gh0strat | cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e

General

Target

cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
Size

1.5MB
MD5

3232dd1fe39974d4c420656906861e77
SHA1

ef342366eeb045f7ffe20cf1fb1bcf80350836d0
SHA256

cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e
SHA512

44c37b7b9e0371cd85359fb66e0f2cab4cbec427d9c239b12f041f81f3c742de2a86e2a2db20368d45fe605840947b9f70ecccccbc7db557b3e7482d4e400c4a
SSDEEP

24576:F09tv9/7JtDElDEExIko2H2HESq2eWJ6MQjySjy+ygWDVD:F09XJt4HIN2H2tFvduySAg2VD

Score

10^/10

gh0strat purplefox persistence rat rootkit trojan upx

Malware Config

Signatures

Detect PurpleFox Rootkit 12 IoCs

Detect PurpleFox Rootkit.

rootkit

Processes:

resource	yara_rule
behavioral2/memory/5096-6-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/5096-8-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/5096-7-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1456-15-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1456-16-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1456-17-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3948-28-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3948-29-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3948-32-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/5096-34-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/1456-35-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit
behavioral2/memory/3948-36-0x0000000010000000-0x00000000101B6000-memory.dmp	purplefox_rootkit

Gh0st RAT payload 12 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5096-6-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/5096-8-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/5096-7-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1456-15-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1456-16-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1456-17-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3948-28-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3948-29-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3948-32-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/5096-34-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/1456-35-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat
behavioral2/memory/3948-36-0x0000000010000000-0x00000000101B6000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Drops file in Drivers directory 1 IoCs

Processes:

TXPlatforn.exe

description ioc process

File created C:\Windows\system32\drivers\QAssist.sys TXPlatforn.exe

description	ioc	process
File created	C:\Windows\system32\drivers\QAssist.sys	TXPlatforn.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

TXPlatforn.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	TXPlatforn.exe

Executes dropped EXE 4 IoCs

Processes:

RVN.exeTXPlatforn.exeHD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exeTXPlatforn.exe

pid process

5096 RVN.exe
1456 TXPlatforn.exe
664 HD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
3948 TXPlatforn.exe

pid	process
5096	RVN.exe
1456	TXPlatforn.exe
664	HD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
3948	TXPlatforn.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/5096-4-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5096-6-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5096-8-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5096-7-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1456-15-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1456-16-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1456-17-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1456-13-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3948-28-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3948-29-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3948-32-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/5096-34-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/1456-35-0x0000000010000000-0x00000000101B6000-memory.dmp	upx
behavioral2/memory/3948-36-0x0000000010000000-0x00000000101B6000-memory.dmp	upx

Drops file in System32 directory 2 IoCs

Processes:

RVN.exe

description ioc process

File created C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe
File opened for modification C:\Windows\SysWOW64\TXPlatforn.exe RVN.exe

description	ioc	process
File created	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe
File opened for modification	C:\Windows\SysWOW64\TXPlatforn.exe	RVN.exe

Drops file in Program Files directory 5 IoCs

Processes:

cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
File created	C:\Program Files (x86)\Google\Chrome\Application\chrome.exe	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

4924 PING.EXE

pid	process
4924	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe

pid	process
2296	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
2296	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

TXPlatforn.exe

pid process

3948 TXPlatforn.exe

pid	process
3948	TXPlatforn.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

RVN.exeTXPlatforn.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	5096	RVN.exe
Token: SeLoadDriverPrivilege	3948	TXPlatforn.exe
Token: 33	3948	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	3948	TXPlatforn.exe
Token: 33	3948	TXPlatforn.exe
Token: SeIncBasePriorityPrivilege	3948	TXPlatforn.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe

pid	process
2296	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
2296	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exeRVN.exeTXPlatforn.execmd.exeHD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe

description	pid	process	target process
PID 2296 wrote to memory of 5096	2296	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe	RVN.exe
PID 2296 wrote to memory of 5096	2296	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe	RVN.exe
PID 2296 wrote to memory of 5096	2296	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe	RVN.exe
PID 5096 wrote to memory of 4764	5096	RVN.exe	cmd.exe
PID 5096 wrote to memory of 4764	5096	RVN.exe	cmd.exe
PID 5096 wrote to memory of 4764	5096	RVN.exe	cmd.exe
PID 2296 wrote to memory of 664	2296	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe	HD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
PID 2296 wrote to memory of 664	2296	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe	HD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
PID 2296 wrote to memory of 664	2296	cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe	HD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
PID 1456 wrote to memory of 3948	1456	TXPlatforn.exe	TXPlatforn.exe
PID 1456 wrote to memory of 3948	1456	TXPlatforn.exe	TXPlatforn.exe
PID 1456 wrote to memory of 3948	1456	TXPlatforn.exe	TXPlatforn.exe
PID 4764 wrote to memory of 4924	4764	cmd.exe	PING.EXE
PID 4764 wrote to memory of 4924	4764	cmd.exe	PING.EXE
PID 4764 wrote to memory of 4924	4764	cmd.exe	PING.EXE
PID 664 wrote to memory of 2992	664	HD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe	msedge.exe
PID 664 wrote to memory of 2992	664	HD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
"C:\Users\Admin\AppData\Local\Temp\cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2296

C:\Users\Admin\AppData\Local\Temp\RVN.exe
C:\Users\Admin\AppData\Local\Temp\\RVN.exe
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5096

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\RVN.exe > nul
3⤵
- Suspicious use of WriteProcessMemory
PID:4764

C:\Windows\SysWOW64\PING.EXE
ping -n 2 127.0.0.1
4⤵
- Runs ping.exe
PID:4924

C:\Users\Admin\AppData\Local\Temp\HD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
C:\Users\Admin\AppData\Local\Temp\HD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qqgame.qq.com/download.shtml
3⤵
PID:2992

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -auto
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\TXPlatforn.exe
C:\Windows\SysWOW64\TXPlatforn.exe -acsi
2⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=3644 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=4284 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4596 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5460 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:1
1⤵
PID:504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4940 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=5676 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\VideoLAN\VLC\vlc.exe

Filesize
2.3MB

MD5
e2f92d5719b7f700cfb62e4154608ec4

SHA1
0a90dbde59577700cc44fc05b05d02dcc83ff3e6

SHA256
2ef33b8bb12b2e7c4b76ead83d8c993927c81cadf02801d43fc85c354471724d

SHA512
832441b7eadea1f7007946c31628853e473e8874887642f7dbe29d792ce64584b2d5666f4f7b274ff6753a1f2fc6bee657f6b3dec360a0087937b6c10a4351d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.3MB

MD5
50baf78c236743c8796ad40ab83d2196

SHA1
41027a7ce66ca2e22dc03ddc3bb03c2759153fd7

SHA256
1530502e8e91f41dc93bda3887e776c859ca4a9904ccccadc9456d65aa556ba7

SHA512
c6172cbc61bb08d00e5c4aa8a44fff670816fd96f956949f1a6bde62d6e5d5764a24c694fac8ec32fdfd11df6652f0851d246959b609a7b149d505d82af6b27a

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_X.dat

Filesize
1.4MB

MD5
980d692654e6fb9232113f69d0aa8316

SHA1
ae2d1de5dff06d4f700572ba443a12b759dfa08e

SHA256
3eb528c4e9c1aafb04dc447af33aed40eeebb1e53dea76dad87e5315e010f5df

SHA512
6c9fc2b7969ed63442da8d991e16292a51d76bf4577cc078edab8c88cbbc71a7421ef3f938f9b010e941009c94d87f8c4cb7aac8f503cbfbb4cd01d893daee8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\HD_cbdf429298f272cd8248f68f0ecce4d97170a93698a4a9a145b745488f4c491e.exe

Filesize
198KB

MD5
26ad88629608fbdd06212a4ca11362d1

SHA1
8aa8791c5d18b8192623380082e044ab5f5bf99b

SHA256
5b0493551e2be141fa80d7ee577b40406606a27410a7b326401569df70eec878

SHA512
82d60898a8955f5c107dbac7108120cd432752cc1b267bc59c9be2a1eff6c0f6172ef31af49d8f24a287c97ad4521eeec26992091678b7334aa03a5d56180d7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\RVN.exe

Filesize
377KB

MD5
80ade1893dec9cab7f2e63538a464fcc

SHA1
c06614da33a65eddb506db00a124a3fc3f5be02e

SHA256
57a920389c044e3f5cf93dabff67070b4511e79779b6f874e08f92d8b0d7afbd

SHA512
fffd4f3fccb5301b3c7a5b3bd92747f31549fbd9d0803fe5d502d1bb0ef979140988718c2ee1406ed3e755790d275185e120a56cbcb5ed2eadf62b5cdbfc4cc4

Download Submit
C:\Users\Admin\AppData\Local\Temp\X.ico

Filesize
69KB

MD5
e33fb6d686b1a8b171349572c5a33f67

SHA1
29f24fe536adf799b69b63c83efadc1bce457a54

SHA256
020c8e0963f89f4b14538b7d69e83c6fec44a29bbbd52fbb6deb2be5c697f450

SHA512
cf1f1d6a9efe53f84e5b4a8246b87c0b96496716605d1b00352d9aae30e664d3d2cbadebf598b4e690a9feef0b5785887a4e643cc5f68938ca744af1d3539e55

Download Submit
memory/1456-35-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1456-15-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1456-16-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1456-17-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/1456-13-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3948-28-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3948-32-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3948-29-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/3948-36-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/5096-34-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/5096-7-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/5096-8-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/5096-6-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download
memory/5096-4-0x0000000010000000-0x00000000101B6000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads