1545645f6c5ecc9f14ee924de8ad3dea051e24a8fca9b34beedf958cae0c1b90

Analysis

max time kernel
0s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
28-12-2023 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe196add855b16dc1b8e80729610a4e0.exe
Size

3.6MB
MD5

fe196add855b16dc1b8e80729610a4e0
SHA1

f44efb48cda5958e5603b36d1a59709a847fc0e7
SHA256

1545645f6c5ecc9f14ee924de8ad3dea051e24a8fca9b34beedf958cae0c1b90
SHA512

78285eb98cefe794720d198509e4ccacfead6546dd0d70594bc137a41c99b6db2d8f5db1a5b674283396165b5fda7a970d34dff376dead59ba67c5e583e2075a
SSDEEP

98304:qGk6+Wzyy2Js1c8YlQvtGSpQVYQahXSj68h761:DtZz9msbEbvVY06CQ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2924	fe196add855b16dc1b8e80729610a4e0.tmp

Loads dropped DLL 3 IoCs

pid	Process
2992	fe196add855b16dc1b8e80729610a4e0.exe
2924	fe196add855b16dc1b8e80729610a4e0.tmp
2924	fe196add855b16dc1b8e80729610a4e0.tmp

Enumerates processes with tasklist 1 TTPs 21 IoCs

Process Discovery

T1057

pid	Process
2312	tasklist.exe
860	tasklist.exe
2752	tasklist.exe
1648	tasklist.exe
2488	tasklist.exe
1064	tasklist.exe
2424	tasklist.exe
784	tasklist.exe
1444	tasklist.exe
1876	tasklist.exe
320	tasklist.exe
1976	tasklist.exe
2192	tasklist.exe
1576	tasklist.exe
340	tasklist.exe
2100	tasklist.exe
1736	tasklist.exe
1728	tasklist.exe
2428	tasklist.exe
2212	tasklist.exe
2068	tasklist.exe

Gathers network information 2 TTPs 5 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2180	NETSTAT.EXE
848	NETSTAT.EXE
2968	NETSTAT.EXE
2064	NETSTAT.EXE
1704	NETSTAT.EXE

Script User-Agent 6 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	5	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	7	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	13	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	3	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	4	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2924	2992	fe196add855b16dc1b8e80729610a4e0.exe	20
PID 2992 wrote to memory of 2924	2992	fe196add855b16dc1b8e80729610a4e0.exe	20
PID 2992 wrote to memory of 2924	2992	fe196add855b16dc1b8e80729610a4e0.exe	20
PID 2992 wrote to memory of 2924	2992	fe196add855b16dc1b8e80729610a4e0.exe	20
PID 2992 wrote to memory of 2924	2992	fe196add855b16dc1b8e80729610a4e0.exe	20
PID 2992 wrote to memory of 2924	2992	fe196add855b16dc1b8e80729610a4e0.exe	20
PID 2992 wrote to memory of 2924	2992	fe196add855b16dc1b8e80729610a4e0.exe	20
PID 2924 wrote to memory of 2832	2924	fe196add855b16dc1b8e80729610a4e0.tmp	19
PID 2924 wrote to memory of 2832	2924	fe196add855b16dc1b8e80729610a4e0.tmp	19
PID 2924 wrote to memory of 2832	2924	fe196add855b16dc1b8e80729610a4e0.tmp	19
PID 2924 wrote to memory of 2832	2924	fe196add855b16dc1b8e80729610a4e0.tmp	19
PID 2832 wrote to memory of 2608	2832	cmd.exe	17
PID 2832 wrote to memory of 2608	2832	cmd.exe	17
PID 2832 wrote to memory of 2608	2832	cmd.exe	17
PID 2832 wrote to memory of 2608	2832	cmd.exe	17

C:\Users\Admin\AppData\Local\Temp\fe196add855b16dc1b8e80729610a4e0.exe
"C:\Users\Admin\AppData\Local\Temp\fe196add855b16dc1b8e80729610a4e0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Users\Admin\AppData\Local\Temp\is-6R8J1.tmp\fe196add855b16dc1b8e80729610a4e0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6R8J1.tmp\fe196add855b16dc1b8e80729610a4e0.tmp" /SL5="$70120,3326047,56832,C:\Users\Admin\AppData\Local\Temp\fe196add855b16dc1b8e80729610a4e0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:536
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:2544
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:1684
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
      4⤵
      PID:540
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:2232
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:2372
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
      4⤵
      PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:1776
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
      4⤵
      PID:1644
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:2436
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
      4⤵
      PID:2748
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:600
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq TeamViewer_Desktop.exe" /FO CSV
      4⤵
      PID:1064
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:1060
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq DFServ.exe" /FO CSV
      4⤵
      PID:624
- - C:\Users\Admin\AppData\Local\Temp\is-S2A8B.tmp\gentlemjmp_irow.exe
    "C:\Users\Admin\AppData\Local\Temp\is-S2A8B.tmp\gentlemjmp_irow.exe" go=ofcourse product_id=UPD xmlsource=C:\Users\Admin\AppData\Local\Temp\fe196add855b16dc1b8e80729610a4e0.exe
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:2372
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:1752
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5904 " | findstr /C:"ESTABLISHED"
    3⤵
    PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5903 " | findstr /C:"ESTABLISHED"
    3⤵
    PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5902 " | findstr /C:"ESTABLISHED"
    3⤵
    PID:2764
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5901 " | findstr /C:"ESTABLISHED"
    3⤵
    PID:2684
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C netstat -na | findstr /C:":5900 " | findstr /C:"ESTABLISHED"
    3⤵
    PID:2552
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-S2A8B.tmp\cmd.bat""
    3⤵
    PID:1592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:892
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:1936
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:2908
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:1344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c tasklist /FI "WINDOWTITLE eq Process Monitor*" |find "PID"
    3⤵
    PID:1528
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:1284
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:1672
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /C ""CheckProc.cmd""
    3⤵
    PID:2392

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
1⤵
PID:2608

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-S2A8B.tmp\ex.bat""
1⤵
- Suspicious use of WriteProcessMemory
PID:2832

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:2488

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:1064
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq TeamViewer_Desktop.exe" /FO CSV
  2⤵
  - Enumerates processes with tasklist
  PID:784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.tmp" /FO CSV
1⤵
PID:784

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq newversion.exe" /FO CSV
1⤵
PID:2960

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Setup.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:1876

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:1728

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:320

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (2).exe" /FO CSV
1⤵
PID:2380

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Setup (1).exe" /FO CSV
1⤵
PID:2016

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:2428

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
1⤵
PID:1500
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Fiddler.exe" /FO CSV
  2⤵
  - Enumerates processes with tasklist
  PID:1648

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Wireshark.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:1976

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
1⤵
PID:1532
- C:\Windows\SysWOW64\tasklist.exe
  tasklist /FI "IMAGENAME eq Capsa.exe" /FO CSV
  2⤵
  - Enumerates processes with tasklist
  PID:1444

C:\Windows\SysWOW64\find.exe
find "PID"
1⤵
PID:1088

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:2192

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:1576

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:340

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:2100

C:\Windows\SysWOW64\findstr.exe
findstr /C:":5902 "
1⤵
PID:2576

C:\Windows\SysWOW64\findstr.exe
findstr /C:"ESTABLISHED"
1⤵
PID:2072

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq DFServ.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:860

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:1736

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq unchecky_gb.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:2424

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-VRDSP.tmp\ex.bat""
1⤵
PID:1516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -inputformat none -NoProfile -NoLogo -Command "& {$avlist = @(); $os = Get-WmiObject Win32_OperatingSystem; if ($os.ProductType -eq 3) {Write-Host \"ServerOS|0\";} elseif ($os.Version -like \"5.*\") {Get-WmiObject -Namespace root\SecurityCenter -Class AntiVirusProduct | ForEach-Object {Write-Host \"$($_.displayName)|$(if ($_.onAccessScanningEnabled) {\"4096\"} else {\"0\"})\"};} else {Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiVirusProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};Get-WmiObject -Namespace root\SecurityCenter2 -Class AntiSpywareProduct | ForEach-Object {$avlist += \"$($_.displayName)|$($_.productState)\"};} Write-Host ($avlist -join \"*\")}"
  2⤵
  PID:1508

C:\Users\Admin\AppData\Local\Temp\is-GL5OV.tmp\gentlemjmp_irow.tmp
"C:\Users\Admin\AppData\Local\Temp\is-GL5OV.tmp\gentlemjmp_irow.tmp" /SL5="$1F01EC,2930134,56832,C:\Users\Admin\AppData\Local\Temp\is-S2A8B.tmp\gentlemjmp_irow.exe" go=ofcourse product_id=UPD xmlsource=C:\Users\Admin\AppData\Local\Temp\fe196add855b16dc1b8e80729610a4e0.exe
1⤵
PID:2368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq unchecky_svc.exe" /FO CSV
1⤵
PID:2204

C:\Windows\SysWOW64\findstr.exe
findstr /C:"ESTABLISHED"
1⤵
PID:2544

C:\Windows\SysWOW64\findstr.exe
findstr /C:":5904 "
1⤵
PID:2836

C:\Windows\SysWOW64\NETSTAT.EXE
netstat -na
1⤵
- Gathers network information
PID:2968

C:\Windows\SysWOW64\findstr.exe
findstr /C:":5903 "
1⤵
PID:1096

C:\Windows\SysWOW64\NETSTAT.EXE
netstat -na
1⤵
- Gathers network information
PID:2064

C:\Windows\SysWOW64\findstr.exe
findstr /C:"ESTABLISHED"
1⤵
PID:2648

C:\Windows\SysWOW64\NETSTAT.EXE
netstat -na
1⤵
- Gathers network information
PID:1704

C:\Windows\SysWOW64\findstr.exe
findstr /C:"ESTABLISHED"
1⤵
PID:2620

C:\Windows\SysWOW64\findstr.exe
findstr /C:":5901 "
1⤵
PID:2680

C:\Windows\SysWOW64\NETSTAT.EXE
netstat -na
1⤵
- Gathers network information
PID:2180

C:\Windows\SysWOW64\findstr.exe
findstr /C:"ESTABLISHED"
1⤵
PID:3028

C:\Windows\SysWOW64\findstr.exe
findstr /C:":5900 "
1⤵
PID:2788

C:\Windows\SysWOW64\NETSTAT.EXE
netstat -na
1⤵
- Gathers network information
PID:848

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-Unicode.exe" /FO CSV
1⤵
PID:2716

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Regshot-x64-Unicode.exe" /FO CSV
1⤵
PID:2868

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq OLLYDBG.exe" /FO CSV
1⤵
PID:2900

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:2312

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq Taskmgr.exe" /FO CSV
1⤵
PID:568

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq regedit.exe" /FO CSV
1⤵
PID:1464

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "WINDOWTITLE eq Process Monitor*"
1⤵
- Enumerates processes with tasklist
PID:2212

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq Procmon.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:2752

C:\Windows\SysWOW64\tasklist.exe
tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
1⤵
- Enumerates processes with tasklist
PID:2068

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq ipscan.exe" /FO CSV
1⤵
PID:1148

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c tasklist /FI "IMAGENAME eq HMA! Pro VPN.exe" /FO CSV
1⤵
PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1508-112-0x0000000072BD0000-0x000000007317B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-113-0x0000000002A70000-0x0000000002AB0000-memory.dmp

Filesize
256KB

Download
memory/1508-115-0x0000000072BD0000-0x000000007317B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-116-0x0000000002A70000-0x0000000002AB0000-memory.dmp

Filesize
256KB

Download
memory/1508-117-0x0000000072BD0000-0x000000007317B000-memory.dmp

Filesize
5.7MB

Download
memory/1508-114-0x0000000072BD0000-0x000000007317B000-memory.dmp

Filesize
5.7MB

Download
memory/2236-131-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2236-124-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2236-78-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2236-81-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2368-125-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2368-130-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/2368-126-0x0000000000540000-0x000000000057C000-memory.dmp

Filesize
240KB

Download
memory/2368-128-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2368-127-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/2368-129-0x0000000000540000-0x000000000057C000-memory.dmp

Filesize
240KB

Download
memory/2368-93-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2368-103-0x00000000003E0000-0x00000000003F5000-memory.dmp

Filesize
84KB

Download
memory/2368-99-0x0000000000540000-0x000000000057C000-memory.dmp

Filesize
240KB

Download
memory/2608-20-0x0000000002960000-0x00000000029A0000-memory.dmp

Filesize
256KB

Download
memory/2608-19-0x00000000735E0000-0x0000000073B8B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-21-0x00000000735E0000-0x0000000073B8B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-23-0x00000000735E0000-0x0000000073B8B000-memory.dmp

Filesize
5.7MB

Download
memory/2608-22-0x0000000002960000-0x00000000029A0000-memory.dmp

Filesize
256KB

Download
memory/2924-10-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2924-121-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2924-71-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2924-38-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2924-133-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2924-134-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2992-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2992-37-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2992-135-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download