894d3fcd2439db97e252dbfe5fb555843e7f21ccd90b7cd1e48c3f3f9bf231cd

General

Target

DELTA`S SUPPORT TOOL.exe
Size

3.0MB
MD5

551c01bff1bdf4bdbe89a0ee348f54e4
SHA1

a0e033049541b5cd73f1212efe6273229409408b
SHA256

894d3fcd2439db97e252dbfe5fb555843e7f21ccd90b7cd1e48c3f3f9bf231cd
SHA512

40d5fceccd7241ae858bd287a9168c535cf49b25eb482f5361dee67f7a5447762a849a468427996bcaf7c85ae8bbb05c84324a6cc180e5431e6b7eeb07e5a435
SSDEEP

49152:8xmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxuihz4sX:8xx9NUFkQx753uWuCyyxuiH

Score

10^/10

evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 6 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exeDELTA`S SUPPORT TOOL.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	icsys.icn.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DELTA`S SUPPORT TOOL.exe

Checks BIOS information in registry 2 TTPs 12 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

spoolsv.exeicsys.icn.exeexplorer.exesvchost.exespoolsv.exeDELTA`S SUPPORT TOOL.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	icsys.icn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DELTA`S SUPPORT TOOL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DELTA`S SUPPORT TOOL.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	icsys.icn.exe

Executes dropped EXE 6 IoCs

Processes:

delta`s support tool.exe icsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2864 delta`s support tool.exe
5072 icsys.icn.exe
5088 explorer.exe
4516 spoolsv.exe
236 svchost.exe
1200 spoolsv.exe

pid	process
2864	delta`s support tool.exe
5072	icsys.icn.exe
5088	explorer.exe
4516	spoolsv.exe
236	svchost.exe
1200	spoolsv.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/3368-0-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
C:\Windows\Resources\Themes\icsys.icn.exe	themida
behavioral1/memory/5072-15-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
\??\c:\windows\resources\themes\explorer.exe	themida
behavioral1/memory/5088-25-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
C:\Windows\Resources\spoolsv.exe	themida
behavioral1/memory/4516-34-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
C:\Windows\Resources\svchost.exe	themida
behavioral1/memory/236-43-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/1200-48-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/4516-55-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/5072-58-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/3368-59-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/1200-54-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/5088-60-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/236-61-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 6 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exeDELTA`S SUPPORT TOOL.exeicsys.icn.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DELTA`S SUPPORT TOOL.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	icsys.icn.exe

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs

Processes:

DELTA`S SUPPORT TOOL.exeicsys.icn.exedelta`s support tool.exe explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

3368 DELTA`S SUPPORT TOOL.exe
5072 icsys.icn.exe
2864 delta`s support tool.exe
5088 explorer.exe
4516 spoolsv.exe
236 svchost.exe
1200 spoolsv.exe

Drops file in Windows directory 4 IoCs

Processes:

explorer.exespoolsv.exeDELTA`S SUPPORT TOOL.exeicsys.icn.exe

description	ioc	process
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\Themes\icsys.icn.exe	DELTA`S SUPPORT TOOL.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	icsys.icn.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

DELTA`S SUPPORT TOOL.exeicsys.icn.exe

pid	process
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5072	icsys.icn.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

5088 explorer.exe
236 svchost.exe

pid	process
5088	explorer.exe
236	svchost.exe

Suspicious use of SetWindowsHookEx 12 IoCs

Processes:

DELTA`S SUPPORT TOOL.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
3368	DELTA`S SUPPORT TOOL.exe
3368	DELTA`S SUPPORT TOOL.exe
5072	icsys.icn.exe
5072	icsys.icn.exe
5088	explorer.exe
5088	explorer.exe
4516	spoolsv.exe
4516	spoolsv.exe
236	svchost.exe
236	svchost.exe
1200	spoolsv.exe
1200	spoolsv.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

DELTA`S SUPPORT TOOL.exeicsys.icn.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 3368 wrote to memory of 2864	3368	DELTA`S SUPPORT TOOL.exe	delta`s support tool.exe
PID 3368 wrote to memory of 2864	3368	DELTA`S SUPPORT TOOL.exe	delta`s support tool.exe
PID 3368 wrote to memory of 5072	3368	DELTA`S SUPPORT TOOL.exe	icsys.icn.exe
PID 3368 wrote to memory of 5072	3368	DELTA`S SUPPORT TOOL.exe	icsys.icn.exe
PID 3368 wrote to memory of 5072	3368	DELTA`S SUPPORT TOOL.exe	icsys.icn.exe
PID 5072 wrote to memory of 5088	5072	icsys.icn.exe	explorer.exe
PID 5072 wrote to memory of 5088	5072	icsys.icn.exe	explorer.exe
PID 5072 wrote to memory of 5088	5072	icsys.icn.exe	explorer.exe
PID 5088 wrote to memory of 4516	5088	explorer.exe	spoolsv.exe
PID 5088 wrote to memory of 4516	5088	explorer.exe	spoolsv.exe
PID 5088 wrote to memory of 4516	5088	explorer.exe	spoolsv.exe
PID 4516 wrote to memory of 236	4516	spoolsv.exe	svchost.exe
PID 4516 wrote to memory of 236	4516	spoolsv.exe	svchost.exe
PID 4516 wrote to memory of 236	4516	spoolsv.exe	svchost.exe
PID 236 wrote to memory of 1200	236	svchost.exe	spoolsv.exe
PID 236 wrote to memory of 1200	236	svchost.exe	spoolsv.exe
PID 236 wrote to memory of 1200	236	svchost.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\DELTA`S SUPPORT TOOL.exe
"C:\Users\Admin\AppData\Local\Temp\DELTA`S SUPPORT TOOL.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3368

\??\c:\users\admin\appdata\local\temp\delta`s support tool.exe
"c:\users\admin\appdata\local\temp\delta`s support tool.exe "
2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2864

C:\Windows\Resources\Themes\icsys.icn.exe
C:\Windows\Resources\Themes\icsys.icn.exe
2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5072

\??\c:\windows\resources\themes\explorer.exe
c:\windows\resources\themes\explorer.exe
3⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5088

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe SE
4⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4516

\??\c:\windows\resources\svchost.exe
c:\windows\resources\svchost.exe
5⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe PR
6⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1200

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Modify Registry

2

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\delta`s support tool.exe
Filesize
505KB

MD5
521a361fe8fb6d8c560a00a2c15452e7

SHA1
7d04366a6e6544664937bd7702fec0996d0c2973

SHA256
39dd835e5e53956a03122cf97f763e0faeb25817d2fd3c3d386eb3e3894e7115

SHA512
74f3fbc8d6100dd4d7a96aae98547d5ee1ffbe37aaaaa275976a66566f4db00a38690b9184d65ff38d37a2c93536021ee632ed74ef2f2cc9863dbf997f17f1af

Download Submit
C:\Windows\Resources\Themes\icsys.icn.exe
Filesize
2.5MB

MD5
4e4155d335db93b23e7ba179eba04c24

SHA1
cf735e9276b453894c4f3f7fed06e29d7c950992

SHA256
5020c6bc994a406c47f198c3407aa053304b3df5470be16c98c18da565ab6c78

SHA512
c5c150b2d21fddf31b74d8da29d566b49c0b8ad731c7eb0c7c5a954254630397f235913062d2e0daa0dcb688223f6e69f59508eaecac26e1a7134f7e7db88199

Download Submit
C:\Windows\Resources\spoolsv.exe
Filesize
2.5MB

MD5
2d8701c1f6c75e2fbf8c9776dd88e733

SHA1
3631ffa4682cf9c6587b5d7132cbe7185c4337a5

SHA256
a4973e0be14da854b0b96af4dc9e88140b9af5ac0a099056030fdf51a1f11e0c

SHA512
b19ab0193d8350dfc245dd0521f334c96cff1cec330e478b2cf2fbb65018606a8c81712bdd66b408dffefcfbc77598880d613585c75c1344766238d133dd26d6

Download Submit
C:\Windows\Resources\svchost.exe
Filesize
2.5MB

MD5
580de3b91a58bde507c6c6d0df2871ae

SHA1
d5beb192b535f3c033500270aed97c88ac9f3124

SHA256
86bd8f0be067e116e57dd7f494071d799b682759c6ce623a9d3b154b5f68d7e0

SHA512
7c95e55d7b8138eade53cbfa4b690c61873b83698ef08a80756f3cf4ee528b5524ecff4afe047553a9025b3fdd04c004ba7ee737482e7e55556b200298dfaaef

Download Submit
\??\c:\windows\resources\themes\explorer.exe
Filesize
2.5MB

MD5
7785d96212b3459e9e07cfe59b2c0c61

SHA1
14432c9d3eaaa790fc1ddd8712fcdd44dbbf771b

SHA256
d792523f22c89475dd49457d371bcb76e54638b3cfc4b1a0f768f467cc44be51

SHA512
dbcd06b99f9b278ea8cae2064a6a79d045ab14524ae539a6c4d2ef13214306729de2ae90237489a4b453b72141455c1e70060f6bcb8380380e510dae7cdcfae1

Download Submit
memory/236-61-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/236-43-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/1200-54-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/1200-48-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2864-11-0x00007FFB141D3000-0x00007FFB141D4000-memory.dmp

Filesize
4KB

Download
memory/2864-16-0x00000227EED60000-0x00000227EED61000-memory.dmp

Filesize
4KB

Download
memory/2864-62-0x00007FFB141D3000-0x00007FFB141D4000-memory.dmp

Filesize
4KB

Download
memory/2864-13-0x00000227ED150000-0x00000227ED224000-memory.dmp

Filesize
848KB

Download
memory/3368-59-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/3368-1-0x0000000077D14000-0x0000000077D15000-memory.dmp

Filesize
4KB

Download
memory/3368-0-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/4516-55-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/4516-34-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/5072-58-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/5072-15-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/5088-60-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/5088-25-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads