fe37c4ba340fd9ebaf3b639cd5a4a356c2adb20e1def2e24af6f6b6ea2542ae0

Analysis

max time kernel
142s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
29/12/2023, 21:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

041f4171d06869ca57d099752e5cc1bf.exe
Size

38KB
MD5

041f4171d06869ca57d099752e5cc1bf
SHA1

023995c6c02f34dcabffd8f79dd333f63ff6a0c5
SHA256

fe37c4ba340fd9ebaf3b639cd5a4a356c2adb20e1def2e24af6f6b6ea2542ae0
SHA512

6664852d478019d0151ff849b4ede766a468cb3bf1784f4ae9afd874ed62a123dcf34025d6b120b5f695508e12626e5c945c4c8dff8c7579de328f9171ff7ec9
SSDEEP

768:xg5idY4WSEcfw/rZ/+rNx4u8RXE4jl/i20SS68d7sHum7soV:x2KY4/3IjZ+sSWFiUSjd7CsoV

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
2828	balloon.exe
2160	load.exe
2488	sysguard.exe

Loads dropped DLL 7 IoCs

pid	Process
2216	041f4171d06869ca57d099752e5cc1bf.exe
2216	041f4171d06869ca57d099752e5cc1bf.exe
2216	041f4171d06869ca57d099752e5cc1bf.exe
2216	041f4171d06869ca57d099752e5cc1bf.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\sysguard = "C:\\Windows\\sysguard.exe"	balloon.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File created	C:\Windows\jungertab.exe	sysguard.exe
File created	C:\Windows\zibaglertz.exe	sysguard.exe
File created	C:\Windows\seeukluba.exe	sysguard.exe
File opened for modification	C:\Windows\sysguard.exe	balloon.exe
File created	C:\Windows\aazalirt.exe	sysguard.exe
File created	C:\Windows\iddqdops.exe	sysguard.exe
File created	C:\Windows\jikglond.exe	sysguard.exe
File created	C:\Windows\jiklagka.exe	sysguard.exe
File created	C:\Windows\sysguard.exe	balloon.exe
File created	C:\Windows\skaaanret.exe	sysguard.exe
File created	C:\Windows\salrtybek.exe	sysguard.exe
File created	C:\Windows\ronitfst.exe	sysguard.exe
File created	C:\Windows\tobmygers.exe	sysguard.exe
File created	C:\Windows\tobykke.exe	sysguard.exe
File created	C:\Windows\klopnidret.exe	sysguard.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process
2852	2160	WerFault.exe

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 00a191e5bc3ada01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f120000000000200000000001066000000010000200000008859bd26550306561554a5e8b67f71f517a132b37bb82c4edf2390c8215066c3000000000e80000000020000200000006e8e10878bc995b76fb340fcb61efcdf6020f06b9a45bb8d693dcc474c5cdb65200000000f108a2cd4220fb992297a8a7f87f2f899b83c1a34e5e2acf801d2043118df5e40000000ec1a2c6dea97f3d8c12a3415bd087bdc6a9eaa42053d34f95aceb90c9bf42d123641fca85b8cafec83807002e58901232b780a7afef7b2e6671ff68dbefa24e0	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "410060431"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000046332ab722508540bf00312f0a24f12000000000020000000000106600000001000020000000ebf324d14176592f8c3e1b36da7a5a066dd8b39da25a863ed0feedc3b2ab9676000000000e8000000002000020000000ad701d8725fb55e1f38b09aa654c34ac00fbeed24441790bcf5b176f046df46a900000004f07dd70bcf678557c2c1a6c24675f9ad3936939653cd5c865cd590f971c800ad7010acfe485a67e1123b90bdc8a04e1f60e18443cc1987e0c9a0d37d90a5efae442b53e992a638e14f417be9b2bd4f7ff96f46716ad080d1104b795b937862846fd40e427cba9aebaf972feb6a6f4048013bb6bdbd526b884a0210bbc5b5ae18513d4de06ba6b27fdbab86b0a8a46d440000000706383ebc186331ee3c79153458f94e08aac3307b35b555333d56ff923f06422393e6802950b63574da8c0713fd88e266302d58601ae482c86fb48865877a657	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{110967A1-A6B0-11EE-A2F4-62ABD1C114F0} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2820	ping.exe
2636	ping.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2540	iexplore.exe
2488	sysguard.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
2488	sysguard.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2540	iexplore.exe
2540	iexplore.exe
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE
1960	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 2828	2216	041f4171d06869ca57d099752e5cc1bf.exe	21
PID 2216 wrote to memory of 2828	2216	041f4171d06869ca57d099752e5cc1bf.exe	21
PID 2216 wrote to memory of 2828	2216	041f4171d06869ca57d099752e5cc1bf.exe	21
PID 2216 wrote to memory of 2828	2216	041f4171d06869ca57d099752e5cc1bf.exe	21
PID 2828 wrote to memory of 2820	2828	balloon.exe	20
PID 2828 wrote to memory of 2820	2828	balloon.exe	20
PID 2828 wrote to memory of 2820	2828	balloon.exe	20
PID 2828 wrote to memory of 2820	2828	balloon.exe	20
PID 2216 wrote to memory of 2160	2216	041f4171d06869ca57d099752e5cc1bf.exe	19
PID 2216 wrote to memory of 2160	2216	041f4171d06869ca57d099752e5cc1bf.exe	19
PID 2216 wrote to memory of 2160	2216	041f4171d06869ca57d099752e5cc1bf.exe	19
PID 2216 wrote to memory of 2160	2216	041f4171d06869ca57d099752e5cc1bf.exe	19
PID 2160 wrote to memory of 2852	2160	load.exe	18
PID 2160 wrote to memory of 2852	2160	load.exe	18
PID 2160 wrote to memory of 2852	2160	load.exe	18
PID 2160 wrote to memory of 2852	2160	load.exe	18
PID 2828 wrote to memory of 2488	2828	balloon.exe	35
PID 2828 wrote to memory of 2488	2828	balloon.exe	35
PID 2828 wrote to memory of 2488	2828	balloon.exe	35
PID 2828 wrote to memory of 2488	2828	balloon.exe	35
PID 2488 wrote to memory of 2636	2488	sysguard.exe	34
PID 2488 wrote to memory of 2636	2488	sysguard.exe	34
PID 2488 wrote to memory of 2636	2488	sysguard.exe	34
PID 2488 wrote to memory of 2636	2488	sysguard.exe	34
PID 2488 wrote to memory of 2540	2488	sysguard.exe	36
PID 2488 wrote to memory of 2540	2488	sysguard.exe	36
PID 2488 wrote to memory of 2540	2488	sysguard.exe	36
PID 2488 wrote to memory of 2540	2488	sysguard.exe	36
PID 2540 wrote to memory of 1960	2540	iexplore.exe	38
PID 2540 wrote to memory of 1960	2540	iexplore.exe	38
PID 2540 wrote to memory of 1960	2540	iexplore.exe	38
PID 2540 wrote to memory of 1960	2540	iexplore.exe	38

C:\Users\Admin\AppData\Local\Temp\041f4171d06869ca57d099752e5cc1bf.exe
"C:\Users\Admin\AppData\Local\Temp\041f4171d06869ca57d099752e5cc1bf.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Users\Admin\AppData\Local\Temp\load.exe
  "C:\Users\Admin\AppData\Local\Temp\load.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2160
- C:\Users\Admin\AppData\Local\Temp\balloon.exe
  "C:\Users\Admin\AppData\Local\Temp\balloon.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\sysguard.exe
    "C:\Windows\sysguard.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2488
  - - C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://sp-protect2009.com/?r=5
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2540
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2540 CREDAT:275457 /prefetch:2
        5⤵
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        
        PID:1960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2160 -s 36
1⤵
- Loads dropped DLL
- Program crash
PID:2852

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
1⤵
- Runs ping.exe
PID:2820

C:\Windows\SysWOW64\ping.exe
ping 127.0.0.1
1⤵
- Runs ping.exe
PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8409fe31d391e69906abd6bcc8546daf

SHA1
6fb06bf818b604b296c3fa73c14be07faca7a68e

SHA256
6a5e4a126c71c9f9b50e8dbb115851417b8a3c5a15be7ec475fce68c28380e28

SHA512
32b3212bac129ad90ea89b0421caf366bde3bdb681c40e7430ddca5e2d98920774abeb7d4477ba66b993718a5ac7a4abed0932bfb0b9d2b7515b127fba107f65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
cd29e72bd2729c17270c5199aba50417

SHA1
2551c4b1e0047b26a1f16b11629f23fd7c3b6773

SHA256
d918123c1cf669e467510285ee10bed7f776bf09b51c71b3e3d98e3164c06030

SHA512
0e46476a17155f8c70ecd83f5140bcf6f0125f0ac28f03b3a9a10a9ac13a779607bb613ce9f8abba01f06e405e778a719ea8fa34e169a72401628bc261468226

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
579b7a07c0b6d12820721c16501e376d

SHA1
3ff0a744d92020b8892208d914d12859f7166ef2

SHA256
a5a9852a28ac1d4b0705231cd21a64f38bee7d0eb8774ea2963035936c89e9c6

SHA512
8915503e0763ff5a9ca426d1f33845d090283934a42bb1a0df9926d6d443679069a4a72eec0af3b01e448f15800db6ef3248de857cc3cfe56786df2160e1e13d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
eedbc9dd01cadc53ca0ef97ab407a3d6

SHA1
8f3fb586be0460a3564fc9c24512f29843176133

SHA256
018c27d6c60aa9072af9df4c975d93b1a3f2057fdea1486d52633c5af577b5a3

SHA512
3eae80a649eb65f58364473d70411623263f2f390a44a2c573ec57ada469825a640e2d64c8cc9dd55a6a4e1869163adf3390c9045198f1f247057ece0cbd74e3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
81699a57765756dd721ef58c3aabc6e4

SHA1
460e307d3d7fa36fc4274e14ae3c4985e70279b8

SHA256
6065bd1bc8bd4299b2eb49a3e1a9c21d6f2e2c235af9d7f57d13e3c67f3b58c1

SHA512
b4eeb70b364d8cb923ec17fbd541c8db09912fa02263bacdac390257fd39ac6d9ed2fd580724a4e4b7459f4baa28d4fd1129d929b9148af1f7ad81f0a4a7d480

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d8403398e670154af721e6b52714800e

SHA1
27152de8b5e5712792ecc3ccb033839ce5c95ba8

SHA256
4a2d73f4088aa13e290da659224d284be3c775f538168d7715c87e9201283592

SHA512
929fec50e813aa1d396d2b90e3959ba9a328ad9acc19b423bb6598885046ed2fe23ea3466bf549b9296a86b04b1b6b2e59a2d623cd96b213f9740fdb1c5c54ed

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d2e71524684398b82e791efda0fba3fa

SHA1
0d46ecb95fbd496b3da9d8305ae3956dbf963014

SHA256
cbc9ed2763b39b2476e3a27d3f58da255f233d9a22f182cd01e57bbcacc78ebf

SHA512
226414fcac5081db7d4ea95c879e1d9b60dfb967248bafa3be9d7d90b8569d004a1cd37fcd8c99fa9bf8798211da028f01b3cc67a27b4bd4ca6141f0a822e33b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ceca05f516028f4c04b2e76ab6b6dae6

SHA1
7324741257942ef03e1a84aee76b752564112a65

SHA256
87b6c9c545f6cc7dc27507fcb2eb95bb4909347a7e1fcd4d0ea2f0c9975601db

SHA512
34e235659f540bd141cd2941b0580f64fc5a89a175e8060fbb7e0a5d60ef1069735f1940fa3ca585d1542e5c12d6350e0c9c232c2728898d9cba2c655264294a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
ad85dfc2587de234ae65d0fba56aabbd

SHA1
80c39c386236c04ed0dfa7a146039793ed8ae15b

SHA256
0f9f22b4ea36f8b1c9e7aff8ffa09c500f9e6a8f84d512062cd189344953e25f

SHA512
90ce3232c34993d0acbf194e2bbeef705c46edf411ebcdaea0de9deacd28230670c83f81f1efc2e5e6d1e97f06e2671fa0e39072d423b298d1a4d6526a49d46c

Download Submit
memory/2216-0-0x0000000000400000-0x0000000000411200-memory.dmp

Filesize
68KB

Download
memory/2216-31-0x0000000000400000-0x0000000000411200-memory.dmp

Filesize
68KB

Download
memory/2488-42-0x00000000001B0000-0x00000000001B5000-memory.dmp

Filesize
20KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads