kpot | a2ae841d1d66074bf6d0b98e52a58e76d2db80fff78b12d98fa6f2b6e6542287

Analysis

max time kernel
145s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 00:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2ae841d1d66074bf6d0b98e52a58e76d2db80fff78b12d98fa6f2b6e6542287.exe
Size 1.2MB
Sample240408-ab9frsaf99
SHA256 a2ae841d1d66074bf6d0b98e52a58e76d2db80fff78b12d98fa6f2b6e6542287
MD5 5a8fb46f7bcc79de5c468099362088fc
SHA1 43420f0955ec4c81bc58dd634eb9b1e23b38b62f
SHA512 d4234acd7396b4271af69a883c5047ff402c6199aa07ae7c26fbb76d770285361dde2e7b0ca83541122333576f9f4fea651f1a317c059b469d699a2efa30dc97
SSDEEP 24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOFZ+jJ/1q0GrbcUxnMjC:E5aIwC+Agr6StVEnmcKWnq0vljC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023207-22.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 9 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/1560-15-0x0000000002FE0000-0x0000000003009000-memory.dmp	trickbot_loader32
behavioral2/memory/1560-19-0x0000000002FE0000-0x0000000003009000-memory.dmp	trickbot_loader32
behavioral2/memory/1560-26-0x0000000002FE0000-0x0000000003009000-memory.dmp	trickbot_loader32
behavioral2/memory/1536-44-0x00000000029D0000-0x00000000029F9000-memory.dmp	trickbot_loader32
behavioral2/memory/1536-59-0x00000000029D0000-0x00000000029F9000-memory.dmp	trickbot_loader32
behavioral2/memory/4128-80-0x0000000000DC0000-0x0000000000DE9000-memory.dmp	trickbot_loader32
behavioral2/memory/4128-94-0x0000000000DC0000-0x0000000000DE9000-memory.dmp	trickbot_loader32
behavioral2/memory/4712-117-0x0000000000D10000-0x0000000000D39000-memory.dmp	trickbot_loader32
behavioral2/memory/4712-131-0x0000000000D10000-0x0000000000D39000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
Token: SeTcbPrivilege	4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1560	a2ae841d1d66074bf6d0b98e52a58e76d2db80fff78b12d98fa6f2b6e6542287.exe
1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 1536	1560	a2ae841d1d66074bf6d0b98e52a58e76d2db80fff78b12d98fa6f2b6e6542287.exe	88
PID 1560 wrote to memory of 1536	1560	a2ae841d1d66074bf6d0b98e52a58e76d2db80fff78b12d98fa6f2b6e6542287.exe	88
PID 1560 wrote to memory of 1536	1560	a2ae841d1d66074bf6d0b98e52a58e76d2db80fff78b12d98fa6f2b6e6542287.exe	88
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 1536 wrote to memory of 4864	1536	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	89
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4128 wrote to memory of 4752	4128	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	99
PID 4712 wrote to memory of 2308	4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	101
PID 4712 wrote to memory of 2308	4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	101
PID 4712 wrote to memory of 2308	4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	101
PID 4712 wrote to memory of 2308	4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	101
PID 4712 wrote to memory of 2308	4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	101
PID 4712 wrote to memory of 2308	4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	101
PID 4712 wrote to memory of 2308	4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	101
PID 4712 wrote to memory of 2308	4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	101
PID 4712 wrote to memory of 2308	4712	a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\a2ae841d1d66074bf6d0b98e52a58e76d2db80fff78b12d98fa6f2b6e6542287.exe
"C:\Users\Admin\AppData\Local\Temp\a2ae841d1d66074bf6d0b98e52a58e76d2db80fff78b12d98fa6f2b6e6542287.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Users\Admin\AppData\Roaming\WinSocket\a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:4864

C:\Users\Admin\AppData\Roaming\WinSocket\a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4752

C:\Users\Admin\AppData\Roaming\WinSocket\a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
C:\Users\Admin\AppData\Roaming\WinSocket\a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe

Path C:\Users\Admin\AppData\Roaming\WinSocket\a2ae941d1d77084bf7d0b99e62a69e87d2db90fff89b12d99fa7f2b7e7642298.exe
Size 1.2MB
SHA256 a2ae841d1d66074bf6d0b98e52a58e76d2db80fff78b12d98fa6f2b6e6542287
MD5 5a8fb46f7bcc79de5c468099362088fc
SHA1 43420f0955ec4c81bc58dd634eb9b1e23b38b62f
SHA512 d4234acd7396b4271af69a883c5047ff402c6199aa07ae7c26fbb76d770285361dde2e7b0ca83541122333576f9f4fea651f1a317c059b469d699a2efa30dc97
SSDEEP 24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOFZ+jJ/1q0GrbcUxnMjC:E5aIwC+Agr6StVEnmcKWnq0vljC
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Size 20KB
SHA256 6c6867e3e59112042832c2e817ceaa87ce8304dff479f65b6ecef784dc2da279
MD5 6799f3d36e31eebc1636b0bdc315c320
SHA1 1e24a036b3b4c6b1c42fdb4155ccc18e2709867b
SHA512 e7d26ed52e5e1161724fc7994dd996579e0980955034442c65bbde2a01012a51c2c151bb95dd3bfc6c88058afb09be71f71addf95e35ae1e09076b5dd743e088
SSDEEP 384:8UgJU8Ydd2nqzjp8ZVzaweXdugDRixjfeisWWSAao4syMuBYkI9CO8f6ckuU0ZN:8UgJU8gdcqzN8Paw4Es+u45BYKO8feu7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1536-39-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-37-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-57-0x0000000003090000-0x000000000314E000-memory.dmp

Download

memory/1536-51-0x0000000002A40000-0x0000000002A41000-memory.dmp

Download

memory/1536-44-0x00000000029D0000-0x00000000029F9000-memory.dmp

Download

memory/1536-46-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/1536-43-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-41-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/1536-32-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-58-0x0000000003190000-0x0000000003459000-memory.dmp

Download

memory/1536-38-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-36-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-34-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-35-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-33-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-59-0x00000000029D0000-0x00000000029F9000-memory.dmp

Download

memory/1536-31-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-28-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-29-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1536-30-0x00000000020B0000-0x00000000020B1000-memory.dmp

Download

memory/1560-18-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-4-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-19-0x0000000002FE0000-0x0000000003009000-memory.dmp

Download

memory/1560-3-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-17-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/1560-15-0x0000000002FE0000-0x0000000003009000-memory.dmp

Download

memory/1560-14-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-12-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-13-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-11-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-10-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-9-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-8-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-7-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-2-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-26-0x0000000002FE0000-0x0000000003009000-memory.dmp

Download

memory/1560-6-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/1560-5-0x0000000002A10000-0x0000000002A11000-memory.dmp

Download

memory/4128-74-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-78-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4128-75-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-94-0x0000000000DC0000-0x0000000000DE9000-memory.dmp

Download

memory/4128-73-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-72-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-71-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-70-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-69-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-67-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-66-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-68-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-64-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-65-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-79-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/4128-80-0x0000000000DC0000-0x0000000000DE9000-memory.dmp

Download

memory/4128-86-0x00000000015C0000-0x00000000015C1000-memory.dmp

Download

memory/4128-92-0x0000000001CA0000-0x0000000001D5E000-memory.dmp

Download

memory/4712-115-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/4712-116-0x0000000000610000-0x0000000000611000-memory.dmp

Download

memory/4712-117-0x0000000000D10000-0x0000000000D39000-memory.dmp

Download

memory/4712-125-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/4712-131-0x0000000000D10000-0x0000000000D39000-memory.dmp

Download

memory/4864-53-0x00000180B1220000-0x00000180B1221000-memory.dmp

Download

memory/4864-52-0x0000000010000000-0x000000001001E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads