0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a

General

Target

0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe
Size

2.9MB
MD5

32dfd38036d85d1b0de44e1c6b61cdff
SHA1

d29f730001f6f65b6dfd75682893eef1cbc41b95
SHA256

0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a
SHA512

a4ce001e52022f5aca59af85bd489f141fdb9973214dcc36a86a1704e5ee0ab574d18f4b11c9646c83266c83cd22a16663b671e295c2bf718313ed51652f7da3
SSDEEP

49152:M5JnNd1X1OFPHZXgtN5tI5to9s8Ztl4x/xClHVkmDW/CiC+Z+W:Enh1OFPlTeyCHVzDW/CbS

Score

9^/10

upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 24 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1004-36-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-58-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-60-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-79-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-78-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-72-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-70-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-66-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-62-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-56-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-48-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-46-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-44-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-42-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-76-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-74-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-38-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-68-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-64-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-37-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-54-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-52-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-50-0x0000000010000000-0x000000001003E000-memory.dmp	UPX
behavioral2/memory/1004-40-0x0000000010000000-0x000000001003E000-memory.dmp	UPX

Loads dropped DLL 2 IoCs

Processes:

regsvr32.exe0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe

pid process

2264 regsvr32.exe
1004 0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe

pid	process
2264	regsvr32.exe
1004	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe

UPX packed file 30 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1004-36-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-58-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-60-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-79-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-78-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-72-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-70-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-66-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-62-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-56-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-48-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-46-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-44-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-42-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-76-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-74-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-38-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-68-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-64-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-37-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-54-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-52-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-50-0x0000000010000000-0x000000001003E000-memory.dmp	upx
behavioral2/memory/1004-40-0x0000000010000000-0x000000001003E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\ZCB.dll	upx
behavioral2/memory/2264-83-0x00000000745B0000-0x0000000074873000-memory.dmp	upx
behavioral2/memory/2264-84-0x00000000745B0000-0x0000000074873000-memory.dmp	upx
behavioral2/memory/1004-87-0x00000000745B0000-0x0000000074873000-memory.dmp	upx
behavioral2/memory/1004-89-0x00000000745B0000-0x0000000074873000-memory.dmp	upx
behavioral2/memory/1004-90-0x00000000745B0000-0x0000000074873000-memory.dmp	upx

Modifies registry class 46 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\TypeLib\ = "{D7111ECF-2415-46C6-AAD4-EE6802448456}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.Api	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.Api\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\VersionIndependentProgID\ = "REGCOM.Register.Api"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.Api.1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.Api.1\ = "ZCBApiPlug Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\ = "IZCBApiPlug"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\ = "IZCBApiPlug"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.Api.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\ = "ZCBApiPlug Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.Api.1\CLSID\ = "{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ZCB.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.Api\ = "ZCBApiPlug Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\TypeLib\ = "{D7111ECF-2415-46C6-AAD4-EE6802448456}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\Version\ = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ZCB.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\ProgID\ = "REGCOM.Register.Api.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\ = "ZCB_APILib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7111ECF-2415-46C6-AAD4-EE6802448456}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\REGCOM.Register.Api\CurVer\ = "REGCOM.Register.Api.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9CF66319-AA2F-424A-BEEA-9E42E36BEA1A}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5CF4797-7A19-403B-908C-E9F1CE93135E}\TypeLib\ = "{D7111ECF-2415-46C6-AAD4-EE6802448456}"	regsvr32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe

pid	process
1004	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe
1004	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe
1004	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe

description	pid	process	target process
PID 1004 wrote to memory of 2264	1004	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe	regsvr32.exe
PID 1004 wrote to memory of 2264	1004	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe	regsvr32.exe
PID 1004 wrote to memory of 2264	1004	0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe	regsvr32.exe

C:\Users\Admin\AppData\Local\Temp\0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe
"C:\Users\Admin\AppData\Local\Temp\0b9b5bc00b3976b68d5b111dfb93603aded6b870c26d77553f124452e149534a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1004

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 "C:\Users\Admin\AppData\Local\Temp\ZCB.dll" /s
2⤵
- Loads dropped DLL
- Modifies registry class
PID:2264

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\ZCB.dll

Filesize
1.3MB

MD5
f46c2ce2e26e4f3bd59fffa0bce335b4

SHA1
1c5b61c4d3895066b7191a2baad45d576a2b1bcc

SHA256
ac20d6767ab34d023cfad72403b92febaf3cd88ca5a2250e9b53cde0fc6c0253

SHA512
970067587f22698443276da87bc4b1587e3321171d6f9b01c1061ecd65054d75e113a89f0cf3cdb08d28e6880b9a01c388327c530cf4e419dcd9607eeab8e679

Download Submit
C:\Users\Admin\AppData\Local\Temp\e575644.tmp

Filesize
1.6MB

MD5
4f3387277ccbd6d1f21ac5c07fe4ca68

SHA1
e16506f662dc92023bf82def1d621497c8ab5890

SHA256
767a3fc4a7a6818cdc3f0b99aaa95db694f6bcde719d2057a88b3d4df3d74fac

SHA512
9da199ac69e3c0d4e0c6307e0ab8178f12cc25cb2f14c3511f6b64e6e60a925c860f3263cb38353a97b55a71ef4d27f8cb7fa3cfc08e7c1a349fd8d209dfa219

Download Submit
C:\Users\Admin\AppData\Local\Temp\e575645.tmp

Filesize
1.6MB

MD5
5870ea0d6ba8dd6e2008466bdd00e0f4

SHA1
d41bf60d0dedff90e3cfc1b41b7e1a73df39a7d5

SHA256
5a7dac8c8b5d7cf1115246dfaf994e7f50e16a7eac1488642396f5e23fddfe0d

SHA512
0c620d5e7383adcf979feccc3b1bad584a5cec8b3d74d0ace8bb786f1f04ba87fa70d59d041dc3833977d44a75f2070181d4054c7c0b9c4ce2d66249b4b3c837

Download Submit
C:\Users\Admin\AppData\Local\Temp\e575656.tmp

Filesize
137KB

MD5
f6b847a54cfb804a25b8842b45fd1d50

SHA1
bb22fef07ce1577c8a7fa057d8cf05502c013bfc

SHA256
5dd2f5a957946e0b6f63660ebd897851aad4795d4c847396c47ddbb647715583

SHA512
dd08a55f538e2a33e6a0c496dc97ae9045594cbbf62f7894ae8ded63f4dc0b2e89c5935269adfd1c19607b1d2474bddc49f6acb955e6dc53a55560663ca2137a

Download Submit
memory/1004-42-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-38-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-79-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-78-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-72-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-70-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-66-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-62-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-56-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-48-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-46-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-44-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-58-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-76-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-74-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-60-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-68-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-64-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-37-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-54-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-52-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-50-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-40-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-36-0x0000000010000000-0x000000001003E000-memory.dmp

Filesize
248KB

Download
memory/1004-90-0x00000000745B0000-0x0000000074873000-memory.dmp

Filesize
2.8MB

Download
memory/1004-89-0x00000000745B0000-0x0000000074873000-memory.dmp

Filesize
2.8MB

Download
memory/1004-87-0x00000000745B0000-0x0000000074873000-memory.dmp

Filesize
2.8MB

Download
memory/2264-84-0x00000000745B0000-0x0000000074873000-memory.dmp

Filesize
2.8MB

Download
memory/2264-83-0x00000000745B0000-0x0000000074873000-memory.dmp

Filesize
2.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads