
        5⤵
        
        PID:880
      - C:\Windows\SysWOW64\ROUTE.EXE
        
        C:\Windows\system32\route.exe print
        6⤵
        
        PID:4008
  - - C:\Windows\SysWOW64\net.exe
      net start
      4⤵
      PID:4072
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start
        5⤵
        
        PID:2428
  - - C:\Windows\SysWOW64\net.exe
      net use
      4⤵
      PID:3716
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" echo n"
      4⤵
      PID:3812
  - - C:\Windows\SysWOW64\net.exe
      net share
      4⤵
      PID:3672
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share
        5⤵
        
        PID:3820
  - - C:\Windows\SysWOW64\net.exe
      net view /domain
      4⤵
      Discovers systems in the same network
      PID:1356
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      PID:1648
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "------"
      4⤵
      PID:1128
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      PID:1988
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "domain"
      4⤵
      PID:2328
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      PID:3744
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "¬A╛╣"
      4⤵
      PID:4904
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      PID:1960
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "░⌡ªµª¿"
      4⤵
      PID:3360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\s.log "
      4⤵
      PID:2088
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "├ⁿ┴ε"
      4⤵
      PID:3492
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /S /D /c" type C:\Users\Admin\AppData\Local\Temp\t.log "
      4⤵
      PID:2248
  - - C:\Windows\SysWOW64\find.exe
      find /i /v "completed successfully"
      4⤵
      PID:1192

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Account Manipulation

T1098

Privilege Escalation

Defense Evasion

Credential Access

Account Manipulation

T1098

Credentials in Files

T1081

Discovery

Process Discovery

T1057

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Application Data\wmimgmt.exe

Filesize
70KB

MD5
4a9e537690c47b80219ef48d07dfcd86

SHA1
2357224b7f59940c77015ca600e02615b5128cfc

SHA256
c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14

SHA512
55ec63e95f7760bd313395e32bae7ed9e7475a0e7e39f5d08b255c6ffd71f2afddaaa27fd38c70f53d90b2ab628fa4ca74d3ab736dc82aa992431d80744b7782

Download Submit
C:\ProgramData\wmimgmt.exe

Filesize
70KB

MD5
4a9e537690c47b80219ef48d07dfcd86

SHA1
2357224b7f59940c77015ca600e02615b5128cfc

SHA256
c6d330ac8af0cd12af96411868f7a2a12bc38abb6b184543ca13d89afdb57b14

SHA512
55ec63e95f7760bd313395e32bae7ed9e7475a0e7e39f5d08b255c6ffd71f2afddaaa27fd38c70f53d90b2ab628fa4ca74d3ab736dc82aa992431d80744b7782

Download Submit
C:\Users\Admin\AppData\Local\Temp\INFO.TXT

Filesize
49B

MD5
f2ae9d5ddaf95dff879bcdd2482dadb5

SHA1
78241ac1e0128dea22b5f72f3ad6601b9f1b48b5

SHA256
ca10a19f1be0c3bc16acf0afb3edc842f550729725a22feeb1a7b0ce3bb0d9e0

SHA512
712b9dbb1110e5006255c6e7732e83966a71c8503b97e63aeedd666ef69591585d232c905314b961bffc6f0685ab114c8c5f57222670a707ef8b86bcedfca0ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\drivers.p

Filesize
10B

MD5
3594ed70083b6e10efbfbcd4142b6454

SHA1
59b91832fc3778d2dba62642935c61fb768c760c

SHA256
c1aead592e2eb892263a7b1a7ca36484c73013be81dda18ccbe6a35138799823

SHA512
418466d5b10ba557bdb229cfcf7e190e7cedd9fd52a72e2591f78fc1c5c983b04c60c9307e8919c3d7e366d71c54a325d4f20e4ad4850677b115ca9c562d0586

Download Submit
C:\Users\Admin\AppData\Local\Temp\ghi.bat

Filesize
4KB

MD5
b91bc08162fbc3445c5424b77183b807

SHA1
52b2a60db40cdcc655648a65210ed26219c033e1

SHA256
7cec366268426139777f0776ba3cbce6a50f4112a96fa88190bee2ebe665275a

SHA512
2f19fe96209dcb4e189a8fecddcac40ebed8ce0c6999a469268b57e74e9e830a7b03c1d024c616797ae9029a4566fa96006f29e1fa042bca1534d1d815ae8b35

Download Submit
memory/4220-141-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4220-137-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4384-132-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4384-136-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads