0fc6ed0c9e43593b88d61614e3b17877cf361599862b0659152f4c7cc00fc797

Resubmissions

24/02/2024, 23:51

240224-3whsrsgh5510

24/02/2024, 23:48

240224-3trb5agh437

24/02/2024, 23:40

240224-3n27fagg7510

24/02/2024, 23:38

240224-3mxkkahe917

Analysis

max time kernel
1614s
max time network
1133s
platform
windows10-2004_x64
resource
win10v2004-20240221-de
resource tags

arch:x64arch:x86image:win10v2004-20240221-delocale:de-deos:windows10-2004-x64systemwindows
submitted
24/02/2024, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
459120568.zip
Size 874KB
Sample240224-3n27fagg75
SHA256 0fc6ed0c9e43593b88d61614e3b17877cf361599862b0659152f4c7cc00fc797
MD5 aa330af924e28f830f056e63fc8409e6
SHA1 164461f63c94d5652bd1a56bb51fe256f902529e
SHA512 d080e09f03f184bb54aa0d50ee9fef03d90efb699f21e36942aa6884a98898284eac5194aa060587f61c97a1769a6bef4d0750dae152252f5d93f15f9b7d1951
SSDEEP 12288:EfAN2COO6pe6sYI7NlGAgw/+KSWYZ3xCLk91cIBamKerQ1AWA0YGQXNGsO:EfANLz8e6slpg3ELkLcKQ19A0XUgsO
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008609ca187b67da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000017a581197b67da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087b5dd1a7b67da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-125 = "Microsoft Word Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ec57241c7b67da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c30f2f187b67da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000240bf71b7b67da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\msinfo32.exe,-10001 = "System Information File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003b2604187b67da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db91981a7b67da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006c6b181c7b67da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	1992	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	1992	SearchIndexer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 3084	1992	SearchIndexer.exe	95
PID 1992 wrote to memory of 3084	1992	SearchIndexer.exe	95
PID 1992 wrote to memory of 1124	1992	SearchIndexer.exe	96
PID 1992 wrote to memory of 1124	1992	SearchIndexer.exe	96

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\459120568.zip
1⤵
PID:4244

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2132

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3084
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:1124

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1124-38-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-39-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-40-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-41-0x0000019365A00000-0x0000019365A10000-memory.dmp

Download

memory/1124-42-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-43-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-45-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-44-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-46-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-47-0x0000019365A10000-0x0000019365A11000-memory.dmp

Download

memory/1124-48-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-49-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-53-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-52-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-54-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-57-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-56-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-55-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-51-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-50-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-58-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-59-0x0000019366620000-0x0000019366630000-memory.dmp

Download

memory/1124-60-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-61-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-62-0x0000019366690000-0x00000193666A0000-memory.dmp

Download

memory/1124-63-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-64-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-65-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-68-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-67-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-66-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-69-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-70-0x0000019366690000-0x00000193666A0000-memory.dmp

Download

memory/1124-71-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-75-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-74-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-73-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-78-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-77-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-76-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-72-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-81-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-82-0x0000019366690000-0x00000193666A0000-memory.dmp

Download

memory/1124-85-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-86-0x0000019367D90000-0x0000019367DA0000-memory.dmp

Download

memory/1124-88-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-92-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-93-0x0000019367D90000-0x0000019367DA0000-memory.dmp

Download

memory/1124-99-0x0000019365A10000-0x0000019365A11000-memory.dmp

Download

memory/1124-100-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-101-0x0000019367D90000-0x0000019367DA0000-memory.dmp

Download

memory/1124-107-0x0000019367D90000-0x0000019367DA0000-memory.dmp

Download

memory/1124-106-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-104-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-108-0x0000019366620000-0x0000019366630000-memory.dmp

Download

memory/1124-111-0x0000019366690000-0x00000193666A0000-memory.dmp

Download

memory/1124-112-0x00000193659F0000-0x0000019365A00000-memory.dmp

Download

memory/1124-113-0x0000019366690000-0x00000193666A0000-memory.dmp

Download

memory/1124-114-0x0000019366690000-0x00000193666A0000-memory.dmp

Download

memory/1124-115-0x0000019367D90000-0x0000019367DA0000-memory.dmp

Download

memory/1124-116-0x0000019367D90000-0x0000019367DA0000-memory.dmp

Download

memory/1124-117-0x0000019367D90000-0x0000019367DA0000-memory.dmp

Download

memory/1124-118-0x0000019367D90000-0x0000019367DA0000-memory.dmp

Download

memory/1992-0-0x000001A7359B0000-0x000001A7359C0000-memory.dmp

Download

memory/1992-16-0x000001A735C60000-0x000001A735C70000-memory.dmp

Download

memory/1992-32-0x000001A739FA0000-0x000001A739FA8000-memory.dmp

Download

memory/1992-36-0x000001A73B6E0000-0x000001A73B6E8000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads