f06f770d04152516bd9be7b550bea9039288627636debd6ce4297fdcb3506413

Analysis

max time kernel
152s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2024, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fae9df099c314eae273898d92515fd17.exe
Size

47KB
MD5

fae9df099c314eae273898d92515fd17
SHA1

4238397a25a4698556a228598319447e3cdd5eb5
SHA256

f06f770d04152516bd9be7b550bea9039288627636debd6ce4297fdcb3506413
SHA512

4ebf4ed1a08b341d6bb74984f6404b19dad7c0a28a686902f83ed7d0a07dff03b88cf3a4cbba64692c31cb727f592314b83c8f0f52b440b37851ff7c480675a7
SSDEEP

768:YcxncuMz4CFgHehzvfMbUS5Tg1ousEGdYshJEHPp1jypEH7FsrKTaMkQ7U6p87/d:YcxvMEVHeGH5TgauVGe+JEHPTyp85srz

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe
1516	fae9df099c314eae273898d92515fd17.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1516	fae9df099c314eae273898d92515fd17.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 616	1516	fae9df099c314eae273898d92515fd17.exe	2
PID 1516 wrote to memory of 616	1516	fae9df099c314eae273898d92515fd17.exe	2
PID 1516 wrote to memory of 616	1516	fae9df099c314eae273898d92515fd17.exe	2
PID 1516 wrote to memory of 616	1516	fae9df099c314eae273898d92515fd17.exe	2
PID 1516 wrote to memory of 616	1516	fae9df099c314eae273898d92515fd17.exe	2
PID 1516 wrote to memory of 616	1516	fae9df099c314eae273898d92515fd17.exe	2
PID 1516 wrote to memory of 672	1516	fae9df099c314eae273898d92515fd17.exe	3
PID 1516 wrote to memory of 672	1516	fae9df099c314eae273898d92515fd17.exe	3
PID 1516 wrote to memory of 672	1516	fae9df099c314eae273898d92515fd17.exe	3
PID 1516 wrote to memory of 672	1516	fae9df099c314eae273898d92515fd17.exe	3
PID 1516 wrote to memory of 672	1516	fae9df099c314eae273898d92515fd17.exe	3
PID 1516 wrote to memory of 672	1516	fae9df099c314eae273898d92515fd17.exe	3
PID 1516 wrote to memory of 776	1516	fae9df099c314eae273898d92515fd17.exe	86
PID 1516 wrote to memory of 776	1516	fae9df099c314eae273898d92515fd17.exe	86
PID 1516 wrote to memory of 776	1516	fae9df099c314eae273898d92515fd17.exe	86
PID 1516 wrote to memory of 776	1516	fae9df099c314eae273898d92515fd17.exe	86
PID 1516 wrote to memory of 776	1516	fae9df099c314eae273898d92515fd17.exe	86
PID 1516 wrote to memory of 776	1516	fae9df099c314eae273898d92515fd17.exe	86
PID 1516 wrote to memory of 780	1516	fae9df099c314eae273898d92515fd17.exe	85
PID 1516 wrote to memory of 780	1516	fae9df099c314eae273898d92515fd17.exe	85
PID 1516 wrote to memory of 780	1516	fae9df099c314eae273898d92515fd17.exe	85
PID 1516 wrote to memory of 780	1516	fae9df099c314eae273898d92515fd17.exe	85
PID 1516 wrote to memory of 780	1516	fae9df099c314eae273898d92515fd17.exe	85
PID 1516 wrote to memory of 780	1516	fae9df099c314eae273898d92515fd17.exe	85
PID 1516 wrote to memory of 796	1516	fae9df099c314eae273898d92515fd17.exe	84
PID 1516 wrote to memory of 796	1516	fae9df099c314eae273898d92515fd17.exe	84
PID 1516 wrote to memory of 796	1516	fae9df099c314eae273898d92515fd17.exe	84
PID 1516 wrote to memory of 796	1516	fae9df099c314eae273898d92515fd17.exe	84
PID 1516 wrote to memory of 796	1516	fae9df099c314eae273898d92515fd17.exe	84
PID 1516 wrote to memory of 796	1516	fae9df099c314eae273898d92515fd17.exe	84
PID 1516 wrote to memory of 904	1516	fae9df099c314eae273898d92515fd17.exe	83
PID 1516 wrote to memory of 904	1516	fae9df099c314eae273898d92515fd17.exe	83
PID 1516 wrote to memory of 904	1516	fae9df099c314eae273898d92515fd17.exe	83
PID 1516 wrote to memory of 904	1516	fae9df099c314eae273898d92515fd17.exe	83
PID 1516 wrote to memory of 904	1516	fae9df099c314eae273898d92515fd17.exe	83
PID 1516 wrote to memory of 904	1516	fae9df099c314eae273898d92515fd17.exe	83
PID 1516 wrote to memory of 952	1516	fae9df099c314eae273898d92515fd17.exe	82
PID 1516 wrote to memory of 952	1516	fae9df099c314eae273898d92515fd17.exe	82
PID 1516 wrote to memory of 952	1516	fae9df099c314eae273898d92515fd17.exe	82
PID 1516 wrote to memory of 952	1516	fae9df099c314eae273898d92515fd17.exe	82
PID 1516 wrote to memory of 952	1516	fae9df099c314eae273898d92515fd17.exe	82
PID 1516 wrote to memory of 952	1516	fae9df099c314eae273898d92515fd17.exe	82
PID 1516 wrote to memory of 1016	1516	fae9df099c314eae273898d92515fd17.exe	8
PID 1516 wrote to memory of 1016	1516	fae9df099c314eae273898d92515fd17.exe	8
PID 1516 wrote to memory of 1016	1516	fae9df099c314eae273898d92515fd17.exe	8
PID 1516 wrote to memory of 1016	1516	fae9df099c314eae273898d92515fd17.exe	8
PID 1516 wrote to memory of 1016	1516	fae9df099c314eae273898d92515fd17.exe	8
PID 1516 wrote to memory of 1016	1516	fae9df099c314eae273898d92515fd17.exe	8
PID 1516 wrote to memory of 512	1516	fae9df099c314eae273898d92515fd17.exe	81
PID 1516 wrote to memory of 512	1516	fae9df099c314eae273898d92515fd17.exe	81
PID 1516 wrote to memory of 512	1516	fae9df099c314eae273898d92515fd17.exe	81
PID 1516 wrote to memory of 512	1516	fae9df099c314eae273898d92515fd17.exe	81
PID 1516 wrote to memory of 512	1516	fae9df099c314eae273898d92515fd17.exe	81
PID 1516 wrote to memory of 512	1516	fae9df099c314eae273898d92515fd17.exe	81
PID 1516 wrote to memory of 432	1516	fae9df099c314eae273898d92515fd17.exe	9
PID 1516 wrote to memory of 432	1516	fae9df099c314eae273898d92515fd17.exe	9
PID 1516 wrote to memory of 432	1516	fae9df099c314eae273898d92515fd17.exe	9
PID 1516 wrote to memory of 432	1516	fae9df099c314eae273898d92515fd17.exe	9
PID 1516 wrote to memory of 432	1516	fae9df099c314eae273898d92515fd17.exe	9
PID 1516 wrote to memory of 432	1516	fae9df099c314eae273898d92515fd17.exe	9
PID 1516 wrote to memory of 896	1516	fae9df099c314eae273898d92515fd17.exe	80
PID 1516 wrote to memory of 896	1516	fae9df099c314eae273898d92515fd17.exe	80
PID 1516 wrote to memory of 896	1516	fae9df099c314eae273898d92515fd17.exe	80
PID 1516 wrote to memory of 896	1516	fae9df099c314eae273898d92515fd17.exe	80

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1016
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:780

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1144
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:4224
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2180

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:2116

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2064

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2008

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1904

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1784

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1584

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2944

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4072

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3968

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3672

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3472
- C:\Users\Admin\AppData\Local\Temp\fae9df099c314eae273898d92515fd17.exe
  "C:\Users\Admin\AppData\Local\Temp\fae9df099c314eae273898d92515fd17.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1516

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:4944

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1820

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:2548

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:3828

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:3172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4532

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:2436

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3688

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:4308

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4884

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:4236

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:5112

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4180

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3344

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2956

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2932

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2868

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2484

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2292

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:796
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3904
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1444

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:776

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1516-1-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1516-2-0x0000000077B42000-0x0000000077B43000-memory.dmp

Filesize
4KB

Download
memory/1516-3-0x0000000077B43000-0x0000000077B44000-memory.dmp

Filesize
4KB

Download
memory/1516-4-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/1516-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download