44caliber | 65b6f1f4ac0fbc8a7a113548630b284a731e0b219bee029745f2710b6e02c51c

General

Target

Downloads.exe
Size

411KB
MD5

87ac4c646fd5b62dbabf59fb6ef34fd7
SHA1

45832029b6cfa6c4020ee0e1f965bd5898d5f137
SHA256

65b6f1f4ac0fbc8a7a113548630b284a731e0b219bee029745f2710b6e02c51c
SHA512

b647910eaeaee60b8d2378986bf824dfddfd9b3a4e0f2a8a723406da1a6072bf9171ee12fd0178e027ddfdc4be8fbb4d74f9e94dd470d4342c6711dbe9ea02b7
SSDEEP

12288:Kat0EAH49n8BLaWNO8DlIlaRJ3wWxJS7Xy4WtZ:Ft24saW02pbWO4g

Score

10^/10

44caliber xworm execution rat spyware stealer trojan

Malware Config

Extracted

Family

xworm

C2

127.0.0.1:32901

engineering-thoroughly.gl.at.ply.gg:32901

Attributes

Install_directory
%AppData%
install_file
OxyInstaller.exe

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1253302699978526772/b5mqXVOEs47XQy9dHee2Po12VotJwgdPtLauhKlKoyBH-xF42vUZ2Glc0N58n1pvAEdH

Signatures

44Caliber
An open source infostealer written in C#.
stealer 44caliber

Detect Xworm Payload 2 IoCs

Processes:

resource	yara_rule
C:\Program Files (x86)\sigma\oxyinstaller.exe	family_xworm
behavioral1/memory/400-26-0x0000000000F40000-0x0000000000F98000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid process

4884 powershell.exe
2920 powershell.exe
3532 powershell.exe
3828 powershell.exe

pid	process
4884	powershell.exe
2920	powershell.exe
3532	powershell.exe
3828	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Downloads.exeoxyinstaller.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	Downloads.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	oxyinstaller.exe

Drops startup file 2 IoCs

Processes:

oxyinstaller.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OxyInstaller.lnk	oxyinstaller.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OxyInstaller.lnk	oxyinstaller.exe

Executes dropped EXE 2 IoCs

Processes:

Insidious.exeoxyinstaller.exe

pid process

4024 Insidious.exe
400 oxyinstaller.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 freegeoip.app
23 ip-api.com
4 freegeoip.app

flow	ioc
5	freegeoip.app
23	ip-api.com
4	freegeoip.app

Drops file in Program Files directory 6 IoCs

Processes:

Downloads.exe

description	ioc	process
File created	C:\Program Files (x86)\sigma\__tmp_rar_sfx_access_check_240600187	Downloads.exe
File created	C:\Program Files (x86)\sigma\Insidious.exe	Downloads.exe
File opened for modification	C:\Program Files (x86)\sigma\Insidious.exe	Downloads.exe
File created	C:\Program Files (x86)\sigma\oxyinstaller.exe	Downloads.exe
File opened for modification	C:\Program Files (x86)\sigma\oxyinstaller.exe	Downloads.exe
File opened for modification	C:\Program Files (x86)\sigma	Downloads.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "197"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

Insidious.exepowershell.exepowershell.exepowershell.exetaskmgr.exepowershell.exe

pid	process
4024	Insidious.exe
4024	Insidious.exe
4024	Insidious.exe
2920	powershell.exe
2920	powershell.exe
3532	powershell.exe
3532	powershell.exe
3828	powershell.exe
3828	powershell.exe
2012	taskmgr.exe
2012	taskmgr.exe
4884	powershell.exe
4884	powershell.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious behavior: LoadsDriver 64 IoCs

Processes:

pid	process
4024
3416
4100
2888
2988
2044
684
548
3044
1612
1552
2356
3724
3496
404
2340
1144
4000
2232
3712
3568
668
2412
3544
4536
2308
3132
3944
968
3376
2864
3880
2064
4112
872
1064
4564
3904
4328
4344
3808
4336
4576
4644
3232
2476
4972
2388
1496
4136
4396
4172
1680
5044
1864
2040
4652
4680
1792
624
3036
4676
5116
4508

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

Insidious.exeoxyinstaller.exepowershell.exepowershell.exepowershell.exetaskmgr.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	4024	Insidious.exe
Token: SeDebugPrivilege	400	oxyinstaller.exe
Token: SeDebugPrivilege	2920	powershell.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	3828	powershell.exe
Token: SeDebugPrivilege	2012	taskmgr.exe
Token: SeSystemProfilePrivilege	2012	taskmgr.exe
Token: SeCreateGlobalPrivilege	2012	taskmgr.exe
Token: SeDebugPrivilege	4884	powershell.exe
Token: SeDebugPrivilege	400	oxyinstaller.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

taskmgr.exe

pid	process
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

taskmgr.exe

pid	process
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe
2012	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

LogonUI.exe

pid process

980 LogonUI.exe

pid	process
980	LogonUI.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Downloads.exeoxyinstaller.exe

description	pid	process	target process
PID 2516 wrote to memory of 4024	2516	Downloads.exe	Insidious.exe
PID 2516 wrote to memory of 4024	2516	Downloads.exe	Insidious.exe
PID 2516 wrote to memory of 400	2516	Downloads.exe	oxyinstaller.exe
PID 2516 wrote to memory of 400	2516	Downloads.exe	oxyinstaller.exe
PID 400 wrote to memory of 2920	400	oxyinstaller.exe	powershell.exe
PID 400 wrote to memory of 2920	400	oxyinstaller.exe	powershell.exe
PID 400 wrote to memory of 3532	400	oxyinstaller.exe	powershell.exe
PID 400 wrote to memory of 3532	400	oxyinstaller.exe	powershell.exe
PID 400 wrote to memory of 3828	400	oxyinstaller.exe	powershell.exe
PID 400 wrote to memory of 3828	400	oxyinstaller.exe	powershell.exe
PID 400 wrote to memory of 4884	400	oxyinstaller.exe	powershell.exe
PID 400 wrote to memory of 4884	400	oxyinstaller.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\Downloads.exe
"C:\Users\Admin\AppData\Local\Temp\Downloads.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\sigma\Insidious.exe
  "C:\Program Files (x86)\sigma\Insidious.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4024
- C:\Program Files (x86)\sigma\oxyinstaller.exe
  "C:\Program Files (x86)\sigma\oxyinstaller.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Program Files (x86)\sigma\oxyinstaller.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2920
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'oxyinstaller.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\OxyInstaller.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'OxyInstaller.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4884

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2012

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3978055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

2

T1552

Credentials In Files

2

T1552.001

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Data from Local System

2

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\sigma\Insidious.exe

Filesize
303KB

MD5
eefb066dcbb1ae4273c3834f74881a25

SHA1
013657673cb6fbdc4a04db2a4d01332d9ec37363

SHA256
9a23c010ab4bdd266a109740796baecc5b4eb583c1fe8d94b53961a029ca7cc2

SHA512
8d5eab85b0a56351bfc56a4940c1097bc3abb93e003135cdacc3e4cbf5b6a464bb3f46750c1466f1ddcffd265f52abf74951eda632d7b31dbd0b7e38c0d99741

Download Submit
C:\Program Files (x86)\sigma\oxyinstaller.exe

Filesize
325KB

MD5
f65b6e70becdeafa363cd101646a0602

SHA1
1c6ebde3a18aa9ba02202e8ef4139f6c8bbf0c68

SHA256
e304be47ba6bd5a80284e6750f4c97181134e9daa0f581c8c47a665084e49555

SHA512
409601c4f5f8c4856d77aded96d466f3f9f057bf1edd635de8db42a946478aed467145249bdc6243d2df0172007b76345550b937d8191c403806ce0a755f21fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
98baf5117c4fcec1692067d200c58ab3

SHA1
5b33a57b72141e7508b615e17fb621612cb8e390

SHA256
30bf8496e9a08f4fdfe4767abcd565f92b6da06ca1c7823a70cb7cab16262e51

SHA512
344a70bfc037d54176f12db91f05bf4295bb587a5062fd1febe6f52853571170bd8ef6042cb87b893185bbae1937cf77b679d7970f8cc1c2666b0b7c1b32987d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
50632ca0f9f268214d6838e8b7c1fe6f

SHA1
5597251238406133385670a63c0b2c3958712f98

SHA256
507b78ee9c8e87d59684d3d2cfed038d896b8f9c37c6c36a2a32ef1777eef3dd

SHA512
d9997fbd906311e72a928dbcf474dfdd4869a49729e32cec6c529adbb8e48257c21bec4b79b48e396de239b8ea3c668a1eb1092fcbeb09c0b81094da3228c433

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vv4guqwj.jhk.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OxyInstaller.lnk

Filesize
798B

MD5
7c111b0c33535e19e32bbc0efd2a9970

SHA1
07719cd7ee99c57727e95eb4c132b3f2f562299f

SHA256
73e31410099723752c22242ae324497fee3170be7d0ade3f17fc9456140ad65c

SHA512
09b2e8d313d2b31bd143c304ae4e9262d91489f190d99e79767887c75e0f54270fd315e8bc1826f28dfdf31e4124e09f4c1cee005faf2ef074d6c42ba1078daf

Download Submit
memory/400-124-0x00007FFBF7540000-0x00007FFBF8001000-memory.dmp

Filesize
10.8MB

Download
memory/400-26-0x0000000000F40000-0x0000000000F98000-memory.dmp

Filesize
352KB

Download
memory/400-52-0x00007FFBF7540000-0x00007FFBF8001000-memory.dmp

Filesize
10.8MB

Download
memory/2012-116-0x000001F94F790000-0x000001F94F791000-memory.dmp

Filesize
4KB

Download
memory/2012-113-0x000001F94F790000-0x000001F94F791000-memory.dmp

Filesize
4KB

Download
memory/2012-111-0x000001F94F790000-0x000001F94F791000-memory.dmp

Filesize
4KB

Download
memory/2012-105-0x000001F94F790000-0x000001F94F791000-memory.dmp

Filesize
4KB

Download
memory/2012-107-0x000001F94F790000-0x000001F94F791000-memory.dmp

Filesize
4KB

Download
memory/2012-106-0x000001F94F790000-0x000001F94F791000-memory.dmp

Filesize
4KB

Download
memory/2012-117-0x000001F94F790000-0x000001F94F791000-memory.dmp

Filesize
4KB

Download
memory/2012-112-0x000001F94F790000-0x000001F94F791000-memory.dmp

Filesize
4KB

Download
memory/2012-115-0x000001F94F790000-0x000001F94F791000-memory.dmp

Filesize
4KB

Download
memory/2012-114-0x000001F94F790000-0x000001F94F791000-memory.dmp

Filesize
4KB

Download
memory/2920-59-0x000001A350CD0000-0x000001A350CF2000-memory.dmp

Filesize
136KB

Download
memory/4024-57-0x00007FFBF7540000-0x00007FFBF8001000-memory.dmp

Filesize
10.8MB

Download
memory/4024-58-0x00007FFBF7540000-0x00007FFBF8001000-memory.dmp

Filesize
10.8MB

Download
memory/4024-24-0x00007FFBF7543000-0x00007FFBF7545000-memory.dmp

Filesize
8KB

Download
memory/4024-25-0x0000024A7A540000-0x0000024A7A592000-memory.dmp

Filesize
328KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads