8f2dad334e7d146f5f68b839b449976033fc9b8e4e233bce4f2c2032ad41b6e3

Analysis

max time kernel
153s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 19:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c16723e4a57711813e198a40582ac7be.exe
Size

956KB
MD5

c16723e4a57711813e198a40582ac7be
SHA1

ca5409bb26dbaa4bc7396b2e81adb734fc60ccf9
SHA256

8f2dad334e7d146f5f68b839b449976033fc9b8e4e233bce4f2c2032ad41b6e3
SHA512

e86158fa87caa904d30b36745da2ba7b70f555c9a218d68aafdc6f5b024999d817b03bfaaea66155413a1fd3b38b79ef760988eeed47b6a3773cd794ab9108f9
SSDEEP

24576:8NdWWi1OHS0R4bYiwYrZ+YPFnUm1Y2A9Q9JNds6syh:8NdtOeS06bpcYNUmm2A69JN66th

Score

10^/10

bootkit evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\z607g2ssn.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe

Adds policy Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run	z607g2ssn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Microsoft Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe"	z607g2ssn.exe

Modifies Installed Components in the registry 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDD5C9BA-F948-4C9D-9D7B-D8DE4E08A3CA}	z607g2ssn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FDD5C9BA-F948-4C9D-9D7B-D8DE4E08A3CA}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe"	z607g2ssn.exe
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FDD5C9BA-F948-4C9D-9D7B-D8DE4E08A3CA}	z607g2ssn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{FDD5C9BA-F948-4C9D-9D7B-D8DE4E08A3CA}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe"	z607g2ssn.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	c16723e4a57711813e198a40582ac7be.exe

Executes dropped EXE 3 IoCs

pid	Process
4840	z607g2ssn.exe
3896	z607g2ssn.exe
1712	z607g2ssn.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe"	z607g2ssn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Update = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\svchost.exe"	z607g2ssn.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	c16723e4a57711813e198a40582ac7be.exe
File opened for modification	\??\PhysicalDrive0	z607g2ssn.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2748 set thread context of 4444	2748	c16723e4a57711813e198a40582ac7be.exe	97
PID 4840 set thread context of 3896	4840	z607g2ssn.exe	103
PID 3896 set thread context of 1712	3896	z607g2ssn.exe	105

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
3620	reg.exe
4192	reg.exe
3436	reg.exe
372	reg.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: 1	1712	z607g2ssn.exe
Token: SeCreateTokenPrivilege	1712	z607g2ssn.exe
Token: SeAssignPrimaryTokenPrivilege	1712	z607g2ssn.exe
Token: SeLockMemoryPrivilege	1712	z607g2ssn.exe
Token: SeIncreaseQuotaPrivilege	1712	z607g2ssn.exe
Token: SeMachineAccountPrivilege	1712	z607g2ssn.exe
Token: SeTcbPrivilege	1712	z607g2ssn.exe
Token: SeSecurityPrivilege	1712	z607g2ssn.exe
Token: SeTakeOwnershipPrivilege	1712	z607g2ssn.exe
Token: SeLoadDriverPrivilege	1712	z607g2ssn.exe
Token: SeSystemProfilePrivilege	1712	z607g2ssn.exe
Token: SeSystemtimePrivilege	1712	z607g2ssn.exe
Token: SeProfSingleProcessPrivilege	1712	z607g2ssn.exe
Token: SeIncBasePriorityPrivilege	1712	z607g2ssn.exe
Token: SeCreatePagefilePrivilege	1712	z607g2ssn.exe
Token: SeCreatePermanentPrivilege	1712	z607g2ssn.exe
Token: SeBackupPrivilege	1712	z607g2ssn.exe
Token: SeRestorePrivilege	1712	z607g2ssn.exe
Token: SeShutdownPrivilege	1712	z607g2ssn.exe
Token: SeDebugPrivilege	1712	z607g2ssn.exe
Token: SeAuditPrivilege	1712	z607g2ssn.exe
Token: SeSystemEnvironmentPrivilege	1712	z607g2ssn.exe
Token: SeChangeNotifyPrivilege	1712	z607g2ssn.exe
Token: SeRemoteShutdownPrivilege	1712	z607g2ssn.exe
Token: SeUndockPrivilege	1712	z607g2ssn.exe
Token: SeSyncAgentPrivilege	1712	z607g2ssn.exe
Token: SeEnableDelegationPrivilege	1712	z607g2ssn.exe
Token: SeManageVolumePrivilege	1712	z607g2ssn.exe
Token: SeImpersonatePrivilege	1712	z607g2ssn.exe
Token: SeCreateGlobalPrivilege	1712	z607g2ssn.exe
Token: 31	1712	z607g2ssn.exe
Token: 32	1712	z607g2ssn.exe
Token: 33	1712	z607g2ssn.exe
Token: 34	1712	z607g2ssn.exe
Token: 35	1712	z607g2ssn.exe
Token: SeDebugPrivilege	1712	z607g2ssn.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2748	c16723e4a57711813e198a40582ac7be.exe
4444	c16723e4a57711813e198a40582ac7be.exe
4840	z607g2ssn.exe
3896	z607g2ssn.exe
1712	z607g2ssn.exe
1712	z607g2ssn.exe
1712	z607g2ssn.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 4444	2748	c16723e4a57711813e198a40582ac7be.exe	97
PID 2748 wrote to memory of 4444	2748	c16723e4a57711813e198a40582ac7be.exe	97
PID 2748 wrote to memory of 4444	2748	c16723e4a57711813e198a40582ac7be.exe	97
PID 2748 wrote to memory of 4444	2748	c16723e4a57711813e198a40582ac7be.exe	97
PID 2748 wrote to memory of 4444	2748	c16723e4a57711813e198a40582ac7be.exe	97
PID 2748 wrote to memory of 4444	2748	c16723e4a57711813e198a40582ac7be.exe	97
PID 2748 wrote to memory of 4444	2748	c16723e4a57711813e198a40582ac7be.exe	97
PID 2748 wrote to memory of 4444	2748	c16723e4a57711813e198a40582ac7be.exe	97
PID 4444 wrote to memory of 4840	4444	c16723e4a57711813e198a40582ac7be.exe	100
PID 4444 wrote to memory of 4840	4444	c16723e4a57711813e198a40582ac7be.exe	100
PID 4444 wrote to memory of 4840	4444	c16723e4a57711813e198a40582ac7be.exe	100
PID 4840 wrote to memory of 3896	4840	z607g2ssn.exe	103
PID 4840 wrote to memory of 3896	4840	z607g2ssn.exe	103
PID 4840 wrote to memory of 3896	4840	z607g2ssn.exe	103
PID 4840 wrote to memory of 3896	4840	z607g2ssn.exe	103
PID 4840 wrote to memory of 3896	4840	z607g2ssn.exe	103
PID 4840 wrote to memory of 3896	4840	z607g2ssn.exe	103
PID 4840 wrote to memory of 3896	4840	z607g2ssn.exe	103
PID 4840 wrote to memory of 3896	4840	z607g2ssn.exe	103
PID 3896 wrote to memory of 1712	3896	z607g2ssn.exe	105
PID 3896 wrote to memory of 1712	3896	z607g2ssn.exe	105
PID 3896 wrote to memory of 1712	3896	z607g2ssn.exe	105
PID 3896 wrote to memory of 1712	3896	z607g2ssn.exe	105
PID 3896 wrote to memory of 1712	3896	z607g2ssn.exe	105
PID 3896 wrote to memory of 1712	3896	z607g2ssn.exe	105
PID 3896 wrote to memory of 1712	3896	z607g2ssn.exe	105
PID 3896 wrote to memory of 1712	3896	z607g2ssn.exe	105
PID 1712 wrote to memory of 4460	1712	z607g2ssn.exe	106
PID 1712 wrote to memory of 4460	1712	z607g2ssn.exe	106
PID 1712 wrote to memory of 4460	1712	z607g2ssn.exe	106
PID 1712 wrote to memory of 4612	1712	z607g2ssn.exe	107
PID 1712 wrote to memory of 4612	1712	z607g2ssn.exe	107
PID 1712 wrote to memory of 4612	1712	z607g2ssn.exe	107
PID 1712 wrote to memory of 4432	1712	z607g2ssn.exe	108
PID 1712 wrote to memory of 4432	1712	z607g2ssn.exe	108
PID 1712 wrote to memory of 4432	1712	z607g2ssn.exe	108
PID 1712 wrote to memory of 3596	1712	z607g2ssn.exe	109
PID 1712 wrote to memory of 3596	1712	z607g2ssn.exe	109
PID 1712 wrote to memory of 3596	1712	z607g2ssn.exe	109
PID 4460 wrote to memory of 3620	4460	cmd.exe	114
PID 4460 wrote to memory of 3620	4460	cmd.exe	114
PID 4460 wrote to memory of 3620	4460	cmd.exe	114
PID 4612 wrote to memory of 4192	4612	cmd.exe	115
PID 4612 wrote to memory of 4192	4612	cmd.exe	115
PID 4612 wrote to memory of 4192	4612	cmd.exe	115
PID 4432 wrote to memory of 3436	4432	cmd.exe	116
PID 4432 wrote to memory of 3436	4432	cmd.exe	116
PID 4432 wrote to memory of 3436	4432	cmd.exe	116
PID 3596 wrote to memory of 372	3596	cmd.exe	117
PID 3596 wrote to memory of 372	3596	cmd.exe	117
PID 3596 wrote to memory of 372	3596	cmd.exe	117

C:\Users\Admin\AppData\Local\Temp\c16723e4a57711813e198a40582ac7be.exe
"C:\Users\Admin\AppData\Local\Temp\c16723e4a57711813e198a40582ac7be.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Users\Admin\AppData\Local\Temp\c16723e4a57711813e198a40582ac7be.exe
  "C:\Users\Admin\AppData\Local\Temp\c16723e4a57711813e198a40582ac7be.exe"
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe
    "C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe
      "C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe"
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe
        
        "C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe"
        5⤵
        Adds policy Run key to start application
        Modifies Installed Components in the registry
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1712
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4460
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        7⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:3620
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4612
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe:*:Enabled:Windows Messanger" /f
        7⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:4192
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:4432
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        7⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:3436
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3596
        
        C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Microsoft\svchost.exe:*:Enabled:Windows Messanger" /f
        7⤵
        Modifies firewall policy service
        Modifies registry key
        
        PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\z607g2ssn.exe

Filesize
676KB

MD5
45033334a78ebe0cf821edb6f41bda29

SHA1
d89d1335e95883599b973603bb391eb1c0a3654d

SHA256
70da12e65e60b8dcb88a4f154e3be5c0fafbd71cf069c19f6a66e1e9ca15e5ff

SHA512
98053a7e296f1398c6fe6e142a424710546ad42d92729b47e26f6076a2a4e7231d551c3d3614b1ecf1ef03320d72eb5e21b37878eb29e5c2684582beb2740c7a

Download Submit
memory/1712-48-0x0000000077520000-0x0000000077610000-memory.dmp

Filesize
960KB

Download
memory/1712-64-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-87-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-84-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-77-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-29-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-32-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-73-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-41-0x0000000077520000-0x0000000077610000-memory.dmp

Filesize
960KB

Download
memory/1712-43-0x0000000077686000-0x0000000077687000-memory.dmp

Filesize
4KB

Download
memory/1712-42-0x00000000772E0000-0x000000007735A000-memory.dmp

Filesize
488KB

Download
memory/1712-49-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-70-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-80-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-44-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-52-0x00000000772E0000-0x000000007735A000-memory.dmp

Filesize
488KB

Download
memory/1712-54-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-57-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-60-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-47-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/1712-67-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/3896-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3896-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3896-23-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4444-4-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4444-2-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/4444-21-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads