kpot | d68f6d33a336efaf6e8fc65f5c45acaeb060af5c036f05d2f9f18b3a12293362

Analysis

max time kernel
138s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d68f6d33a336efaf6e8fc65f5c45acaeb060af5c036f05d2f9f18b3a12293362.exe
Size 1.2MB
Sample240419-d214vsfe27
SHA256 d68f6d33a336efaf6e8fc65f5c45acaeb060af5c036f05d2f9f18b3a12293362
MD5 c6775bc24570fa95cb70492888acba2c
SHA1 0aaa5f046b308ebd001cc3416a76870c7eaa9f38
SHA512 7f3dab895bcd533b041a50df86dd994f92043e2d517d23c6af34dc0a212cbc93016e29df9329d7f76c5dddc6adde1edffb9c2bc4d1d60aa1fbc92c9545e5df7a
SSDEEP 24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1SdrzRjVYaQ/n2lbcMfcuT2:E5aIwC+Agr6S/FYqOc27T2
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

kpot trickbot banker stealer trojan

Malware Config

Signatures

KPOT
KPOT is an information stealer that steals user data and account credentials.
trojan stealer kpot

KPOT Core Executable 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023403-22.dat	family_kpot

Trickbot
Developed in 2016, TrickBot is one of the more recent banking Trojans.
trojan banker trickbot

Trickbot x86 loader 9 IoCs

Detected Trickbot's x86 loader that unpacks the x86 payload.

resource	yara_rule
behavioral2/memory/4812-15-0x0000000002220000-0x0000000002249000-memory.dmp	trickbot_loader32
behavioral2/memory/4812-19-0x0000000002220000-0x0000000002249000-memory.dmp	trickbot_loader32
behavioral2/memory/4812-25-0x0000000002220000-0x0000000002249000-memory.dmp	trickbot_loader32
behavioral2/memory/5048-47-0x0000000002FD0000-0x0000000002FF9000-memory.dmp	trickbot_loader32
behavioral2/memory/5048-59-0x0000000002FD0000-0x0000000002FF9000-memory.dmp	trickbot_loader32
behavioral2/memory/3352-80-0x0000000000DB0000-0x0000000000DD9000-memory.dmp	trickbot_loader32
behavioral2/memory/3352-94-0x0000000000DB0000-0x0000000000DD9000-memory.dmp	trickbot_loader32
behavioral2/memory/3904-122-0x00000000016E0000-0x0000000001709000-memory.dmp	trickbot_loader32
behavioral2/memory/3904-131-0x00000000016E0000-0x0000000001709000-memory.dmp	trickbot_loader32

Executes dropped EXE 3 IoCs

pid	Process
5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTcbPrivilege	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
Token: SeTcbPrivilege	3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4812	d68f6d33a336efaf6e8fc65f5c45acaeb060af5c036f05d2f9f18b3a12293362.exe
5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 5048	4812	d68f6d33a336efaf6e8fc65f5c45acaeb060af5c036f05d2f9f18b3a12293362.exe	88
PID 4812 wrote to memory of 5048	4812	d68f6d33a336efaf6e8fc65f5c45acaeb060af5c036f05d2f9f18b3a12293362.exe	88
PID 4812 wrote to memory of 5048	4812	d68f6d33a336efaf6e8fc65f5c45acaeb060af5c036f05d2f9f18b3a12293362.exe	88
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 5048 wrote to memory of 3216	5048	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	89
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3352 wrote to memory of 4456	3352	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	99
PID 3904 wrote to memory of 2860	3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	101
PID 3904 wrote to memory of 2860	3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	101
PID 3904 wrote to memory of 2860	3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	101
PID 3904 wrote to memory of 2860	3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	101
PID 3904 wrote to memory of 2860	3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	101
PID 3904 wrote to memory of 2860	3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	101
PID 3904 wrote to memory of 2860	3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	101
PID 3904 wrote to memory of 2860	3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	101
PID 3904 wrote to memory of 2860	3904	d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\d68f6d33a336efaf6e8fc65f5c45acaeb060af5c036f05d2f9f18b3a12293362.exe
"C:\Users\Admin\AppData\Local\Temp\d68f6d33a336efaf6e8fc65f5c45acaeb060af5c036f05d2f9f18b3a12293362.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Roaming\WinSocket\d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
  C:\Users\Admin\AppData\Roaming\WinSocket\d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:3216

C:\Users\Admin\AppData\Roaming\WinSocket\d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
C:\Users\Admin\AppData\Roaming\WinSocket\d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:4456

C:\Users\Admin\AppData\Roaming\WinSocket\d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
C:\Users\Admin\AppData\Roaming\WinSocket\d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe

Path C:\Users\Admin\AppData\Roaming\WinSocket\d79f7d33a337efaf7e9fc76f6c46acaeb070af6c037f06d2f9f19b3a12293372.exe
Size 1.2MB
SHA256 d68f6d33a336efaf6e8fc65f5c45acaeb060af5c036f05d2f9f18b3a12293362
MD5 c6775bc24570fa95cb70492888acba2c
SHA1 0aaa5f046b308ebd001cc3416a76870c7eaa9f38
SHA512 7f3dab895bcd533b041a50df86dd994f92043e2d517d23c6af34dc0a212cbc93016e29df9329d7f76c5dddc6adde1edffb9c2bc4d1d60aa1fbc92c9545e5df7a
SSDEEP 24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1SdrzRjVYaQ/n2lbcMfcuT2:E5aIwC+Agr6S/FYqOc27T2
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Roaming\WinSocket\settings.ini
Size 39KB
SHA256 91259b9a9a165ed5d310bd3550627c2c8fc64b55726802d46d96003f7935256f
MD5 30e97eaa8e071cd16dba2d80a5f4cfd9
SHA1 1d375b84b572bc14c3b2c4f45ccac8401422e0a1
SHA512 8132641bab5c8f79dc76f643b239194b684d2365cd3440285cade3fab533fb7ae47c35e8b626b3d5419d93a7f7446f6a344f91f0d7ab31ecfcb372b9bb0d50d8
SSDEEP 768:NFLBTqpWW9WmmHXMDpGVvBDBjmMXI84PnzA78zMmvD7HUALb74pqlh6RESAP7ydp:WicmaT66c
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3216-52-0x00000229D74A0000-0x00000229D74A1000-memory.dmp

Download

memory/3216-53-0x0000000010000000-0x000000001001E000-memory.dmp

Download

memory/3352-94-0x0000000000DB0000-0x0000000000DD9000-memory.dmp

Download

memory/3352-91-0x0000000001C40000-0x0000000001CFE000-memory.dmp

Download

memory/3352-75-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-64-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-65-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-66-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-67-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-68-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-69-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-70-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-71-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-80-0x0000000000DB0000-0x0000000000DD9000-memory.dmp

Download

memory/3352-92-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/3352-79-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-78-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3352-72-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-73-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3352-74-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/3904-128-0x0000000001710000-0x0000000001711000-memory.dmp

Download

memory/3904-122-0x00000000016E0000-0x0000000001709000-memory.dmp

Download

memory/3904-116-0x0000000000510000-0x0000000000511000-memory.dmp

Download

memory/3904-115-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/3904-131-0x00000000016E0000-0x0000000001709000-memory.dmp

Download

memory/4812-18-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-25-0x0000000002220000-0x0000000002249000-memory.dmp

Download

memory/4812-3-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-4-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-6-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-5-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-8-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-7-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-9-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-11-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-10-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-12-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-14-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-13-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-15-0x0000000002220000-0x0000000002249000-memory.dmp

Download

memory/4812-19-0x0000000002220000-0x0000000002249000-memory.dmp

Download

memory/4812-2-0x0000000002140000-0x0000000002141000-memory.dmp

Download

memory/4812-17-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5048-36-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-58-0x0000000003160000-0x0000000003429000-memory.dmp

Download

memory/5048-29-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-28-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-31-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-33-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-32-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-34-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-59-0x0000000002FD0000-0x0000000002FF9000-memory.dmp

Download

memory/5048-30-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-57-0x0000000003060000-0x000000000311E000-memory.dmp

Download

memory/5048-38-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-35-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-51-0x0000000003040000-0x0000000003041000-memory.dmp

Download

memory/5048-47-0x0000000002FD0000-0x0000000002FF9000-memory.dmp

Download

memory/5048-42-0x0000000000400000-0x0000000000472000-memory.dmp

Download

memory/5048-44-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-45-0x0000000010000000-0x0000000010007000-memory.dmp

Download

memory/5048-39-0x0000000002270000-0x0000000002271000-memory.dmp

Download

memory/5048-37-0x0000000002270000-0x0000000002271000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads