ramnit | 887e75c66218aa2570e84194ff097bfcd103a1c0befdf134387a88941b8ec731

General

Target

AYRFydoZ.exe
Size

139KB
MD5

f2f0128222f4fdde378133bccd62853c
SHA1

2040bde9fa68e318c96bf7433e37db4ee6226588
SHA256

887e75c66218aa2570e84194ff097bfcd103a1c0befdf134387a88941b8ec731
SHA512

568c63d7cd6395a9ae64d0cda24ad9b2b1158856d1324f72f055c15959c3231ec0f0e4b451b0926bf6719ff844b02cd23405d20cc6e1bde6c0448e223b3332d1
SSDEEP

3072:nROzoTq0+RO7IwnYu6VHir3J2qed7WzUXVn19d:RkdNwBF6VCAnJWzUFd

Score

10^/10

ramnit banker evasion spyware stealer trojan upx worm

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

AYRFydoZ.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	AYRFydoZ.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	AYRFydoZ.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	AYRFydoZ.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\AYRFydoZ.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\AYRFydoZ.exe:*:enabled:@shell32.dll,-1"	AYRFydoZ.exe

Ramnit
Ramnit is a versatile family that holds viruses, worms, and Trojans.
trojan spyware stealer worm banker ramnit
Drops file in Drivers directory 1 IoCs

Processes:

AYRFydoZ.exe

description ioc process

File opened for modification C:\Windows\system32\DRIVERS\ETC\HOSTS AYRFydoZ.exe

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\ETC\HOSTS	AYRFydoZ.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/328-132-0x0000000000400000-0x0000000000443000-memory.dmp	upx
behavioral1/memory/328-156-0x0000000000400000-0x0000000000443000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

Processes:

AYRFydoZ.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\pxA175.tmp	AYRFydoZ.exe
File created	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	AYRFydoZ.exe
File opened for modification	C:\Program Files (x86)\Microsoft\DesktopLayer.exe	AYRFydoZ.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2932 328 WerFault.exe AYRFydoZ.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

AYRFydoZ.exe

pid process

328 AYRFydoZ.exe
328 AYRFydoZ.exe

pid	pid_target	process	target process
2932	328	WerFault.exe	AYRFydoZ.exe

Suspicious behavior: MapViewOfSection 56 IoCs

Processes:

AYRFydoZ.exe

pid	process
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe
328	AYRFydoZ.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

AYRFydoZ.exe

description pid process

Token: SeDebugPrivilege 328 AYRFydoZ.exe

description	pid	process
Token: SeDebugPrivilege	328	AYRFydoZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AYRFydoZ.exe

description	pid	process	target process
PID 328 wrote to memory of 568	328	AYRFydoZ.exe	winlogon.exe
PID 328 wrote to memory of 568	328	AYRFydoZ.exe	winlogon.exe
PID 328 wrote to memory of 568	328	AYRFydoZ.exe	winlogon.exe
PID 328 wrote to memory of 568	328	AYRFydoZ.exe	winlogon.exe
PID 328 wrote to memory of 568	328	AYRFydoZ.exe	winlogon.exe
PID 328 wrote to memory of 568	328	AYRFydoZ.exe	winlogon.exe
PID 328 wrote to memory of 644	328	AYRFydoZ.exe	lsass.exe
PID 328 wrote to memory of 644	328	AYRFydoZ.exe	lsass.exe
PID 328 wrote to memory of 644	328	AYRFydoZ.exe	lsass.exe
PID 328 wrote to memory of 644	328	AYRFydoZ.exe	lsass.exe
PID 328 wrote to memory of 644	328	AYRFydoZ.exe	lsass.exe
PID 328 wrote to memory of 644	328	AYRFydoZ.exe	lsass.exe
PID 328 wrote to memory of 724	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 724	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 724	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 724	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 724	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 724	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 732	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 732	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 732	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 732	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 732	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 732	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 740	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 740	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 740	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 740	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 740	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 740	328	AYRFydoZ.exe	fontdrvhost.exe
PID 328 wrote to memory of 808	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 808	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 808	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 808	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 808	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 808	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 864	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 864	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 864	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 864	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 864	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 864	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 912	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 912	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 912	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 912	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 912	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 912	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 1000	328	AYRFydoZ.exe	dwm.exe
PID 328 wrote to memory of 1000	328	AYRFydoZ.exe	dwm.exe
PID 328 wrote to memory of 1000	328	AYRFydoZ.exe	dwm.exe
PID 328 wrote to memory of 1000	328	AYRFydoZ.exe	dwm.exe
PID 328 wrote to memory of 1000	328	AYRFydoZ.exe	dwm.exe
PID 328 wrote to memory of 1000	328	AYRFydoZ.exe	dwm.exe
PID 328 wrote to memory of 1020	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 1020	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 1020	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 1020	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 1020	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 1020	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 444	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 444	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 444	328	AYRFydoZ.exe	svchost.exe
PID 328 wrote to memory of 444	328	AYRFydoZ.exe	svchost.exe

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:644

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:568

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
2⤵
PID:740

C:\Windows\system32\dwm.exe
"dwm.exe"
2⤵
PID:1000

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
PID:724

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s LSM
1⤵
PID:912

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1020

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s lmhosts
1⤵
PID:444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
PID:4204

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localserviceandnoimpersonation -s SSDPSRV
1⤵
PID:4016

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4440

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s CDPSvc
1⤵
PID:4300

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3756

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3492

C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe
"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca
1⤵
PID:3268

C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe
"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca
1⤵
PID:3248

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2952

C:\Users\Admin\AppData\Local\Temp\AYRFydoZ.exe
"C:\Users\Admin\AppData\Local\Temp\AYRFydoZ.exe"
2⤵
- Modifies firewall policy service
- Drops file in Drivers directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 328 -s 560
3⤵
- Program crash
PID:2932

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2740

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2728

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s TrkWks
1⤵
PID:2712

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2672

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s CryptSvc
1⤵
PID:2656

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2644

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2588

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservicenetworkrestricted -s PolicyAgent
1⤵
PID:2556

c:\windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2500

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2464

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc
1⤵
PID:2336

c:\windows\system32\sihost.exe
sihost.exe
1⤵
PID:2328

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s tiledatamodelsvc
1⤵
PID:2156

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s LanmanWorkstation
1⤵
PID:1676

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2032

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1892

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k appmodel -s StateRepository
1⤵
PID:1856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1724

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s netprofm
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
1⤵
PID:1648

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s Dnscache
1⤵
PID:1600

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s NlaSvc
1⤵
PID:1524

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s FontCache
1⤵
PID:1480

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s AudioEndpointBuilder
1⤵
PID:1472

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1348

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s Dhcp
1⤵
PID:1336

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s EventSystem
1⤵
PID:1264

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1256

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s nsi
1⤵
PID:1160

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservicenetworkrestricted -s EventLog
1⤵
PID:1144

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1100

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
1⤵
PID:932

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s NcbService
1⤵
PID:696

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k rpcss
1⤵
PID:864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
PID:808

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:732

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/328-120-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-121-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-122-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-123-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-124-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-125-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-126-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-128-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-127-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-129-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-130-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-131-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-132-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/328-133-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-135-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-136-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-137-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-138-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-140-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-139-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-142-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-141-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-143-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-144-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-146-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-147-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-148-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-149-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-145-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-134-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-150-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-152-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-153-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-154-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-151-0x0000000077460000-0x00000000775EE000-memory.dmp

Filesize
1.6MB

Download
memory/328-155-0x0000000000450000-0x000000000059A000-memory.dmp

Filesize
1.3MB

Download
memory/328-156-0x0000000000400000-0x0000000000443000-memory.dmp

Filesize
268KB

Download
memory/328-157-0x0000000000450000-0x000000000059A000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads