neshta | 79b58bb35b6299919e78f166bd42cbd38741c73922c41ee7470b1813e5d09d26

General

Target

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
Size

780KB
MD5

53634e768575e91e9b89543fb47dca4c
SHA1

4151261b147b5b22057dda171b9f024de0b01d46
SHA256

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a
SHA512

49afb63b3f0f3f986365875a450fdadf865822cbc41b62253d2c2b5c96993bf6883096a96927dd9872861f72c31012bd224243a592e39bd009bb3960d3e37f87
SSDEEP

12288:1rfXXHjivz4mL/ybmDw1IwjfkM8aCDwjU3qhiqxjExqMHDFACuvFd:1rfDiyaDw+yMMdC2U6Dw4sDF4

Score

10^/10

neshta persistence spyware

Malware Config

Signatures

Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description	pid	process	target process
PID 1248 set thread context of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

Drops file in Program Files directory 14 IoCs

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description	ioc	process
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

Drops file in Windows directory 1 IoCs

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description ioc process

File opened for modification C:\Windows\svchost.com 7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

3152 schtasks.exe

description	ioc	process
File opened for modification	C:\Windows\svchost.com	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

pid	process
3152	schtasks.exe

Modifies registry class 1 IoCs

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

pid process

4320 powershell.exe
4320 powershell.exe
4612 powershell.exe
4612 powershell.exe
4612 powershell.exe
4320 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 4320 powershell.exe
Token: SeDebugPrivilege 4612 powershell.exe

pid	process
4320	powershell.exe
4320	powershell.exe
4612	powershell.exe
4612	powershell.exe
4612	powershell.exe
4320	powershell.exe

description	pid	process
Token: SeDebugPrivilege	4320	powershell.exe
Token: SeDebugPrivilege	4612	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

description	pid	process	target process
PID 1248 wrote to memory of 4320	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 1248 wrote to memory of 4320	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 1248 wrote to memory of 4320	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 1248 wrote to memory of 4612	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 1248 wrote to memory of 4612	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 1248 wrote to memory of 4612	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	powershell.exe
PID 1248 wrote to memory of 3152	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	schtasks.exe
PID 1248 wrote to memory of 3152	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	schtasks.exe
PID 1248 wrote to memory of 3152	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	schtasks.exe
PID 1248 wrote to memory of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 1248 wrote to memory of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 1248 wrote to memory of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 1248 wrote to memory of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 1248 wrote to memory of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 1248 wrote to memory of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 1248 wrote to memory of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 1248 wrote to memory of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 1248 wrote to memory of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 1248 wrote to memory of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
PID 1248 wrote to memory of 2252	1248	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe	7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe

C:\Users\Admin\AppData\Local\Temp\7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
"C:\Users\Admin\AppData\Local\Temp\7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1248

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\JdlPFHWpQXC.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4612

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JdlPFHWpQXC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD869.tmp"
2⤵
- Creates scheduled task(s)
PID:3152

C:\Users\Admin\AppData\Local\Temp\7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
"C:\Users\Admin\AppData\Local\Temp\7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe"
2⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1400 --field-trial-handle=2256,i,6670388345726423024,18382795228658886258,262144 --variations-seed-version /prefetch:8
1⤵
PID:1620

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Event Triggered Execution

1

T1546

Change Default File Association

Scheduled Task/Job

Privilege Escalation

Event Triggered Execution

1

T1546

Change Default File Association

Scheduled Task/Job

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Filesize
53KB

MD5
124edf3ad57549a6e475f3bc4e6cfe51

SHA1
80f5187eeebb4a304e9caa0ce66fcd78c113d634

SHA256
638c51e173ca6b3469494a7e2e0b656021a761f77b4a83f3e430e82e7b9af675

SHA512
b6c1a9051feeffad54ba1092fd799d34a9578368d7e66b31780fe478c1def0eb4094dce2879003f7389f2f9d86b94a3ef3975e78092a604597841c9b8db120ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\3582-490\7e4178777e66874affc0c4e95846d4fadd7b9d39252ef984ede3e13ffdf0140a.exe
Filesize
739KB

MD5
a39a031ea7067eebf6b0db50de2903f6

SHA1
4d5ba46009e1d1a9bc326e160bd0804c811bba32

SHA256
b075b1b3863e7b301e518dac93147dd20b8759942269f85b9db7df79c27c1bc0

SHA512
ec56f6ca2b632ebacf42799a84be915be3871d1bebf2e8591cf8fcc7f5733bc261c59820b63d80bb1c1437acaa16ef07f357bf521d44429dd9929e6110d14881

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ivy1kqtg.c5p.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpD869.tmp
Filesize
1KB

MD5
b88537ff01ca7deed85b54e754314a75

SHA1
2c795a87164b6d30479b26f582fcf1c510c7d734

SHA256
7252329b451bacec6d7759d22d517bcb9f2283b5af7e5cdbbaf04ff91ba28096

SHA512
a4683795d559dedff403d35a9a992de7a84ff5c6f4ed31cfe98489b6cdfbc616485b86fa9e9a4849ede46131b734c202a5b4461d56811030b3d13b229a0595c7

Download Submit
C:\Windows\svchost.com
Filesize
40KB

MD5
f605c7dcb3ec017d4f7e48b450adb998

SHA1
eeeea0d6f923c82f3f3490deba323ee5121cda13

SHA256
22614585cebaadfe4332322c0fcd368fd402bbca8e83e7fe90e59a2bf993275b

SHA512
b264681b2856a4e71fbee7d88369fc2165bb5ba930a50aac4f2e6e6e40a0245cf3a407ae1120a771c1357163b221b6a2d60fe13aaa5573f98a4bbde0bb778379

Download Submit
memory/1248-10-0x0000000007C90000-0x0000000007C98000-memory.dmp

Filesize
32KB

Download
memory/1248-4-0x00000000056B0000-0x0000000005A04000-memory.dmp

Filesize
3.3MB

Download
memory/1248-6-0x0000000004DA0000-0x0000000004DAA000-memory.dmp

Filesize
40KB

Download
memory/1248-7-0x00000000050A0000-0x00000000050B4000-memory.dmp

Filesize
80KB

Download
memory/1248-8-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/1248-9-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/1248-0-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/1248-11-0x0000000007CA0000-0x0000000007CAC000-memory.dmp

Filesize
48KB

Download
memory/1248-12-0x0000000007D20000-0x0000000007DA6000-memory.dmp

Filesize
536KB

Download
memory/1248-13-0x0000000007F90000-0x000000000802C000-memory.dmp

Filesize
624KB

Download
memory/1248-1-0x0000000000140000-0x000000000020A000-memory.dmp

Filesize
808KB

Download
memory/1248-5-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/1248-2-0x0000000005100000-0x00000000056A4000-memory.dmp

Filesize
5.6MB

Download
memory/1248-42-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/1248-3-0x0000000004BF0000-0x0000000004C82000-memory.dmp

Filesize
584KB

Download
memory/2252-29-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2252-28-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2252-105-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2252-26-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/2252-27-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4320-107-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/4320-104-0x00000000075A0000-0x0000000007636000-memory.dmp

Filesize
600KB

Download
memory/4320-114-0x0000000007660000-0x0000000007668000-memory.dmp

Filesize
32KB

Download
memory/4320-113-0x000000007F340000-0x000000007F350000-memory.dmp

Filesize
64KB

Download
memory/4320-110-0x0000000007580000-0x0000000007594000-memory.dmp

Filesize
80KB

Download
memory/4320-109-0x0000000007390000-0x000000000739E000-memory.dmp

Filesize
56KB

Download
memory/4320-45-0x00000000050C0000-0x0000000005126000-memory.dmp

Filesize
408KB

Download
memory/4320-16-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/4320-19-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/4320-96-0x00000000072B0000-0x0000000007353000-memory.dmp

Filesize
652KB

Download
memory/4320-22-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/4320-120-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/4320-68-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/4320-71-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/4320-102-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/4320-100-0x00000000073B0000-0x00000000073BA000-memory.dmp

Filesize
40KB

Download
memory/4320-99-0x00000000066E0000-0x00000000066FA000-memory.dmp

Filesize
104KB

Download
memory/4320-93-0x000000007F340000-0x000000007F350000-memory.dmp

Filesize
64KB

Download
memory/4320-98-0x00000000079E0000-0x000000000805A000-memory.dmp

Filesize
6.5MB

Download
memory/4320-83-0x00000000721C0000-0x000000007220C000-memory.dmp

Filesize
304KB

Download
memory/4320-97-0x0000000004B90000-0x0000000004BA0000-memory.dmp

Filesize
64KB

Download
memory/4612-66-0x00000000065B0000-0x00000000065CE000-memory.dmp

Filesize
120KB

Download
memory/4612-95-0x0000000006B90000-0x0000000006BAE000-memory.dmp

Filesize
120KB

Download
memory/4612-86-0x000000007F5B0000-0x000000007F5C0000-memory.dmp

Filesize
64KB

Download
memory/4612-82-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/4612-70-0x0000000007780000-0x00000000077B2000-memory.dmp

Filesize
200KB

Download
memory/4612-101-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/4612-103-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/4612-72-0x00000000721C0000-0x000000007220C000-memory.dmp

Filesize
304KB

Download
memory/4612-69-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/4612-67-0x0000000006640000-0x000000000668C000-memory.dmp

Filesize
304KB

Download
memory/4612-106-0x0000000006A30000-0x0000000006A41000-memory.dmp

Filesize
68KB

Download
memory/4612-108-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/4612-57-0x0000000005F90000-0x00000000062E4000-memory.dmp

Filesize
3.3MB

Download
memory/4612-44-0x00000000055E0000-0x0000000005646000-memory.dmp

Filesize
408KB

Download
memory/4612-43-0x00000000054C0000-0x00000000054E2000-memory.dmp

Filesize
136KB

Download
memory/4612-111-0x0000000007C10000-0x0000000007C2A000-memory.dmp

Filesize
104KB

Download
memory/4612-112-0x000000007F5B0000-0x000000007F5C0000-memory.dmp

Filesize
64KB

Download
memory/4612-24-0x0000000005670000-0x0000000005C98000-memory.dmp

Filesize
6.2MB

Download
memory/4612-23-0x0000000002C30000-0x0000000002C40000-memory.dmp

Filesize
64KB

Download
memory/4612-21-0x0000000002B70000-0x0000000002BA6000-memory.dmp

Filesize
216KB

Download
memory/4612-20-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download
memory/4612-121-0x0000000074510000-0x0000000074CC0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads