ardamax | 22b38ee022a7e7e2f55626a236607ce1985dcb049980802216eddce095842e25

Analysis

max time kernel
142s
max time network
123s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2381438830c9dea5950abda8fa2cf4d.exe
Size 1.1MB
Sample240107-x2jpcsdca3
SHA256 22b38ee022a7e7e2f55626a236607ce1985dcb049980802216eddce095842e25
MD5 a2381438830c9dea5950abda8fa2cf4d
SHA1 bb97b90003d7ec0e7598b26ff6723b57a8c7ede8
SHA512 37aac29d987e59030f47df263fa4dd3d3dfbab0963b134457cb8b38b45c893fa3d7913f0d8b7e167de73a93f951fd5532f013467e972fe50bff06372318ae157
SSDEEP 24576:FZjyFYRX2KMA9xU2QQ6RAC+UDT3tOSsqW8bSVW5:FEuxca7cRAC+UX3tKqBSc5
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

ardamax discovery keylogger stealer

Malware Config

Signatures

Ardamax
A keylogger first seen in 2013.
keylogger stealer ardamax

Ardamax main executable 1 IoCs

resource	yara_rule
behavioral1/files/0x0006000000015c6f-40.dat	family_ardamax

Executes dropped EXE 2 IoCs

pid	Process
2752	Olly.exe
2548	CJPO.exe

Loads dropped DLL 14 IoCs

pid	Process
2760	cmd.exe
2760	cmd.exe
2752	Olly.exe
2752	Olly.exe
2752	Olly.exe
2752	Olly.exe
2548	CJPO.exe
2548	CJPO.exe
2548	CJPO.exe
2760	cmd.exe
268	DllHost.exe
2752	Olly.exe
2548	CJPO.exe
268	DllHost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\28463	CJPO.exe
File created	C:\Windows\SysWOW64\28463\CJPO.001	Olly.exe
File created	C:\Windows\SysWOW64\28463\CJPO.006	Olly.exe
File created	C:\Windows\SysWOW64\28463\CJPO.007	Olly.exe
File created	C:\Windows\SysWOW64\28463\CJPO.exe	Olly.exe
File created	C:\Windows\SysWOW64\28463\key.bin	Olly.exe
File created	C:\Windows\SysWOW64\28463\AKV.exe	Olly.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\0\win32\	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\ProgID	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\0\win32	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\FLAGS\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\FLAGS\ = "4"	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\TypeLib	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\Version	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\Version\	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\InprocServer32	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\HELPDIR	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\"	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\TypeLib\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\TypeLib\ = "{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}"	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\ = "Erikohmoj.Anejidiv.Zibofal class"	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\0\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\Version\ = "1.0"	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\0	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\ = "Groove OutlookUtil Private 1.0 Type Library"	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\HELPDIR\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\InprocServer32\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\ProgID\	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\ProgID\ = "LDAPNamespace"	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\0\win32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\GROOVE.EXE\\17"	CJPO.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C67F217-8D5E-F641-C1C6-534E6F62C0D3}\1.0\FLAGS	CJPO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CB964463-B286-4AE6-9385-3FB35AA23C58}\InprocServer32\ = "%SystemRoot%\\SysWow64\\adsldp.dll"	CJPO.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2028	a2381438830c9dea5950abda8fa2cf4d.exe
Token: SeBackupPrivilege	2028	a2381438830c9dea5950abda8fa2cf4d.exe
Token: 33	2548	CJPO.exe
Token: SeIncBasePriorityPrivilege	2548	CJPO.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
268	DllHost.exe
268	DllHost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2548	CJPO.exe
2548	CJPO.exe
2548	CJPO.exe
2548	CJPO.exe
2548	CJPO.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 2760	2028	a2381438830c9dea5950abda8fa2cf4d.exe	28
PID 2028 wrote to memory of 2760	2028	a2381438830c9dea5950abda8fa2cf4d.exe	28
PID 2028 wrote to memory of 2760	2028	a2381438830c9dea5950abda8fa2cf4d.exe	28
PID 2028 wrote to memory of 2760	2028	a2381438830c9dea5950abda8fa2cf4d.exe	28
PID 2028 wrote to memory of 2760	2028	a2381438830c9dea5950abda8fa2cf4d.exe	28
PID 2028 wrote to memory of 2760	2028	a2381438830c9dea5950abda8fa2cf4d.exe	28
PID 2028 wrote to memory of 2760	2028	a2381438830c9dea5950abda8fa2cf4d.exe	28
PID 2760 wrote to memory of 2752	2760	cmd.exe	30
PID 2760 wrote to memory of 2752	2760	cmd.exe	30
PID 2760 wrote to memory of 2752	2760	cmd.exe	30
PID 2760 wrote to memory of 2752	2760	cmd.exe	30
PID 2760 wrote to memory of 2752	2760	cmd.exe	30
PID 2760 wrote to memory of 2752	2760	cmd.exe	30
PID 2760 wrote to memory of 2752	2760	cmd.exe	30
PID 2752 wrote to memory of 2548	2752	Olly.exe	31
PID 2752 wrote to memory of 2548	2752	Olly.exe	31
PID 2752 wrote to memory of 2548	2752	Olly.exe	31
PID 2752 wrote to memory of 2548	2752	Olly.exe	31
PID 2752 wrote to memory of 2548	2752	Olly.exe	31
PID 2752 wrote to memory of 2548	2752	Olly.exe	31
PID 2752 wrote to memory of 2548	2752	Olly.exe	31

C:\Users\Admin\AppData\Local\Temp\a2381438830c9dea5950abda8fa2cf4d.exe
"C:\Users\Admin\AppData\Local\Temp\a2381438830c9dea5950abda8fa2cf4d.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Arquivos de programas\jk.bat" "
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2760
- - C:\Arquivos de programas\Olly.exe
    Olly.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in System32 directory
    - Suspicious use of WriteProcessMemory
    PID:2752
  - - C:\Windows\SysWOW64\28463\CJPO.exe
      "C:\Windows\system32\28463\CJPO.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2548

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4.jpeg

Path C:\Arquivos de programas\4.jpeg
Size 172KB
SHA256 5e6e70d3d38ef9307f402cbc8f9c16e10c6e170a568d29e8804d933f4d29193f
MD5 c0351960ce0aa29da4f918149d3cfe3f
SHA1 74a4e1babf879f0d2fb731d77ef114e4b058e4ab
SHA512 46da503e98b560c3d89789fee24248df2b5e8d7a1c4f5846752d5d59e8972b8ff43160c22addb27578959354c3898a9c57609342b01082aefaf1bcef2b72af74
SSDEEP 3072:zkver6MNDnjYdVyJJ4HDFSI9qUvqVddaZQ1cHCGcAtzB61J2nV8m7H+++P7w:hZnjdJ4HxSsPoddaZ5HCF8MLiZH+++c
MD5 SHA1 SHA512 SSDEEP

Submit Download

jk.bat

Path C:\Arquivos de programas\jk.bat
Size 28B
SHA256 357424002bbaea2ca847158c4b42bc90860013a04c2178f729f55f626b7a58cb
MD5 fb2ad654057a9889563decebd169baf6
SHA1 eb0eef6aad39e529bc4742bcad615f8f7980e657
SHA512 6512fe8c0ff2b32d6aa571ae9350603f35ccaa7283f3c6a843e47320ff191de7b8c5755a5ea71562aacc596e65f4d6c023a7540af6d54b981a0379993008e265
MD5 SHA1 SHA512

Submit Download

1.JPG

Path C:\Users\Admin\AppData\Local\Temp\1.JPG
Size 125KB
SHA256 b4236ddd0e86537d15455f5ce484831b2769c40abe8179ae1d3c92a60844a8df
MD5 37716e966bbf128f2841a8f7e9f8bba7
SHA1 9cf1abfb1ac3ad3abaef63d60491e3d76e30d1df
SHA512 7ed560de9d813294e3ed72dbaefe445af29e2550446afad088b36cb0876bb356eb897dea1d860efaca582adc039a24841e8e44af83657cf9fdfdf6961aa9b70f
SSDEEP 3072:FgXHNYq2mkX5UdlXdCh6NnPoFJpj28IIijDOo+++VfW:FKHb2mkmd5dCh6hoFJk8Iuo+++I
MD5 SHA1 SHA512 SSDEEP

Submit Download

AKV.exe

Path C:\Windows\SysWOW64\28463\AKV.exe
Size 457KB
SHA256 02b8379b1838ea70f7f17e0785aaaedb7c721d9b6e262577723bba9492748d0c
MD5 828586f5f9fd7e6bd99401fe7cece954
SHA1 8eb70f4af2cec3c3dd3ec1491913369e99b7b874
SHA512 16b64be59cf9ae403fb3b7e1fc8da98cb2a5db84aef0e352910172796ecf96dcf86a7e16afe78fa7e22b7b6948e8a1fa027da7161d5a0ad98e76175d764ed6a7
SSDEEP 6144:glgwmKd9EEU8Gk9gPD2XlL5YctZx65KSpNceZ/TyGLTz/GVfC1HK:XJEUpkWPD2XlFYct2ouNceNTLC
MD5 SHA1 SHA512 SSDEEP

Submit Download

CJPO.001

Path C:\Windows\SysWOW64\28463\CJPO.001
Size 298B
SHA256 5c34c5d27a2e44ad9398d1f30988701300687a9c4d4d9adb97866e1a3456423e
MD5 d945741b753dc8c65bc3e23811a7de74
SHA1 43b5a06ec39bea29a21e89da8ec8f555ca59f5af
SHA512 410bc2dd4394c9a07572ecb065a2ec189d505e23890328ef5301bb20381bc3e100393da05b6909f0b3e9f54b96df5b1413f4a5d74ec06d2b7c8d1870a6f4c479
MD5 SHA1 SHA512

Submit Download

CJPO.006

Path C:\Windows\SysWOW64\28463\CJPO.006
Size 8KB
SHA256 984da5476c2c69a779bc99d0901569347cc605a36499e2284706cda3ed6e13f3
MD5 69db8c925f2dd8136d956a086ed1ee41
SHA1 9d0f653cc7ab881eb45fe93490a9c096f2dec6cf
SHA512 fa5cedd539dca3631511488aea8bcb7821db1d53452c1b61ee663cb5700bb9919b092593a7f5eb7a3c3a75f801b2980f817de4a66bf8aa51093ced4b30ffd068
SSDEEP 192:DVdg5cxPjOhoZHOiX+/yWDpQzWXmM1DOcQ68OIy:o5cpOhSuK+/ynMmQfQhO
MD5 SHA1 SHA512 SSDEEP

Submit Download

CJPO.007

Path C:\Windows\SysWOW64\28463\CJPO.007
Size 5KB
SHA256 94f6502a4e94de0301ae07befd63767a4de35d9b2d2d00687a3130e883ab1963
MD5 9e9da4c851850726c789bb4b94a41bb3
SHA1 1e2fd71f1d1a3ac15d3c820d8459635cd775cf24
SHA512 4c60e951056c5773d769a9c88245fc4a597949deb72a1a7546991488e85ffc4ff2a34840ad227595bcdc105cf187207721b57c457ac832ee0159dd0e1d9be063
SSDEEP 48:6RsQzi+o80EE/KD4XJQK5Gaayko1vmiXdjAECihnm8mMWqlo0P:6Rx/DMWaavoFRNsECi9mbqlo
MD5 SHA1 SHA512 SSDEEP

Submit Download

key.bin

Path C:\Windows\SysWOW64\28463\key.bin
Size 106B
SHA256 fc42ab050ffdfed8c8c7aac6d7e4a7cad4696218433f7ca327bcfdf9f318ac98
MD5 639d75ab6799987dff4f0cf79fa70c76
SHA1 be2678476d07f78bb81e8813c9ee2bfff7cc7efb
SHA512 4b511d0330d7204af948ce7b15615d745e8d4ea0a73bbece4e00fb23ba2635dd99e4fa54a76236d6f74bdbcdba57d32fd4c36b608d52628e72d11d5ed6f8cde2
MD5 SHA1 SHA512

Submit Download

Olly.exe

Path \Arquivos de programas\Olly.exe
Size 896KB
SHA256 d56f1f993340b9cf299273eddd4aa5270fbb4cc8422d870d470b45b63bc4a431
MD5 a4123ae48cffd1eeb6881cdcb3edae9d
SHA1 b368043362d7ccd4065e4ef78639bfd9ac3f7905
SHA512 b22fca4e1cebd02197892ad84f3d2bef0c4802d779ef3bbd3a0ac4d4177814c8936ed3a8b7150ed281a036bb16f7a3e28ce384d698b4821207252ac155bf85bd
SSDEEP 24576:SFJEL991DvhoKD+2RtpvxBH7oCLABjkiRDh:XrLNRxxpL43
MD5 SHA1 SHA512 SSDEEP

Submit Download

@7D4B.tmp

Path \Users\Admin\AppData\Local\Temp\@7D4B.tmp
Size 4KB
SHA256 4c9cca81f2f2d91b636c0ec747e96821749788368c48981bf04accfeb5c2e5d0
MD5 ccf39f70a662f70e7cae4cfc81255c44
SHA1 00177d41252c2a5322be8e54567a845217072e2c
SHA512 2cc006d3bd6af737f31707b457caaa267ee1361cfd0afab0be8b74be8587d02b20909962d138e137fe79252e0d112bd3be091a98ba50863520b5bbf21bb9501d
MD5 SHA1 SHA512

Submit Download

CJPO.exe

Path \Windows\SysWOW64\28463\CJPO.exe
Size 648KB
SHA256 0ca27dfe22971bfb19c7f3d6fe03cd398816a88fc50943ba9821fa6b91be7807
MD5 c5ca2c96edc99cf9edf0f861d784209a
SHA1 6cb654b3eb20c85224a4849c4cc30012cabbdbaa
SHA512 aeb36bbbf68c7b733ddd856f8f0cdd9548ff597843a22611757c98f69a589035410fecfa692bb83c740823ddae6432d3be5cb66f4309a9d0f5fedeb7b017ff36
SSDEEP 12288:rzS0sq3PvAeaN99CE0iIE/uPq6xGJOpqeRypiI3no+dA:rzp4R999/V0GkpgpvnvS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/268-87-0x0000000000200000-0x0000000000202000-memory.dmp

Download

memory/2028-51-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/2548-84-0x00000000024B0000-0x00000000024B1000-memory.dmp

Download

memory/2548-99-0x0000000003330000-0x0000000003331000-memory.dmp

Download

memory/2548-61-0x00000000031E0000-0x00000000031E3000-memory.dmp

Download

memory/2548-126-0x0000000000970000-0x00000000009CA000-memory.dmp

Download

memory/2548-81-0x00000000001F0000-0x00000000001F1000-memory.dmp

Download

memory/2548-82-0x00000000005C0000-0x00000000005C1000-memory.dmp

Download

memory/2548-57-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

memory/2548-89-0x0000000003280000-0x0000000003281000-memory.dmp

Download

memory/2548-86-0x0000000002610000-0x0000000002611000-memory.dmp

Download

memory/2548-52-0x00000000009E0000-0x0000000000ABF000-memory.dmp

Download

memory/2548-91-0x00000000032A0000-0x00000000032A1000-memory.dmp

Download

memory/2548-93-0x00000000032C0000-0x00000000032C1000-memory.dmp

Download

memory/2548-95-0x00000000032E0000-0x00000000032E1000-memory.dmp

Download

memory/2548-97-0x0000000003310000-0x0000000003311000-memory.dmp

Download

memory/2548-101-0x0000000003350000-0x0000000003351000-memory.dmp

Download

memory/2548-59-0x0000000000970000-0x00000000009CA000-memory.dmp

Download

memory/2548-124-0x00000000009E0000-0x0000000000ABF000-memory.dmp

Download

memory/2548-104-0x0000000003390000-0x0000000003391000-memory.dmp

Download

memory/2548-103-0x0000000003370000-0x0000000003371000-memory.dmp

Download

memory/2548-105-0x00000000033B0000-0x00000000033B1000-memory.dmp

Download

memory/2548-106-0x00000000033D0000-0x00000000033D1000-memory.dmp

Download

memory/2548-123-0x00000000009E0000-0x0000000000ABF000-memory.dmp

Download

memory/2548-45-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

memory/2548-122-0x0000000000400000-0x00000000004DF000-memory.dmp

Download

memory/2752-23-0x0000000000020000-0x0000000000028000-memory.dmp

Download

memory/2752-118-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2752-26-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2752-44-0x00000000025D0000-0x00000000026AF000-memory.dmp

Download

memory/2752-80-0x0000000000530000-0x0000000000532000-memory.dmp

Download

memory/2760-19-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2760-16-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/2760-102-0x0000000000400000-0x0000000000402000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads