metasploit | 17b0f65a3acf878d72123a1648ce0490307ff176abf2117cb23b9ca30417a02e

General

Target

f420bad96029b024d42e23c5b9300e44_JaffaCakes118.exe
Size

477KB
MD5

f420bad96029b024d42e23c5b9300e44
SHA1

79ef3ab63be198ed25851febee5c3bc603dc1d7a
SHA256

17b0f65a3acf878d72123a1648ce0490307ff176abf2117cb23b9ca30417a02e
SHA512

f962d6aeb2bb8e0a1a00a86dd709152542c9dd95750b062da6a86eec7b743e7e8610714663753530497219b21e0f37b8a4a1de204a638a0778cbd1d1e244d370
SSDEEP

12288:HIlKyhSac+JN0So1IImovQdkd2ABbl1HhjGR:olFhSnvSko47HJ6

Score

10^/10

metasploit backdoor trojan

Malware Config

Extracted

Family

metasploit

Version

encoder/call4_dword_xor

Signatures

MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
trojan backdoor metasploit

Executes dropped EXE 24 IoCs

Processes:

nvbw.exekxsj.exefmmf.exekxds.exebyjn.exewjsv.exezvsd.exetgal.exetdvj.exenapw.exeipar.exeijsu.execusc.exexjmx.exezgxs.exetvjn.exewgrw.exerrse.exeldam.exeozmh.exefask.exelagk.exefack.exezpof.exe

pid	process
2972	nvbw.exe
3692	kxsj.exe
944	fmmf.exe
5116	kxds.exe
2584	byjn.exe
3900	wjsv.exe
2772	zvsd.exe
5032	tgal.exe
64	tdvj.exe
2460	napw.exe
1152	ipar.exe
3916	ijsu.exe
1612	cusc.exe
4116	xjmx.exe
2384	zgxs.exe
4624	tvjn.exe
2276	wgrw.exe
3724	rrse.exe
4052	ldam.exe
5084	ozmh.exe
2456	fask.exe
2136	lagk.exe
2520	fack.exe
1708	zpof.exe

Drops file in System32 directory 48 IoCs

Processes:

byjn.exeipar.exewgrw.exef420bad96029b024d42e23c5b9300e44_JaffaCakes118.exefmmf.exezvsd.exetdvj.exexjmx.exezgxs.exeldam.exefack.exekxds.exetgal.execusc.exetvjn.exefask.exelagk.exekxsj.exewjsv.exenvbw.exeozmh.exerrse.exenapw.exeijsu.exe

description	ioc	process
File created	C:\Windows\SysWOW64\wjsv.exe	byjn.exe
File created	C:\Windows\SysWOW64\ijsu.exe	ipar.exe
File created	C:\Windows\SysWOW64\rrse.exe	wgrw.exe
File opened for modification	C:\Windows\SysWOW64\nvbw.exe	f420bad96029b024d42e23c5b9300e44_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\kxds.exe	fmmf.exe
File opened for modification	C:\Windows\SysWOW64\kxds.exe	fmmf.exe
File opened for modification	C:\Windows\SysWOW64\tgal.exe	zvsd.exe
File created	C:\Windows\SysWOW64\napw.exe	tdvj.exe
File created	C:\Windows\SysWOW64\zgxs.exe	xjmx.exe
File created	C:\Windows\SysWOW64\tvjn.exe	zgxs.exe
File opened for modification	C:\Windows\SysWOW64\rrse.exe	wgrw.exe
File created	C:\Windows\SysWOW64\ozmh.exe	ldam.exe
File created	C:\Windows\SysWOW64\zpof.exe	fack.exe
File created	C:\Windows\SysWOW64\byjn.exe	kxds.exe
File opened for modification	C:\Windows\SysWOW64\tdvj.exe	tgal.exe
File opened for modification	C:\Windows\SysWOW64\xjmx.exe	cusc.exe
File opened for modification	C:\Windows\SysWOW64\wgrw.exe	tvjn.exe
File opened for modification	C:\Windows\SysWOW64\ozmh.exe	ldam.exe
File created	C:\Windows\SysWOW64\lagk.exe	fask.exe
File created	C:\Windows\SysWOW64\fack.exe	lagk.exe
File created	C:\Windows\SysWOW64\fmmf.exe	kxsj.exe
File created	C:\Windows\SysWOW64\zvsd.exe	wjsv.exe
File opened for modification	C:\Windows\SysWOW64\napw.exe	tdvj.exe
File opened for modification	C:\Windows\SysWOW64\ijsu.exe	ipar.exe
File created	C:\Windows\SysWOW64\wgrw.exe	tvjn.exe
File opened for modification	C:\Windows\SysWOW64\fack.exe	lagk.exe
File opened for modification	C:\Windows\SysWOW64\zpof.exe	fack.exe
File created	C:\Windows\SysWOW64\kxsj.exe	nvbw.exe
File opened for modification	C:\Windows\SysWOW64\byjn.exe	kxds.exe
File created	C:\Windows\SysWOW64\tgal.exe	zvsd.exe
File created	C:\Windows\SysWOW64\fask.exe	ozmh.exe
File opened for modification	C:\Windows\SysWOW64\fask.exe	ozmh.exe
File created	C:\Windows\SysWOW64\nvbw.exe	f420bad96029b024d42e23c5b9300e44_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\fmmf.exe	kxsj.exe
File opened for modification	C:\Windows\SysWOW64\wjsv.exe	byjn.exe
File created	C:\Windows\SysWOW64\tdvj.exe	tgal.exe
File created	C:\Windows\SysWOW64\ldam.exe	rrse.exe
File opened for modification	C:\Windows\SysWOW64\lagk.exe	fask.exe
File opened for modification	C:\Windows\SysWOW64\zvsd.exe	wjsv.exe
File opened for modification	C:\Windows\SysWOW64\ipar.exe	napw.exe
File created	C:\Windows\SysWOW64\cusc.exe	ijsu.exe
File opened for modification	C:\Windows\SysWOW64\cusc.exe	ijsu.exe
File created	C:\Windows\SysWOW64\xjmx.exe	cusc.exe
File opened for modification	C:\Windows\SysWOW64\tvjn.exe	zgxs.exe
File opened for modification	C:\Windows\SysWOW64\kxsj.exe	nvbw.exe
File created	C:\Windows\SysWOW64\ipar.exe	napw.exe
File opened for modification	C:\Windows\SysWOW64\zgxs.exe	xjmx.exe
File opened for modification	C:\Windows\SysWOW64\ldam.exe	rrse.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f420bad96029b024d42e23c5b9300e44_JaffaCakes118.exenvbw.exekxsj.exefmmf.exekxds.exebyjn.exewjsv.exezvsd.exetgal.exetdvj.exenapw.exeipar.exeijsu.execusc.exexjmx.exezgxs.exetvjn.exewgrw.exerrse.exeldam.exeozmh.exefask.exe

description	pid	process	target process
PID 4412 wrote to memory of 2972	4412	f420bad96029b024d42e23c5b9300e44_JaffaCakes118.exe	nvbw.exe
PID 4412 wrote to memory of 2972	4412	f420bad96029b024d42e23c5b9300e44_JaffaCakes118.exe	nvbw.exe
PID 4412 wrote to memory of 2972	4412	f420bad96029b024d42e23c5b9300e44_JaffaCakes118.exe	nvbw.exe
PID 2972 wrote to memory of 3692	2972	nvbw.exe	kxsj.exe
PID 2972 wrote to memory of 3692	2972	nvbw.exe	kxsj.exe
PID 2972 wrote to memory of 3692	2972	nvbw.exe	kxsj.exe
PID 3692 wrote to memory of 944	3692	kxsj.exe	fmmf.exe
PID 3692 wrote to memory of 944	3692	kxsj.exe	fmmf.exe
PID 3692 wrote to memory of 944	3692	kxsj.exe	fmmf.exe
PID 944 wrote to memory of 5116	944	fmmf.exe	kxds.exe
PID 944 wrote to memory of 5116	944	fmmf.exe	kxds.exe
PID 944 wrote to memory of 5116	944	fmmf.exe	kxds.exe
PID 5116 wrote to memory of 2584	5116	kxds.exe	byjn.exe
PID 5116 wrote to memory of 2584	5116	kxds.exe	byjn.exe
PID 5116 wrote to memory of 2584	5116	kxds.exe	byjn.exe
PID 2584 wrote to memory of 3900	2584	byjn.exe	wjsv.exe
PID 2584 wrote to memory of 3900	2584	byjn.exe	wjsv.exe
PID 2584 wrote to memory of 3900	2584	byjn.exe	wjsv.exe
PID 3900 wrote to memory of 2772	3900	wjsv.exe	zvsd.exe
PID 3900 wrote to memory of 2772	3900	wjsv.exe	zvsd.exe
PID 3900 wrote to memory of 2772	3900	wjsv.exe	zvsd.exe
PID 2772 wrote to memory of 5032	2772	zvsd.exe	tgal.exe
PID 2772 wrote to memory of 5032	2772	zvsd.exe	tgal.exe
PID 2772 wrote to memory of 5032	2772	zvsd.exe	tgal.exe
PID 5032 wrote to memory of 64	5032	tgal.exe	tdvj.exe
PID 5032 wrote to memory of 64	5032	tgal.exe	tdvj.exe
PID 5032 wrote to memory of 64	5032	tgal.exe	tdvj.exe
PID 64 wrote to memory of 2460	64	tdvj.exe	napw.exe
PID 64 wrote to memory of 2460	64	tdvj.exe	napw.exe
PID 64 wrote to memory of 2460	64	tdvj.exe	napw.exe
PID 2460 wrote to memory of 1152	2460	napw.exe	ipar.exe
PID 2460 wrote to memory of 1152	2460	napw.exe	ipar.exe
PID 2460 wrote to memory of 1152	2460	napw.exe	ipar.exe
PID 1152 wrote to memory of 3916	1152	ipar.exe	ijsu.exe
PID 1152 wrote to memory of 3916	1152	ipar.exe	ijsu.exe
PID 1152 wrote to memory of 3916	1152	ipar.exe	ijsu.exe
PID 3916 wrote to memory of 1612	3916	ijsu.exe	cusc.exe
PID 3916 wrote to memory of 1612	3916	ijsu.exe	cusc.exe
PID 3916 wrote to memory of 1612	3916	ijsu.exe	cusc.exe
PID 1612 wrote to memory of 4116	1612	cusc.exe	xjmx.exe
PID 1612 wrote to memory of 4116	1612	cusc.exe	xjmx.exe
PID 1612 wrote to memory of 4116	1612	cusc.exe	xjmx.exe
PID 4116 wrote to memory of 2384	4116	xjmx.exe	zgxs.exe
PID 4116 wrote to memory of 2384	4116	xjmx.exe	zgxs.exe
PID 4116 wrote to memory of 2384	4116	xjmx.exe	zgxs.exe
PID 2384 wrote to memory of 4624	2384	zgxs.exe	tvjn.exe
PID 2384 wrote to memory of 4624	2384	zgxs.exe	tvjn.exe
PID 2384 wrote to memory of 4624	2384	zgxs.exe	tvjn.exe
PID 4624 wrote to memory of 2276	4624	tvjn.exe	wgrw.exe
PID 4624 wrote to memory of 2276	4624	tvjn.exe	wgrw.exe
PID 4624 wrote to memory of 2276	4624	tvjn.exe	wgrw.exe
PID 2276 wrote to memory of 3724	2276	wgrw.exe	rrse.exe
PID 2276 wrote to memory of 3724	2276	wgrw.exe	rrse.exe
PID 2276 wrote to memory of 3724	2276	wgrw.exe	rrse.exe
PID 3724 wrote to memory of 4052	3724	rrse.exe	ldam.exe
PID 3724 wrote to memory of 4052	3724	rrse.exe	ldam.exe
PID 3724 wrote to memory of 4052	3724	rrse.exe	ldam.exe
PID 4052 wrote to memory of 5084	4052	ldam.exe	ozmh.exe
PID 4052 wrote to memory of 5084	4052	ldam.exe	ozmh.exe
PID 4052 wrote to memory of 5084	4052	ldam.exe	ozmh.exe
PID 5084 wrote to memory of 2456	5084	ozmh.exe	fask.exe
PID 5084 wrote to memory of 2456	5084	ozmh.exe	fask.exe
PID 5084 wrote to memory of 2456	5084	ozmh.exe	fask.exe
PID 2456 wrote to memory of 2136	2456	fask.exe	lagk.exe

C:\Users\Admin\AppData\Local\Temp\f420bad96029b024d42e23c5b9300e44_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f420bad96029b024d42e23c5b9300e44_JaffaCakes118.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4412

C:\Windows\SysWOW64\nvbw.exe
C:\Windows\system32\nvbw.exe 1344 "C:\Users\Admin\AppData\Local\Temp\f420bad96029b024d42e23c5b9300e44_JaffaCakes118.exe"
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2972

C:\Windows\SysWOW64\kxsj.exe
C:\Windows\system32\kxsj.exe 1244 "C:\Windows\SysWOW64\nvbw.exe"
3⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3692

C:\Windows\SysWOW64\fmmf.exe
C:\Windows\system32\fmmf.exe 1240 "C:\Windows\SysWOW64\kxsj.exe"
4⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:944

C:\Windows\SysWOW64\kxds.exe
C:\Windows\system32\kxds.exe 1360 "C:\Windows\SysWOW64\fmmf.exe"
5⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5116

C:\Windows\SysWOW64\byjn.exe
C:\Windows\system32\byjn.exe 1256 "C:\Windows\SysWOW64\kxds.exe"
6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2584

C:\Windows\SysWOW64\wjsv.exe
C:\Windows\system32\wjsv.exe 1260 "C:\Windows\SysWOW64\byjn.exe"
7⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3900

C:\Windows\SysWOW64\zvsd.exe
C:\Windows\system32\zvsd.exe 1232 "C:\Windows\SysWOW64\wjsv.exe"
8⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2772

C:\Windows\SysWOW64\tgal.exe
C:\Windows\system32\tgal.exe 1288 "C:\Windows\SysWOW64\zvsd.exe"
9⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5032

C:\Windows\SysWOW64\tdvj.exe
C:\Windows\system32\tdvj.exe 1264 "C:\Windows\SysWOW64\tgal.exe"
10⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:64

C:\Windows\SysWOW64\napw.exe
C:\Windows\system32\napw.exe 1272 "C:\Windows\SysWOW64\tdvj.exe"
11⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2460

C:\Windows\SysWOW64\ipar.exe
C:\Windows\system32\ipar.exe 1292 "C:\Windows\SysWOW64\napw.exe"
12⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\ijsu.exe
C:\Windows\system32\ijsu.exe 1424 "C:\Windows\SysWOW64\ipar.exe"
13⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3916

C:\Windows\SysWOW64\cusc.exe
C:\Windows\system32\cusc.exe 1284 "C:\Windows\SysWOW64\ijsu.exe"
14⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1612

C:\Windows\SysWOW64\xjmx.exe
C:\Windows\system32\xjmx.exe 1304 "C:\Windows\SysWOW64\cusc.exe"
15⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4116

C:\Windows\SysWOW64\zgxs.exe
C:\Windows\system32\zgxs.exe 1448 "C:\Windows\SysWOW64\xjmx.exe"
16⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2384

C:\Windows\SysWOW64\tvjn.exe
C:\Windows\system32\tvjn.exe 1420 "C:\Windows\SysWOW64\zgxs.exe"
17⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4624

C:\Windows\SysWOW64\wgrw.exe
C:\Windows\system32\wgrw.exe 1328 "C:\Windows\SysWOW64\tvjn.exe"
18⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\SysWOW64\rrse.exe
C:\Windows\system32\rrse.exe 1472 "C:\Windows\SysWOW64\wgrw.exe"
19⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3724

C:\Windows\SysWOW64\ldam.exe
C:\Windows\system32\ldam.exe 1372 "C:\Windows\SysWOW64\rrse.exe"
20⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\SysWOW64\ozmh.exe
C:\Windows\system32\ozmh.exe 1488 "C:\Windows\SysWOW64\ldam.exe"
21⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:5084

C:\Windows\SysWOW64\fask.exe
C:\Windows\system32\fask.exe 1364 "C:\Windows\SysWOW64\ozmh.exe"
22⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2456

C:\Windows\SysWOW64\lagk.exe
C:\Windows\system32\lagk.exe 1356 "C:\Windows\SysWOW64\fask.exe"
23⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2136

C:\Windows\SysWOW64\fack.exe
C:\Windows\system32\fack.exe 1352 "C:\Windows\SysWOW64\lagk.exe"
24⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2520

C:\Windows\SysWOW64\zpof.exe
C:\Windows\system32\zpof.exe 1532 "C:\Windows\SysWOW64\fack.exe"
25⤵
- Executes dropped EXE
PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
1⤵
PID:3352

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\nvbw.exe
Filesize
477KB

MD5
f420bad96029b024d42e23c5b9300e44

SHA1
79ef3ab63be198ed25851febee5c3bc603dc1d7a

SHA256
17b0f65a3acf878d72123a1648ce0490307ff176abf2117cb23b9ca30417a02e

SHA512
f962d6aeb2bb8e0a1a00a86dd709152542c9dd95750b062da6a86eec7b743e7e8610714663753530497219b21e0f37b8a4a1de204a638a0778cbd1d1e244d370

Download Submit
memory/64-85-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/64-98-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/64-86-0x0000000002920000-0x0000000002A10000-memory.dmp

Filesize
960KB

Download
memory/944-40-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/944-39-0x00000000028D0000-0x00000000029C0000-memory.dmp

Filesize
960KB

Download
memory/944-28-0x00000000028D0000-0x00000000029C0000-memory.dmp

Filesize
960KB

Download
memory/944-27-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/1152-103-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/1152-106-0x0000000002650000-0x0000000002740000-memory.dmp

Filesize
960KB

Download
memory/1152-117-0x0000000002650000-0x0000000002740000-memory.dmp

Filesize
960KB

Download
memory/1152-118-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/1612-137-0x0000000002890000-0x0000000002980000-memory.dmp

Filesize
960KB

Download
memory/1612-138-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/1612-124-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/1612-125-0x0000000002890000-0x0000000002980000-memory.dmp

Filesize
960KB

Download
memory/2276-163-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2276-164-0x0000000002A00000-0x0000000002AF0000-memory.dmp

Filesize
960KB

Download
memory/2384-157-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2384-144-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2384-156-0x0000000002900000-0x00000000029F0000-memory.dmp

Filesize
960KB

Download
memory/2384-145-0x0000000002900000-0x00000000029F0000-memory.dmp

Filesize
960KB

Download
memory/2460-96-0x00000000028D0000-0x00000000029C0000-memory.dmp

Filesize
960KB

Download
memory/2460-108-0x00000000028D0000-0x00000000029C0000-memory.dmp

Filesize
960KB

Download
memory/2460-107-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2460-95-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2584-59-0x00000000027B0000-0x00000000028A0000-memory.dmp

Filesize
960KB

Download
memory/2584-47-0x00000000027B0000-0x00000000028A0000-memory.dmp

Filesize
960KB

Download
memory/2584-60-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2584-46-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2772-67-0x0000000002950000-0x0000000002A40000-memory.dmp

Filesize
960KB

Download
memory/2772-66-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2772-78-0x0000000002950000-0x0000000002A40000-memory.dmp

Filesize
960KB

Download
memory/2772-79-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2972-9-0x0000000002970000-0x0000000002A60000-memory.dmp

Filesize
960KB

Download
memory/2972-8-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/2972-21-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/3692-30-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/3692-19-0x0000000002910000-0x0000000002A00000-memory.dmp

Filesize
960KB

Download
memory/3692-18-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/3900-56-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/3900-69-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/3900-57-0x00000000028D0000-0x00000000029C0000-memory.dmp

Filesize
960KB

Download
memory/3916-128-0x0000000002900000-0x00000000029F0000-memory.dmp

Filesize
960KB

Download
memory/3916-114-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/3916-115-0x0000000002900000-0x00000000029F0000-memory.dmp

Filesize
960KB

Download
memory/3916-127-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/4116-134-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/4116-135-0x0000000002970000-0x0000000002A60000-memory.dmp

Filesize
960KB

Download
memory/4116-147-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/4412-0-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/4412-1-0x0000000002A40000-0x0000000002B30000-memory.dmp

Filesize
960KB

Download
memory/4412-12-0x0000000002A40000-0x0000000002B30000-memory.dmp

Filesize
960KB

Download
memory/4412-11-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/4624-154-0x0000000002920000-0x0000000002A10000-memory.dmp

Filesize
960KB

Download
memory/4624-153-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/4624-166-0x0000000002920000-0x0000000002A10000-memory.dmp

Filesize
960KB

Download
memory/5032-75-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/5032-88-0x0000000002910000-0x0000000002A00000-memory.dmp

Filesize
960KB

Download
memory/5032-89-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/5032-76-0x0000000002910000-0x0000000002A00000-memory.dmp

Filesize
960KB

Download
memory/5116-49-0x0000000002900000-0x00000000029F0000-memory.dmp

Filesize
960KB

Download
memory/5116-37-0x0000000002900000-0x00000000029F0000-memory.dmp

Filesize
960KB

Download
memory/5116-50-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download
memory/5116-36-0x0000000000400000-0x00000000008E4000-memory.dmp

Filesize
4.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads