agenttesla | cc744204664bbe57a739b6dc9ea221a6480c7331677c208b05b451bccd31a102

General

Target

Spoof/WindowsFormsApp2.exe
Size

498KB
MD5

077abb82b84ddc20f64c1fc01bd48b87
SHA1

69a7f39503ec50d9305344cb09f2ab1afd736f7b
SHA256

c7e2265f4e6bd4a1ed9dc47f04c213a893ecc799ad61e407320cfe928b317093
SHA512

38002751eaec363e9890ec398d3f6975bf84823fd98ceadbaeb540a3b1ae38e948be912316fb61b7253d4fbada6f8bc527e4072ff68baa20c12b661f3d517f68
SSDEEP

6144:fy64DBFSbj/fG2uGAKsGAKsGAKmGAK1ino4IL52GAK1ino4IL52GAK1ino4IL5:gFym2uGUGUG+GsnoQGsnoQGsno

Score

10^/10

agenttesla keylogger spyware stealer trojan

Malware Config

Signatures

AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
keylogger trojan stealer spyware agenttesla

AgentTesla payload 1 IoCs

Processes:

resource	yara_rule
behavioral3/memory/4688-6-0x00000000063D0000-0x00000000065E4000-memory.dmp	family_agenttesla

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

WindowsFormsApp2.exemsedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	WindowsFormsApp2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	WindowsFormsApp2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	WindowsFormsApp2.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exe

pid process

1892 msedge.exe
1892 msedge.exe
2872 msedge.exe
2872 msedge.exe
4340 msedge.exe
4340 msedge.exe
1852 identity_helper.exe
1852 identity_helper.exe

pid	process
1892	msedge.exe
1892	msedge.exe
2872	msedge.exe
2872	msedge.exe
4340	msedge.exe
4340	msedge.exe
1852	identity_helper.exe
1852	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WindowsFormsApp2.exe

description pid process

Token: SeDebugPrivilege 4688 WindowsFormsApp2.exe

description	pid	process
Token: SeDebugPrivilege	4688	WindowsFormsApp2.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

Processes:

msedge.exe

pid	process
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe
2872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 2872 wrote to memory of 3924	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 3924	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1340	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1892	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 1892	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe
PID 2872 wrote to memory of 2300	2872	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\Spoof\WindowsFormsApp2.exe
"C:\Users\Admin\AppData\Local\Temp\Spoof\WindowsFormsApp2.exe"
1⤵
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff93f583cb8,0x7ff93f583cc8,0x7ff93f583cd8
2⤵
PID:3924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
2⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2472 /prefetch:8
2⤵
PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
2⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
2⤵
PID:3052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
2⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
2⤵
PID:4744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
2⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6092 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
2⤵
PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1892 /prefetch:1
2⤵
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
2⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
2⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,18109562312524547468,1127434576034918966,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
2⤵
PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
342be62313dab4970ff22b7fea8d0873

SHA1
f73558f6b8e5f3f40c5051a538c8fe2e994cfd05

SHA256
0bc96704325f901d169745aacf06f19cd3bf24445dc9c8b1309f20d06d8fd6a7

SHA512
651b3dfc0bfb7b4f1b416c67827ba0ba8b3c34244f094683787888a522822dff6c7b9d8bbe7d605b2785bf3992999cefc5531e0eb19f72cb9c2dcb39d10b27c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
4KB

MD5
ba0888f40f520094b07be43653d3ec24

SHA1
e797ce4a970794534b84a73efcdc226045f30a72

SHA256
7980af65889eac30a07344efc9986faeda32f01f4af130413d597e38b9f24527

SHA512
c31bee9b6d6fbbced4eea276ffef1b81cbf076d9c718fa040edbd4d925bb9a9956fe9310f8117b606814bd2d649a88d9480d56a7851f863a2dc05c962e94f2d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
10edaeae1a5363dc896b1b8b54ce8016

SHA1
1fb4d9c40aaf4d1dc3d53a5009526a999956db93

SHA256
b76f9cb2bd3a63053131354b6e9a89a21f77e7c877766a13bbdf6000b4e52f34

SHA512
d2549a4f8ab95a45870323c4a13bc6009888c62a1b350a5d4e33829aad68d1e14ced4729afed596b77c54dcf645be28d53505f5584ffd9d1c90e2b2437ca7cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
24fb1040f4905f2b3a97eb663de02b1c

SHA1
cc9f22f239793c8ebe5985e01e449f5392cf5448

SHA256
de4ab1da62784c9d19ec6999ca10a93fa4fad6ddd6410b053af32434c6010eae

SHA512
6bf47f3636b7879bd7dbd623ab6546455bb2a869274074878ad92e479903a7fd2a02b4eb85606ac9c83d3228b4c08761a2393f2b71eb890ce0b7efc8dd1c4907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
423c65e85c1e2ecaf28ef7abc59313dd

SHA1
90f3bad182d7044c43f6b01781f10dce10849583

SHA256
e5985aeabde39a1e9937f0c734d547dd6d0b10385be26f9b8c1f8bb9dc32eb08

SHA512
fb27907b9b3b7caf038b00fbde849663fe55ae5a23db43335a0ff08b305d826863e7003fa4e0bc182e87fdccb23690d97cc077bc0ccc1559fc0dadc0b6cf2cf2

Download Submit
\??\pipe\LOCAL\crashpad_2872_TFXCHAARPBBYGYDO

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4688-5-0x0000000005850000-0x000000000585A000-memory.dmp

Filesize
40KB

Download
memory/4688-8-0x0000000009050000-0x0000000009062000-memory.dmp

Filesize
72KB

Download
memory/4688-9-0x0000000009840000-0x000000000987C000-memory.dmp

Filesize
240KB

Download
memory/4688-10-0x0000000075110000-0x00000000758C1000-memory.dmp

Filesize
7.7MB

Download
memory/4688-11-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/4688-12-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/4688-7-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/4688-6-0x00000000063D0000-0x00000000065E4000-memory.dmp

Filesize
2.1MB

Download
memory/4688-0-0x0000000075110000-0x00000000758C1000-memory.dmp

Filesize
7.7MB

Download
memory/4688-4-0x0000000005840000-0x0000000005850000-memory.dmp

Filesize
64KB

Download
memory/4688-3-0x0000000005870000-0x0000000005902000-memory.dmp

Filesize
584KB

Download
memory/4688-2-0x0000000005E20000-0x00000000063C6000-memory.dmp

Filesize
5.6MB

Download
memory/4688-1-0x0000000000D10000-0x0000000000D92000-memory.dmp

Filesize
520KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads