njrat | 87d0845412d5ad22a56954c151f0ae21cba71d2284189fdb0d3c6cb93b6282eb

Analysis

max time kernel
34s
max time network
62s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 13:59

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

gu.exe
Size

37KB
MD5

5623a039c27a4c274b375c83e42651d4
SHA1

877caa65809f345247c37d0bf64a49b1abda1e60
SHA256

87d0845412d5ad22a56954c151f0ae21cba71d2284189fdb0d3c6cb93b6282eb
SHA512

3f896c083919d310b4715d267dfccf57e10c8ba67a33f4feb1a6839cb97b922868339b9f448a5ad4360229837c030a03465337ec1aaba7d4fca64b8a31c00fd2
SSDEEP

768:/y0yQEkNVfCNWtkriwFYbMLrM+rMRa8NuOyt:hVqNWimwy4U+gRJNx

Score

10^/10

njrat gu evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

127.0.0.1:2323

Mutex

b7f2f50a5eff21f2499c81ed48fee825

Attributes

reg_key
b7f2f50a5eff21f2499c81ed48fee825
splitter
|'|'|

Signatures

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2892	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
1300	server.exe

Loads dropped DLL 1 IoCs

pid	Process
1916	gu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\NetSh	netsh.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe
1300	server.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	1300	server.exe
Token: 33	1300	server.exe
Token: SeIncBasePriorityPrivilege	1300	server.exe
Token: 33	1300	server.exe
Token: SeIncBasePriorityPrivilege	1300	server.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: 33	1300	server.exe
Token: SeIncBasePriorityPrivilege	1300	server.exe
Token: SeShutdownPrivilege	2664	chrome.exe
Token: SeShutdownPrivilege	2664	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe
2664	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 1300	1916	gu.exe	28
PID 1916 wrote to memory of 1300	1916	gu.exe	28
PID 1916 wrote to memory of 1300	1916	gu.exe	28
PID 1916 wrote to memory of 1300	1916	gu.exe	28
PID 1300 wrote to memory of 2892	1300	server.exe	29
PID 1300 wrote to memory of 2892	1300	server.exe	29
PID 1300 wrote to memory of 2892	1300	server.exe	29
PID 1300 wrote to memory of 2892	1300	server.exe	29
PID 2664 wrote to memory of 2728	2664	chrome.exe	32
PID 2664 wrote to memory of 2728	2664	chrome.exe	32
PID 2664 wrote to memory of 2728	2664	chrome.exe	32
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 296	2664	chrome.exe	34
PID 2664 wrote to memory of 2600	2664	chrome.exe	35
PID 2664 wrote to memory of 2600	2664	chrome.exe	35
PID 2664 wrote to memory of 2600	2664	chrome.exe	35
PID 2664 wrote to memory of 2828	2664	chrome.exe	36
PID 2664 wrote to memory of 2828	2664	chrome.exe	36
PID 2664 wrote to memory of 2828	2664	chrome.exe	36
PID 2664 wrote to memory of 2828	2664	chrome.exe	36
PID 2664 wrote to memory of 2828	2664	chrome.exe	36
PID 2664 wrote to memory of 2828	2664	chrome.exe	36
PID 2664 wrote to memory of 2828	2664	chrome.exe	36
PID 2664 wrote to memory of 2828	2664	chrome.exe	36
PID 2664 wrote to memory of 2828	2664	chrome.exe	36
PID 2664 wrote to memory of 2828	2664	chrome.exe	36
PID 2664 wrote to memory of 2828	2664	chrome.exe	36

C:\Users\Admin\AppData\Local\Temp\gu.exe
"C:\Users\Admin\AppData\Local\Temp\gu.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\server.exe
  "C:\Users\Admin\AppData\Local\Temp\server.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2892

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7489758,0x7fef7489768,0x7fef7489778
  2⤵
  PID:2728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 --field-trial-handle=1208,i,3123486931391590680,8125418711247151900,131072 /prefetch:2
  2⤵
  PID:296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1472 --field-trial-handle=1208,i,3123486931391590680,8125418711247151900,131072 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1208,i,3123486931391590680,8125418711247151900,131072 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2308 --field-trial-handle=1208,i,3123486931391590680,8125418711247151900,131072 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2320 --field-trial-handle=1208,i,3123486931391590680,8125418711247151900,131072 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1548 --field-trial-handle=1208,i,3123486931391590680,8125418711247151900,131072 /prefetch:2
  2⤵
  PID:568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1344 --field-trial-handle=1208,i,3123486931391590680,8125418711247151900,131072 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3296 --field-trial-handle=1208,i,3123486931391590680,8125418711247151900,131072 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3324 --field-trial-handle=1208,i,3123486931391590680,8125418711247151900,131072 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3040 --field-trial-handle=1208,i,3123486931391590680,8125418711247151900,131072 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2612 --field-trial-handle=1208,i,3123486931391590680,8125418711247151900,131072 /prefetch:1
  2⤵
  PID:1744

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2300

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1052

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\68c7bf52-d61b-4c54-84dc-00fc586f79e2.tmp

Filesize
140KB

MD5
98c1096f31b86c53eba9ef008c02175a

SHA1
04b4c859c557408aebfcdec86d03978a7147370c

SHA256
67a310d9ab7f28753a813b63e5d53370b7b4f96bfacbcebbfc9bd6487c38973a

SHA512
9a72e992f9e13bbe4fe6fd9d9c1068e48db984ff85b13bff8b9a6e0289f94f4785d3c59888d5978b5df8554f45731186504f98fb1b342bed2348ea8b0619f940

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
5KB

MD5
747bdec1675ba47f8e1d959b3e9877be

SHA1
81a4881e455d46cb57eb8361f4240739d7e35a16

SHA256
2552ce5e16696ebddce54978a3d329d61415c697e59a9124f73ddf5c183056b7

SHA512
8ee1d68b2dad4382c364fd6b6c8c7a2fd0c1367604d795223b1b16b07b7241ecef1bca2754312ea131fc684d28f3f8238bd4f338bde7d8309096aa8d163e3529

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
140KB

MD5
ec6fffcce86aa6ffd6ceb9670efbd9dc

SHA1
13abc6ba1b560480f154bbc2a82d5cd13ea9ee31

SHA256
00e1634c3ef113afacbb7ddad46646ea452c39ddc49fd549d95a3bddfd814fd1

SHA512
50c525789727b5c895dc3d2a9b79f83bcc9f504432f7c46cb69cb9dd32d9552b44df9061f1db2691dbf3a49662bce6d895124a55f19b038b1a09261077407bcb

Download Submit
\Users\Admin\AppData\Local\Temp\server.exe

Filesize
37KB

MD5
5623a039c27a4c274b375c83e42651d4

SHA1
877caa65809f345247c37d0bf64a49b1abda1e60

SHA256
87d0845412d5ad22a56954c151f0ae21cba71d2284189fdb0d3c6cb93b6282eb

SHA512
3f896c083919d310b4715d267dfccf57e10c8ba67a33f4feb1a6839cb97b922868339b9f448a5ad4360229837c030a03465337ec1aaba7d4fca64b8a31c00fd2

Download Submit
memory/1300-10-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1300-11-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1300-61-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1300-180-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1916-12-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1916-0-0x0000000074F31000-0x0000000074F32000-memory.dmp

Filesize
4KB

Download
memory/1916-2-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download
memory/1916-1-0x0000000074F30000-0x00000000754DB000-memory.dmp

Filesize
5.7MB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads