a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0

General

Target

a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
Size

172KB
MD5

1e149467daa9277f9a2e36ad1be60090
SHA1

4561d52a35b80e9634633a30a6d55ebf429fd368
SHA256

a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0
SHA512

d55acbc094757e15f33e89fbb047205f6421af4a1a4e5f638e2e6e7be1f28d8f5bf789cd0a80852894e0e30f12bbca39ae73bdc8d7cb993a26aefef6fce3c285
SSDEEP

3072:9YTA7Jhf//HJG3xwQhy2rXSzrpuUODQc:9P1pGBV0FzrTOF

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.execoutuit.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	coutuit.exe

Executes dropped EXE 2 IoCs

Processes:

coutuit.execoutuit.exe

pid process

1480 coutuit.exe
616 coutuit.exe

pid	process
1480	coutuit.exe
616	coutuit.exe

Loads dropped DLL 2 IoCs

Processes:

a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe

pid	process
2032	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
2032	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe

Adds Run key to start application 2 TTPs 29 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

coutuit.exea5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /l"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /k"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /h"	coutuit.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /m"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /p"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /n"	coutuit.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /a"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /f"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /g"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /s"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /q"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /c"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /v"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /o"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /r"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /z"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /d"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /i"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /b"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /u"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /v"	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /y"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /t"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /j"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /e"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /w"	coutuit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\coutuit = "C:\\Users\\Admin\\coutuit.exe /x"	coutuit.exe

Maps connected drives based on registry 3 TTPs 4 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

coutuit.exea5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	coutuit.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	coutuit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe

Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

coutuit.exe

description ioc process

File opened for modification C:\Users\Admin\c\autorun.inf coutuit.exe

description	ioc	process
File opened for modification	C:\Users\Admin\c\autorun.inf	coutuit.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.execoutuit.exe

description	pid	process	target process
PID 1488 set thread context of 2032	1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
PID 1480 set thread context of 616	1480	coutuit.exe	coutuit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.execoutuit.exe

pid	process
2032	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe
616	coutuit.exe

Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exea5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.execoutuit.execoutuit.exe

pid	process
1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
2032	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
1480	coutuit.exe
616	coutuit.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exea5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.execoutuit.exe

description	pid	process	target process
PID 1488 wrote to memory of 2032	1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
PID 1488 wrote to memory of 2032	1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
PID 1488 wrote to memory of 2032	1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
PID 1488 wrote to memory of 2032	1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
PID 1488 wrote to memory of 2032	1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
PID 1488 wrote to memory of 2032	1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
PID 1488 wrote to memory of 2032	1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
PID 1488 wrote to memory of 2032	1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
PID 1488 wrote to memory of 2032	1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
PID 1488 wrote to memory of 2032	1488	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
PID 2032 wrote to memory of 1480	2032	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	coutuit.exe
PID 2032 wrote to memory of 1480	2032	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	coutuit.exe
PID 2032 wrote to memory of 1480	2032	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	coutuit.exe
PID 2032 wrote to memory of 1480	2032	a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe	coutuit.exe
PID 1480 wrote to memory of 616	1480	coutuit.exe	coutuit.exe
PID 1480 wrote to memory of 616	1480	coutuit.exe	coutuit.exe
PID 1480 wrote to memory of 616	1480	coutuit.exe	coutuit.exe
PID 1480 wrote to memory of 616	1480	coutuit.exe	coutuit.exe
PID 1480 wrote to memory of 616	1480	coutuit.exe	coutuit.exe
PID 1480 wrote to memory of 616	1480	coutuit.exe	coutuit.exe
PID 1480 wrote to memory of 616	1480	coutuit.exe	coutuit.exe
PID 1480 wrote to memory of 616	1480	coutuit.exe	coutuit.exe
PID 1480 wrote to memory of 616	1480	coutuit.exe	coutuit.exe
PID 1480 wrote to memory of 616	1480	coutuit.exe	coutuit.exe

C:\Users\Admin\AppData\Local\Temp\a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
"C:\Users\Admin\AppData\Local\Temp\a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1488

C:\Users\Admin\AppData\Local\Temp\a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0.exe
74
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Adds Run key to start application
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032

C:\Users\Admin\coutuit.exe
"C:\Users\Admin\coutuit.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1480

C:\Users\Admin\coutuit.exe
74
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\coutuit.exe
Filesize
172KB

MD5
1e149467daa9277f9a2e36ad1be60090

SHA1
4561d52a35b80e9634633a30a6d55ebf429fd368

SHA256
a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0

SHA512
d55acbc094757e15f33e89fbb047205f6421af4a1a4e5f638e2e6e7be1f28d8f5bf789cd0a80852894e0e30f12bbca39ae73bdc8d7cb993a26aefef6fce3c285

Download Submit
C:\Users\Admin\coutuit.exe
Filesize
172KB

MD5
1e149467daa9277f9a2e36ad1be60090

SHA1
4561d52a35b80e9634633a30a6d55ebf429fd368

SHA256
a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0

SHA512
d55acbc094757e15f33e89fbb047205f6421af4a1a4e5f638e2e6e7be1f28d8f5bf789cd0a80852894e0e30f12bbca39ae73bdc8d7cb993a26aefef6fce3c285

Download Submit
C:\Users\Admin\coutuit.exe
Filesize
172KB

MD5
1e149467daa9277f9a2e36ad1be60090

SHA1
4561d52a35b80e9634633a30a6d55ebf429fd368

SHA256
a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0

SHA512
d55acbc094757e15f33e89fbb047205f6421af4a1a4e5f638e2e6e7be1f28d8f5bf789cd0a80852894e0e30f12bbca39ae73bdc8d7cb993a26aefef6fce3c285

Download Submit
\Users\Admin\coutuit.exe
Filesize
172KB

MD5
1e149467daa9277f9a2e36ad1be60090

SHA1
4561d52a35b80e9634633a30a6d55ebf429fd368

SHA256
a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0

SHA512
d55acbc094757e15f33e89fbb047205f6421af4a1a4e5f638e2e6e7be1f28d8f5bf789cd0a80852894e0e30f12bbca39ae73bdc8d7cb993a26aefef6fce3c285

Download Submit
\Users\Admin\coutuit.exe
Filesize
172KB

MD5
1e149467daa9277f9a2e36ad1be60090

SHA1
4561d52a35b80e9634633a30a6d55ebf429fd368

SHA256
a5ca923dceb0aee349e59666f287352d18f9dc79234fbe02d935ad2ccc8cdfc0

SHA512
d55acbc094757e15f33e89fbb047205f6421af4a1a4e5f638e2e6e7be1f28d8f5bf789cd0a80852894e0e30f12bbca39ae73bdc8d7cb993a26aefef6fce3c285

Download Submit
memory/616-81-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/616-78-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/616-72-0x00000000004010EC-mapping.dmp

Download
memory/1480-66-0x0000000000000000-mapping.dmp

Download
memory/2032-56-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-63-0x0000000076681000-0x0000000076683000-memory.dmp

Filesize
8KB

Download
memory/2032-62-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-59-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-80-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2032-57-0x00000000004010EC-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads