hawkeye | 8b3b8df6a16eed6edc74e0b57adf7e057e643d572ae1fcd6d806e9c78141e145

General

Target

3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe
Size

515KB
MD5

3fc92e5d34ae656ad8ef85e0ee1e4f12
SHA1

ed670181751fcc091b3419cb6b7081adbd5ac722
SHA256

8b3b8df6a16eed6edc74e0b57adf7e057e643d572ae1fcd6d806e9c78141e145
SHA512

752e26940de0a40a1e6937007f927695d49329468eed0936dc7e264252bd75f9ae206cfe8ccc6fe0b14d1a14ce161e87985623a671fdf603ef17ff5b44265431
SSDEEP

12288:uyDqtM3bdDzjp6rG6srN4LOU0Rm0dj6EUMJ:zDqiVp6r9IN60RHd5J

Score

10^/10

hawkeye latentbot evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

latentbot

C2

dcomete70353.zapto.org

1dcomete70353.zapto.org

2dcomete70353.zapto.org

3dcomete70353.zapto.org

4dcomete70353.zapto.org

5dcomete70353.zapto.org

6dcomete70353.zapto.org

7dcomete70353.zapto.org

8dcomete70353.zapto.org

Signatures

HawkEye
HawkEye is a malware kit that has seen continuous development since at least 2013.
keylogger trojan stealer spyware hawkeye
LatentBot
Modular trojan written in Delphi which has been in-the-wild since 2013.
trojan latentbot

Modifies firewall policy service 3 TTPs 10 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

Processes:

reg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\AppLaunch.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	reg.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe = "C:\\Users\\Admin\\AppData\\Roaming\\KSF20FP27A.exe:*:Enabled:Windows Messanger"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	reg.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

explorer.exertmpltem.exe3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	explorer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	rtmpltem.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\Control Panel\International\Geo\Nation	3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe

Deletes itself 1 IoCs

Processes:

explorer.exe

pid process

4132 explorer.exe
Executes dropped EXE 3 IoCs

Processes:

explorer.exertmpltem.exevpltfrm.exe

pid process

4132 explorer.exe
376 rtmpltem.exe
4584 vpltfrm.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rtmpltem.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3419463127-3903270268-2580331543-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\© Microsoft Real Time Media Stack = "C:\\Users\\Admin\\AppData\\Local\\Temp\\System\\rtmpltem.exe"	rtmpltem.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

explorer.exe

description pid process target process

PID 4132 set thread context of 4168 4132 explorer.exe AppLaunch.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry key 1 TTPs 4 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exe

pid process

3444 reg.exe
1996 reg.exe
2348 reg.exe
3652 reg.exe

description	pid	process	target process
PID 4132 set thread context of 4168	4132	explorer.exe	AppLaunch.exe

pid	process
3444	reg.exe
1996	reg.exe
2348	reg.exe
3652	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

explorer.exertmpltem.exevpltfrm.exe

pid	process
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe
376	rtmpltem.exe
4584	vpltfrm.exe
4132	explorer.exe

Suspicious use of AdjustPrivilegeToken 39 IoCs

Processes:

3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exeexplorer.exeAppLaunch.exertmpltem.exevpltfrm.exe

description	pid	process
Token: SeDebugPrivilege	2624	3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe
Token: SeDebugPrivilege	4132	explorer.exe
Token: 1	4168	AppLaunch.exe
Token: SeCreateTokenPrivilege	4168	AppLaunch.exe
Token: SeAssignPrimaryTokenPrivilege	4168	AppLaunch.exe
Token: SeLockMemoryPrivilege	4168	AppLaunch.exe
Token: SeIncreaseQuotaPrivilege	4168	AppLaunch.exe
Token: SeMachineAccountPrivilege	4168	AppLaunch.exe
Token: SeTcbPrivilege	4168	AppLaunch.exe
Token: SeSecurityPrivilege	4168	AppLaunch.exe
Token: SeTakeOwnershipPrivilege	4168	AppLaunch.exe
Token: SeLoadDriverPrivilege	4168	AppLaunch.exe
Token: SeSystemProfilePrivilege	4168	AppLaunch.exe
Token: SeSystemtimePrivilege	4168	AppLaunch.exe
Token: SeProfSingleProcessPrivilege	4168	AppLaunch.exe
Token: SeIncBasePriorityPrivilege	4168	AppLaunch.exe
Token: SeCreatePagefilePrivilege	4168	AppLaunch.exe
Token: SeCreatePermanentPrivilege	4168	AppLaunch.exe
Token: SeBackupPrivilege	4168	AppLaunch.exe
Token: SeRestorePrivilege	4168	AppLaunch.exe
Token: SeShutdownPrivilege	4168	AppLaunch.exe
Token: SeDebugPrivilege	4168	AppLaunch.exe
Token: SeAuditPrivilege	4168	AppLaunch.exe
Token: SeSystemEnvironmentPrivilege	4168	AppLaunch.exe
Token: SeChangeNotifyPrivilege	4168	AppLaunch.exe
Token: SeRemoteShutdownPrivilege	4168	AppLaunch.exe
Token: SeUndockPrivilege	4168	AppLaunch.exe
Token: SeSyncAgentPrivilege	4168	AppLaunch.exe
Token: SeEnableDelegationPrivilege	4168	AppLaunch.exe
Token: SeManageVolumePrivilege	4168	AppLaunch.exe
Token: SeImpersonatePrivilege	4168	AppLaunch.exe
Token: SeCreateGlobalPrivilege	4168	AppLaunch.exe
Token: 31	4168	AppLaunch.exe
Token: 32	4168	AppLaunch.exe
Token: 33	4168	AppLaunch.exe
Token: 34	4168	AppLaunch.exe
Token: 35	4168	AppLaunch.exe
Token: SeDebugPrivilege	376	rtmpltem.exe
Token: SeDebugPrivilege	4584	vpltfrm.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

AppLaunch.exe

pid process

4168 AppLaunch.exe
4168 AppLaunch.exe
4168 AppLaunch.exe

pid	process
4168	AppLaunch.exe
4168	AppLaunch.exe
4168	AppLaunch.exe

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exeexplorer.exeAppLaunch.execmd.execmd.execmd.execmd.exertmpltem.exe

description	pid	process	target process
PID 2624 wrote to memory of 4132	2624	3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe	explorer.exe
PID 2624 wrote to memory of 4132	2624	3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe	explorer.exe
PID 2624 wrote to memory of 4132	2624	3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe	explorer.exe
PID 4132 wrote to memory of 4168	4132	explorer.exe	AppLaunch.exe
PID 4132 wrote to memory of 4168	4132	explorer.exe	AppLaunch.exe
PID 4132 wrote to memory of 4168	4132	explorer.exe	AppLaunch.exe
PID 4132 wrote to memory of 4168	4132	explorer.exe	AppLaunch.exe
PID 4132 wrote to memory of 4168	4132	explorer.exe	AppLaunch.exe
PID 4132 wrote to memory of 4168	4132	explorer.exe	AppLaunch.exe
PID 4132 wrote to memory of 4168	4132	explorer.exe	AppLaunch.exe
PID 4132 wrote to memory of 4168	4132	explorer.exe	AppLaunch.exe
PID 4168 wrote to memory of 4144	4168	AppLaunch.exe	cmd.exe
PID 4168 wrote to memory of 4144	4168	AppLaunch.exe	cmd.exe
PID 4168 wrote to memory of 4144	4168	AppLaunch.exe	cmd.exe
PID 4168 wrote to memory of 2012	4168	AppLaunch.exe	cmd.exe
PID 4168 wrote to memory of 2012	4168	AppLaunch.exe	cmd.exe
PID 4168 wrote to memory of 2012	4168	AppLaunch.exe	cmd.exe
PID 4168 wrote to memory of 3608	4168	AppLaunch.exe	cmd.exe
PID 4168 wrote to memory of 3608	4168	AppLaunch.exe	cmd.exe
PID 4168 wrote to memory of 3608	4168	AppLaunch.exe	cmd.exe
PID 4168 wrote to memory of 3660	4168	AppLaunch.exe	cmd.exe
PID 4168 wrote to memory of 3660	4168	AppLaunch.exe	cmd.exe
PID 4168 wrote to memory of 3660	4168	AppLaunch.exe	cmd.exe
PID 4132 wrote to memory of 376	4132	explorer.exe	rtmpltem.exe
PID 4132 wrote to memory of 376	4132	explorer.exe	rtmpltem.exe
PID 4132 wrote to memory of 376	4132	explorer.exe	rtmpltem.exe
PID 3608 wrote to memory of 3444	3608	cmd.exe	reg.exe
PID 2012 wrote to memory of 3652	2012	cmd.exe	reg.exe
PID 3608 wrote to memory of 3444	3608	cmd.exe	reg.exe
PID 3608 wrote to memory of 3444	3608	cmd.exe	reg.exe
PID 2012 wrote to memory of 3652	2012	cmd.exe	reg.exe
PID 2012 wrote to memory of 3652	2012	cmd.exe	reg.exe
PID 4144 wrote to memory of 2348	4144	cmd.exe	reg.exe
PID 4144 wrote to memory of 2348	4144	cmd.exe	reg.exe
PID 4144 wrote to memory of 2348	4144	cmd.exe	reg.exe
PID 3660 wrote to memory of 1996	3660	cmd.exe	reg.exe
PID 3660 wrote to memory of 1996	3660	cmd.exe	reg.exe
PID 3660 wrote to memory of 1996	3660	cmd.exe	reg.exe
PID 376 wrote to memory of 4584	376	rtmpltem.exe	vpltfrm.exe
PID 376 wrote to memory of 4584	376	rtmpltem.exe	vpltfrm.exe
PID 376 wrote to memory of 4584	376	rtmpltem.exe	vpltfrm.exe

C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3fc92e5d34ae656ad8ef85e0ee1e4f12_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe"
2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132

C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe
3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:4144

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:2348

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:2012

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe" /t REG_SZ /d "C:\Windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:3652

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:3608

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:3444

C:\Windows\SysWOW64\cmd.exe
cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe:*:Enabled:Windows Messanger" /f
4⤵
- Suspicious use of WriteProcessMemory
PID:3660

C:\Windows\SysWOW64\reg.exe
REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\KSF20FP27A.exe:*:Enabled:Windows Messanger" /f
5⤵
- Modifies firewall policy service
- Modifies registry key
PID:1996

C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe
"C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe"
3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:376

C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe
"C:\Users\Admin\AppData\Local\Temp\System\vpltfrm.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Impair Defenses

1

T1562

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SysInfo.txt

Filesize
84B

MD5
7b453da9d6310a2202dcbb8202b45419

SHA1
351759ae45f546891fa517c5c766166a4d54b501

SHA256
17eb0cb7912c45766f98b7df016fa8a007a9c7f7e16b441a25ab63f8e7a82bbd

SHA512
b505209ab597fcf2674fa3bc39739978cf7ce5244883bbcdaac87c143a3a815cd6fc3316ebc8fecb9081a3c2e300c76768f290060cef09e848129f4279972be0

Download Submit
C:\Users\Admin\AppData\Local\Temp\System\rtmpltem.exe

Filesize
52KB

MD5
4777f65333a1f79b6eaa5eba507a855a

SHA1
007e6756a99e86410c24f078b2edf21a9c302aa1

SHA256
8a1fff36d4f7aac527918f7e8e7de942fec16ed0bc50d0a11ba11557d01a0be6

SHA512
40ee3626d28f927fee786aa05729d61a3082a3fe5c5ce4f53a24cc65407f4470dc660bfe60099d6baaddb8a32fbf1755ea791e6283c1c1f0152f0840ddc9cdeb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\explorer.exe

Filesize
515KB

MD5
3fc92e5d34ae656ad8ef85e0ee1e4f12

SHA1
ed670181751fcc091b3419cb6b7081adbd5ac722

SHA256
8b3b8df6a16eed6edc74e0b57adf7e057e643d572ae1fcd6d806e9c78141e145

SHA512
752e26940de0a40a1e6937007f927695d49329468eed0936dc7e264252bd75f9ae206cfe8ccc6fe0b14d1a14ce161e87985623a671fdf603ef17ff5b44265431

Download Submit
memory/2624-1-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/2624-2-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/2624-13-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/2624-0-0x0000000075492000-0x0000000075493000-memory.dmp

Filesize
4KB

Download
memory/4132-15-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/4132-16-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/4132-14-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/4132-43-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/4168-22-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4168-24-0x0000000000400000-0x0000000000470000-memory.dmp

Filesize
448KB

Download
memory/4168-41-0x0000000010000000-0x000000001000F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads