zebrocy | 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105

General

Target

444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
Size

978KB
MD5

34371c7833c38fa441316f238961d9a2
SHA1

74e99094f77642ef2d803188121a9c61e73139fe
SHA256

444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105
SHA512

aba20341168f6f78cecb302c1544ad617a6dc4d5e081cb3ffbcfe0e67c9a5708ce7e9d264de78eb620c3acea19cf37789f25a48dbb080ed16542ccc4b780386a
SSDEEP

24576:VoyOrimyU/MAYycTwgadEhiU8BnM4XkEJ:CNyU/LYyQwdU8RkE

Score

10^/10

zebrocy backdoor spyware stealer trojan upx

Malware Config

Signatures

Zebrocy
Zebrocy is a backdoor created by Sofacy threat group and has multiple variants developed in different languages.
trojan backdoor zebrocy

Zebrocy Go Variant 14 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2436-1-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-2-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-3-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-4-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-5-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-56-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-1303-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-2873-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-2903-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-4244-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-5735-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-7397-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-8366-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy
behavioral1/memory/2436-8422-0x0000000000400000-0x00000000007A7000-memory.dmp	Zebrocy

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2436-0-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-1-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-2-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-3-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-4-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-5-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-56-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-1303-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-2873-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-2903-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-4244-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-5735-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-7397-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-8366-0x0000000000400000-0x00000000007A7000-memory.dmp	upx
behavioral1/memory/2436-8422-0x0000000000400000-0x00000000007A7000-memory.dmp	upx

Drops desktop.ini file(s) 4 IoCs

Processes:

444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe

Drops file in Program Files directory 64 IoCs

Processes:

444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0299125.WMF	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\MSPUB.DEV_F_COL.HXK	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR43F.GIF	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SLERROR.XML	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\logging.properties	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\1423861240811.profile.gz	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\Discussion14.gta	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BORDERBB.DPV	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\flyout.html	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Uzhgorod	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\locale\org-openide-modules_ja.jar	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\24.png	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\modules\common.luac	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\THMBNAIL.PNG	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\OCEAN_01.MID	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue.css	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis.css	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Budapest	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore.xmi_2.10.1.v20140901-1043.jar	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\css\settings.css	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jre7\lib\security\blacklist	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPrintTemplateRTL.html	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.zh_CN_5.5.0.165303.jar	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.beans_1.2.200.v20140214-0004.jar	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jre7\lib\cmm\GRAY.pf	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\32.png	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\telnet.luac	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\PREVIEW.GIF	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00656_.WMF	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14583_.GIF	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME26.CSS	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\GrayCheck\HEADER.GIF	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\settings.html	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\Status Report.fdt	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107528.WMF	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Median.eftx	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV_COL.HXC	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\CSS7DATA0009.DLL	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\AdjacencyResume.dotx	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_rest.png	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-masterfs.xml	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\Documentation.url	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Araguaina	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Bogota	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Mozilla Firefox\dependentlibs.list	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse.nl_ja_4.4.0.v20140623020002.jar	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_COL.HXT	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_few-showers.png	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views.nl_zh_4.4.0.v20140623020002.jar	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Goose_Bay	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR24F.GIF	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe

pid process

2436 444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

vssvc.exe

description pid process

Token: SeBackupPrivilege 3048 vssvc.exe
Token: SeRestorePrivilege 3048 vssvc.exe
Token: SeAuditPrivilege 3048 vssvc.exe
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

pid	process
2436	444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe

description	pid	process
Token: SeBackupPrivilege	3048	vssvc.exe
Token: SeRestorePrivilege	3048	vssvc.exe
Token: SeAuditPrivilege	3048	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe
"C:\Users\Admin\AppData\Local\Temp\444b77c224199fbcb8e1241f999ea02b68e5cee7d74f262c160ae45d85cf1105.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2436

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

1

T1552

Credentials In Files

1

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2436-0-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-1-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-2-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-3-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-4-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-5-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-56-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-1303-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-2873-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-2903-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-4244-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-5735-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-7397-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-8366-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download
memory/2436-8422-0x0000000000400000-0x00000000007A7000-memory.dmp

Filesize
3.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads