7dacd5a2345cffe2482bb86bab684f86ecefe5eef983b99f3873969d9f267b1e

General

Target

e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exe
Size

194KB
MD5

e3fa551432bb0ac6fdcbb992e3332cd3
SHA1

6d499c34b6e95b48f76998d563c37461c0f0eae9
SHA256

7dacd5a2345cffe2482bb86bab684f86ecefe5eef983b99f3873969d9f267b1e
SHA512

618b8307b3131ef853cc414af3602346c06780c8d1181943bf9a6ef83edac8c78ca7b7db70a4c71cf24bbbad0bac329ed21d91a1e48b65236b8b4ef4f805ed33
SSDEEP

6144:+Tca25qNd/cWP+lCQPTuf9e6HVAN6hwSyqc:+T325sGlTufoVRe

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

KB00985204.exe

pid process

1252 KB00985204.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\KB00985204.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\KB00985204.exe\""	e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

KB00985204.exe

pid	process
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe
1252	KB00985204.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

KB00985204.exe

description pid process

Token: SeDebugPrivilege 1252 KB00985204.exe

description	pid	process
Token: SeDebugPrivilege	1252	KB00985204.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exeKB00985204.exe

description	pid	process	target process
PID 4076 wrote to memory of 1252	4076	e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exe	KB00985204.exe
PID 4076 wrote to memory of 1252	4076	e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exe	KB00985204.exe
PID 4076 wrote to memory of 1252	4076	e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exe	KB00985204.exe
PID 4076 wrote to memory of 3964	4076	e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exe	cmd.exe
PID 4076 wrote to memory of 3964	4076	e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exe	cmd.exe
PID 4076 wrote to memory of 3964	4076	e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exe	cmd.exe
PID 1252 wrote to memory of 2384	1252	KB00985204.exe	sihost.exe
PID 1252 wrote to memory of 2384	1252	KB00985204.exe	sihost.exe
PID 1252 wrote to memory of 2384	1252	KB00985204.exe	sihost.exe
PID 1252 wrote to memory of 2384	1252	KB00985204.exe	sihost.exe
PID 1252 wrote to memory of 2384	1252	KB00985204.exe	sihost.exe
PID 1252 wrote to memory of 2424	1252	KB00985204.exe	svchost.exe
PID 1252 wrote to memory of 2424	1252	KB00985204.exe	svchost.exe
PID 1252 wrote to memory of 2424	1252	KB00985204.exe	svchost.exe
PID 1252 wrote to memory of 2424	1252	KB00985204.exe	svchost.exe
PID 1252 wrote to memory of 2424	1252	KB00985204.exe	svchost.exe
PID 1252 wrote to memory of 2844	1252	KB00985204.exe	taskhostw.exe
PID 1252 wrote to memory of 2844	1252	KB00985204.exe	taskhostw.exe
PID 1252 wrote to memory of 2844	1252	KB00985204.exe	taskhostw.exe
PID 1252 wrote to memory of 2844	1252	KB00985204.exe	taskhostw.exe
PID 1252 wrote to memory of 2844	1252	KB00985204.exe	taskhostw.exe
PID 1252 wrote to memory of 3364	1252	KB00985204.exe	Explorer.EXE
PID 1252 wrote to memory of 3364	1252	KB00985204.exe	Explorer.EXE
PID 1252 wrote to memory of 3364	1252	KB00985204.exe	Explorer.EXE
PID 1252 wrote to memory of 3364	1252	KB00985204.exe	Explorer.EXE
PID 1252 wrote to memory of 3364	1252	KB00985204.exe	Explorer.EXE
PID 1252 wrote to memory of 3548	1252	KB00985204.exe	svchost.exe
PID 1252 wrote to memory of 3548	1252	KB00985204.exe	svchost.exe
PID 1252 wrote to memory of 3548	1252	KB00985204.exe	svchost.exe
PID 1252 wrote to memory of 3548	1252	KB00985204.exe	svchost.exe
PID 1252 wrote to memory of 3548	1252	KB00985204.exe	svchost.exe
PID 1252 wrote to memory of 3732	1252	KB00985204.exe	DllHost.exe
PID 1252 wrote to memory of 3732	1252	KB00985204.exe	DllHost.exe
PID 1252 wrote to memory of 3732	1252	KB00985204.exe	DllHost.exe
PID 1252 wrote to memory of 3732	1252	KB00985204.exe	DllHost.exe
PID 1252 wrote to memory of 3732	1252	KB00985204.exe	DllHost.exe
PID 1252 wrote to memory of 3908	1252	KB00985204.exe	StartMenuExperienceHost.exe
PID 1252 wrote to memory of 3908	1252	KB00985204.exe	StartMenuExperienceHost.exe
PID 1252 wrote to memory of 3908	1252	KB00985204.exe	StartMenuExperienceHost.exe
PID 1252 wrote to memory of 3908	1252	KB00985204.exe	StartMenuExperienceHost.exe
PID 1252 wrote to memory of 3908	1252	KB00985204.exe	StartMenuExperienceHost.exe
PID 1252 wrote to memory of 3972	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 3972	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 3972	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 3972	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 3972	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 4052	1252	KB00985204.exe	SearchApp.exe
PID 1252 wrote to memory of 4052	1252	KB00985204.exe	SearchApp.exe
PID 1252 wrote to memory of 4052	1252	KB00985204.exe	SearchApp.exe
PID 1252 wrote to memory of 4052	1252	KB00985204.exe	SearchApp.exe
PID 1252 wrote to memory of 4052	1252	KB00985204.exe	SearchApp.exe
PID 1252 wrote to memory of 3808	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 3808	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 3808	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 3808	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 3808	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 4192	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 4192	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 4192	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 4192	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 4192	1252	KB00985204.exe	RuntimeBroker.exe
PID 1252 wrote to memory of 4664	1252	KB00985204.exe	TextInputHost.exe
PID 1252 wrote to memory of 4664	1252	KB00985204.exe	TextInputHost.exe
PID 1252 wrote to memory of 4664	1252	KB00985204.exe	TextInputHost.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2424

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2844

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3364

C:\Users\Admin\AppData\Local\Temp\e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e3fa551432bb0ac6fdcbb992e3332cd3_JaffaCakes118.exe"
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4076

C:\Users\Admin\AppData\Roaming\KB00985204.exe
"C:\Users\Admin\AppData\Roaming\KB00985204.exe"
3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1252

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\POS829D.tmp.BAT"
3⤵
PID:3964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3548

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3732

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3908

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3972

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4052

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3808

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4192

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
PID:4948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.92 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffe311b5fd8,0x7ffe311b5fe4,0x7ffe311b5ff0
2⤵
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2144 --field-trial-handle=2148,i,1752153415760610784,11376271161549019716,262144 --variations-seed-version /prefetch:2
2⤵
PID:4044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2204 --field-trial-handle=2148,i,1752153415760610784,11376271161549019716,262144 --variations-seed-version /prefetch:3
2⤵
PID:3104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3348 --field-trial-handle=2148,i,1752153415760610784,11376271161549019716,262144 --variations-seed-version /prefetch:8
2⤵
PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5280 --field-trial-handle=2148,i,1752153415760610784,11376271161549019716,262144 --variations-seed-version /prefetch:1
2⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --mojo-platform-channel-handle=5532 --field-trial-handle=2148,i,1752153415760610784,11376271161549019716,262144 --variations-seed-version /prefetch:1
2⤵
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4004 --field-trial-handle=2148,i,1752153415760610784,11376271161549019716,262144 --variations-seed-version /prefetch:8
2⤵
PID:4496

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
1⤵
PID:684

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3344

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:4312

C:\Windows\system32\BackgroundTaskHost.exe
"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
1⤵
PID:3480

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4928

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2088

C:\Windows\System32\wuapihost.exe
C:\Windows\System32\wuapihost.exe -Embedding
1⤵
PID:1012

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:4352

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:828

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:3132

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:1008

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:3448

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1348

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\POS829D.tmp.BAT
Filesize
286B

MD5
93a0fce76491f709220434b5e7903668

SHA1
5ca189e850a1a97a9e0866c9676001fbecf34f32

SHA256
505da55223aa7abfb7a097a37fd10887c821a77dc74d76604bcffd8242b6691b

SHA512
3367f30d7a1cc5180148bc01020eedc5d51c3d41b09c73e27cbc458b898358a13fbed2689094548f8988f452f38fb140a9478ad15554282b1a66d6f16ed20c0c

Download Submit
C:\Users\Admin\AppData\Roaming\KB00985204.exe
Filesize
194KB

MD5
e3fa551432bb0ac6fdcbb992e3332cd3

SHA1
6d499c34b6e95b48f76998d563c37461c0f0eae9

SHA256
7dacd5a2345cffe2482bb86bab684f86ecefe5eef983b99f3873969d9f267b1e

SHA512
618b8307b3131ef853cc414af3602346c06780c8d1181943bf9a6ef83edac8c78ca7b7db70a4c71cf24bbbad0bac329ed21d91a1e48b65236b8b4ef4f805ed33

Download Submit
memory/684-63-0x000000003F020000-0x000000003F041000-memory.dmp

Filesize
132KB

Download
memory/828-123-0x0000000016DD0000-0x0000000016DF1000-memory.dmp

Filesize
132KB

Download
memory/1008-135-0x0000000030C80000-0x0000000030CA1000-memory.dmp

Filesize
132KB

Download
memory/1012-101-0x000000003D2B0000-0x000000003D2D1000-memory.dmp

Filesize
132KB

Download
memory/1012-93-0x000000003D280000-0x000000003D2A1000-memory.dmp

Filesize
132KB

Download
memory/1252-116-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-119-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-147-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-142-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-140-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-131-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-126-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-125-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-124-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-118-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-115-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-114-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-10-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-11-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/1252-82-0x0000000003600000-0x0000000003621000-memory.dmp

Filesize
132KB

Download
memory/1252-79-0x0000000003600000-0x0000000003621000-memory.dmp

Filesize
132KB

Download
memory/1348-146-0x000000001B550000-0x000000001B571000-memory.dmp

Filesize
132KB

Download
memory/2088-89-0x000000001F770000-0x000000001F791000-memory.dmp

Filesize
132KB

Download
memory/2384-15-0x0000000009C70000-0x0000000009C91000-memory.dmp

Filesize
132KB

Download
memory/2424-19-0x0000000028680000-0x00000000286A1000-memory.dmp

Filesize
132KB

Download
memory/2844-23-0x000000001FED0000-0x000000001FEF1000-memory.dmp

Filesize
132KB

Download
memory/3132-130-0x000000003E790000-0x000000003E7B1000-memory.dmp

Filesize
132KB

Download
memory/3344-67-0x0000000038B80000-0x0000000038BA1000-memory.dmp

Filesize
132KB

Download
memory/3364-27-0x0000000003040000-0x0000000003061000-memory.dmp

Filesize
132KB

Download
memory/3448-139-0x000000003E800000-0x000000003E821000-memory.dmp

Filesize
132KB

Download
memory/3480-75-0x00000000355A0000-0x00000000355C1000-memory.dmp

Filesize
132KB

Download
memory/3548-31-0x000000002A870000-0x000000002A891000-memory.dmp

Filesize
132KB

Download
memory/3732-35-0x0000000005C10000-0x0000000005C31000-memory.dmp

Filesize
132KB

Download
memory/3808-51-0x0000000031B00000-0x0000000031B21000-memory.dmp

Filesize
132KB

Download
memory/3908-39-0x000000000E960000-0x000000000E981000-memory.dmp

Filesize
132KB

Download
memory/3972-43-0x000000000AAD0000-0x000000000AAF1000-memory.dmp

Filesize
132KB

Download
memory/4052-47-0x0000000013A20000-0x0000000013A41000-memory.dmp

Filesize
132KB

Download
memory/4076-2-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4076-0-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4076-1-0x0000000000590000-0x0000000000591000-memory.dmp

Filesize
4KB

Download
memory/4076-8-0x0000000000400000-0x0000000000444000-memory.dmp

Filesize
272KB

Download
memory/4192-55-0x0000000025380000-0x00000000253A1000-memory.dmp

Filesize
132KB

Download
memory/4312-71-0x000000001E260000-0x000000001E281000-memory.dmp

Filesize
132KB

Download
memory/4352-113-0x0000000013E50000-0x0000000013E71000-memory.dmp

Filesize
132KB

Download
memory/4352-109-0x0000000013E20000-0x0000000013E41000-memory.dmp

Filesize
132KB

Download
memory/4352-105-0x0000000013DF0000-0x0000000013E11000-memory.dmp

Filesize
132KB

Download
memory/4352-97-0x0000000013DC0000-0x0000000013DE1000-memory.dmp

Filesize
132KB

Download
memory/4664-59-0x0000000015D10000-0x0000000015D31000-memory.dmp

Filesize
132KB

Download
memory/4928-85-0x000000002F390000-0x000000002F3B1000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads