bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa

Resubmissions

24-02-2024 01:30

240224-bw9spsef3x 6

24-02-2024 01:27

240224-bt4hxaee6y 1

Analysis

max time kernel
138s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24-02-2024 01:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fnuuy.zip
Size

41KB
MD5

1df9a18b18332f153918030b7b516615
SHA1

6c42c62696616b72bbfc88a4be4ead57aa7bc503
SHA256

bbd05de19aa2af1455c0494639215898a15286d9b05073b6c4817fe24b2c36fa
SHA512

6382ca9c307d66ab7566acf78b1afd44b18b24d766253e1dc1cb3a3c0be96ecf1f2042d6bd3332d49078ffee571cf98869c1284c1d3e5c1c7dc3e4c64f71af80
SSDEEP

768:hzyVr8GSKL6O3QOXk/0u3wqOghrFCezL1VFJdbq2QTJTw02Q:hGx8DKXE//ZhhCirFi2cwK

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a7dffec3c066da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9925 = "MP3 Format Sound"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fd28c4c2c066da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003e00dcc2c066da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000158280c3c066da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e90e4cc3c066da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000003344c3c3c066da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9936 = "QuickTime Movie"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000198fbc4c066da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008af4d3c3c066da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c96cabc3c066da01	SearchProtocolHost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	5188	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5188	SearchIndexer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5188 wrote to memory of 668	5188	SearchIndexer.exe	101
PID 5188 wrote to memory of 668	5188	SearchIndexer.exe	101
PID 5188 wrote to memory of 6108	5188	SearchIndexer.exe	102
PID 5188 wrote to memory of 6108	5188	SearchIndexer.exe	102

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\fnuuy.zip
1⤵
PID:4536

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4596

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5188
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:668
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788
  2⤵
  - Modifies data under HKEY_USERS
  PID:6108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5188-0-0x000001DD03130000-0x000001DD03140000-memory.dmp

Filesize
64KB

Download
memory/5188-16-0x000001DD03230000-0x000001DD03240000-memory.dmp

Filesize
64KB

Download
memory/5188-32-0x000001DD07720000-0x000001DD07728000-memory.dmp

Filesize
32KB

Download
memory/5188-36-0x000001DD08E20000-0x000001DD08E28000-memory.dmp

Filesize
32KB

Download
memory/6108-38-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-39-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-40-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-41-0x000001DAE7A50000-0x000001DAE7A60000-memory.dmp

Filesize
64KB

Download
memory/6108-42-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-43-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-45-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-44-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-54-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-55-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-53-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-56-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-52-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-51-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-50-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-49-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-48-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-47-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-46-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-57-0x000001DAE7A80000-0x000001DAE7A81000-memory.dmp

Filesize
4KB

Download
memory/6108-58-0x000001DAE7AA0000-0x000001DAE7AB0000-memory.dmp

Filesize
64KB

Download
memory/6108-59-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-63-0x000001DAE7AB0000-0x000001DAE7AC0000-memory.dmp

Filesize
64KB

Download
memory/6108-66-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-65-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-64-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-62-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-61-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-60-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-67-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-68-0x000001DAE7AB0000-0x000001DAE7AC0000-memory.dmp

Filesize
64KB

Download
memory/6108-69-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-70-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-73-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-74-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-72-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-71-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-75-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-77-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-76-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-80-0x000001DAE7A30000-0x000001DAE7A40000-memory.dmp

Filesize
64KB

Download
memory/6108-81-0x000001DAE7A80000-0x000001DAE7A81000-memory.dmp

Filesize
4KB

Download
memory/6108-82-0x000001DAE7AA0000-0x000001DAE7AB0000-memory.dmp

Filesize
64KB

Download
memory/6108-83-0x000001DAE7AB0000-0x000001DAE7AC0000-memory.dmp

Filesize
64KB

Download
memory/6108-84-0x000001DAE7AB0000-0x000001DAE7AC0000-memory.dmp

Filesize
64KB

Download
memory/6108-85-0x000001DAE7AB0000-0x000001DAE7AC0000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads