84bebbe2cc14519a656dd6ee54e892191872f7122ebf53ef6b2349a5218c11e1

Resubmissions

18-07-2024 07:25

240718-h84wjs1hpb 10

18-07-2024 07:19

240718-h51pqa1gng 10

17-07-2024 20:55

240717-zqkhmaydmq 10

17-07-2024 19:21

240717-x2pwdaycjb 10

Analysis

max time kernel
148s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
17-07-2024 20:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Bit Paymer.exe
Size

92KB
MD5

998246bd0e51f9582b998ca514317c33
SHA1

5a2d799ac4cca8954fc117c7fb3e868f93c6f009
SHA256

d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2
SHA512

773d9838be9c09bd43a22aa1eada8f623f95739b21828712236a4a209c6d9266647ef43592d072d68399224965253c37f9ce9ef36e46e8191169c03ac7789130
SSDEEP

1536:tacFdjxs2TlWlpnXv91nhixG8/lA5jG8387SpK6jXOMVHoi5e+vRb:taqJC6lWlpnXv7nhixhlAU83VwMCifvR

Score

10^/10

persistence ransomware spyware stealer

Malware Config

Extracted

Path

C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.readme_txt

Ransom Note

YOUR COMPANY HAS BEEN SUCCESSFULLY PENETRATED! All files are encrypted. We accept only bitcoins to share the decryption software for your network. Also, we have gathered all your private sensitive data.So if you decide not to pay anytime soon, we would share it with media's. It may harm your business reputation and the company's capitalization fell sharply. Do not try to do it with 3rd-parties programs, files might be damaged then. Decrypting of your files is only possible with the special decryption software. To receive your private key and the decryption software please follow the link (using tor2web service): https://qmnmrba4s4a3py6z.onion.to/order/43e4593a-5dc7-11e7-8803-00163e417ea3 If this address is not available, follow these steps: 1. Download and install Tor Browser: https://www.torproject.org/projects/torbrowser.html.en 2. After a successful installation, run the browser and wait for initialization. 3. Type in the address bar: http://qmnmrba4s4a3py6z.onion/order/43e4593a-5dc7-11e7-8803-00163e417ea3 4. Follow the instructions on the site 5. This link is valid for 72 hours only. Afetr that period your local data would be lost completely. 6. Any questions: [email protected]

Emails

[email protected]

URLs

https://qmnmrba4s4a3py6z.onion.to/order/43e4593a-5dc7-11e7-8803-00163e417ea3

http://qmnmrba4s4a3py6z.onion/order/43e4593a-5dc7-11e7-8803-00163e417ea3

Signatures

Renames multiple (12323) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	Bit Paymer.exe

Executes dropped EXE 3 IoCs

pid	Process
1484	gNT:exe
3820	gT0.exe
1268	cFqWH:exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\J723puDXyl = "C:\\Users\\Admin\\AppData\\Local\\NuK\\pd5.exe"	Bit Paymer.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	cFqWH:exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	cFqWH:exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.contrast-white_targetsize-96_altform-unplated.png	cFqWH:exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\PowerShellGet\1.0.0.1\es-ES\PSGet.Resource.psd1.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.dll.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\de\UIAutomationClientSideProviders.resources.dll.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\tzmappings	cFqWH:exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.ICO.locked	cFqWH:exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\GRINTL32.DLL.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	cFqWH:exe
File created	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\SEGOEUISL.TTF.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\en-US\msaddsr.dll.mui	cFqWH:exe
File created	C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\en\Microsoft.PackageManagement.MsuProvider.resources.dll.readme_txt	cFqWH:exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\icudt26l.dat.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework.Aero2.dll	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ul-phn.xrm-ms.readme_txt	cFqWH:exe
File created	C:\Program Files\Microsoft Office\root\vfs\System\vcruntime140.dll.locked	cFqWH:exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.locked	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Data.OData.Query.NetFX35.dll	cFqWH:exe
File opened for modification	C:\Program Files\Google\Chrome\Application\123.0.6312.106\Locales\sl.pak.locked	cFqWH:exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sl-si\ui-strings.js.readme_txt	cFqWH:exe
File created	C:\Program Files\VideoLAN\VLC\locale\kk\LC_MESSAGES\vlc.mo.locked	cFqWH:exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\fr\ReachFramework.resources.dll.locked	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ppd.xrm-ms	cFqWH:exe
File created	C:\Program Files\Microsoft Office\root\rsod\osmuxmui.msi.16.en-us.boot.tree.dat.locked	cFqWH:exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\informix.xsl.locked	cFqWH:exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_filterselected-default_32.svg.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.371\goopdateres_ml.dll.locked	cFqWH:exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\themes\dark\nub.png	cFqWH:exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll	cFqWH:exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Collections.Concurrent.dll.locked	cFqWH:exe
File created	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\Microsoft.Win32.Registry.AccessControl.dll.locked	cFqWH:exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CAPSULES\PREVIEW.GIF.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\v8_context_snapshot.bin.DATA.locked	cFqWH:exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\1033\VBE7INTL.DLL.locked	cFqWH:exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\avutil-56_ms.dll	cFqWH:exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\progress_spinner2x.gif.locked	cFqWH:exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_radio_selected_18.svg.locked	cFqWH:exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\services_discovery\libsap_plugin.dll	cFqWH:exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\librss_plugin.dll.readme_txt	cFqWH:exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\ui-strings.js.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\orcl7.xsl.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sv-se\ui-strings.js.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\api-ms-win-crt-filesystem-l1-1-0.dll	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WINWORD.HXS	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\MySharePoints.ico.locked	cFqWH:exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Globalization.dll.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\GRPHFLT\MS.PNG.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteSmallTile.scale-100.png	cFqWH:exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-72_altform-lightunplated.png	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-pl.xrm-ms.locked	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\dcfmui.msi.16.en-us.tree.dat.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\modules\httprequests.luac	cFqWH:exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\msxactps.dll	cFqWH:exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.ServiceProcess.dll.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ko\PresentationCore.resources.dll.locked	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription5-ul-oob.xrm-ms	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\VVIEWDWG.DLL.locked	cFqWH:exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ru\System.Windows.Controls.Ribbon.resources.dll.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.Proof.Culture.msi.16.es-es.xml.readme_txt	cFqWH:exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\api-ms-win-core-file-l2-1-0.dll.readme_txt	cFqWH:exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\Download_on_the_App_Store_Badge_nb_135x40.svg	cFqWH:exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Discovers systems in the same network 1 TTPs 1 IoCs

discovery

Remote System Discovery

T1018

pid	Process
1708	net.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\gNT:exe	Bit Paymer.exe
File created	C:\Users\Admin\AppData\Local\cFqWH:exe	gT0.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 556 wrote to memory of 1548	556	Bit Paymer.exe	86
PID 556 wrote to memory of 1548	556	Bit Paymer.exe	86
PID 556 wrote to memory of 1548	556	Bit Paymer.exe	86
PID 556 wrote to memory of 1484	556	Bit Paymer.exe	88
PID 556 wrote to memory of 1484	556	Bit Paymer.exe	88
PID 556 wrote to memory of 1484	556	Bit Paymer.exe	88
PID 1548 wrote to memory of 3820	1548	cmd.exe	90
PID 1548 wrote to memory of 3820	1548	cmd.exe	90
PID 1548 wrote to memory of 3820	1548	cmd.exe	90
PID 3820 wrote to memory of 1268	3820	gT0.exe	91
PID 3820 wrote to memory of 1268	3820	gT0.exe	91
PID 3820 wrote to memory of 1268	3820	gT0.exe	91
PID 1484 wrote to memory of 1708	1484	gNT:exe	101
PID 1484 wrote to memory of 1708	1484	gNT:exe	101
PID 1484 wrote to memory of 1708	1484	gNT:exe	101

C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe
"C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Lrx9Yo\gT0.exe 2
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Users\Admin\AppData\Local\Lrx9Yo\gT0.exe
    C:\Users\Admin\AppData\Local\Lrx9Yo\gT0.exe 2
    3⤵
    - Executes dropped EXE
    - NTFS ADS
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Users\Admin\AppData\Local\cFqWH:exe
      C:\Users\Admin\AppData\Local\cFqWH:exe 3 C:\Users\Admin\AppData\Local\Lrx9Yo\gT0.exe
      4⤵
      Executes dropped EXE
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      PID:1268
- C:\Users\Admin\AppData\Local\gNT:exe
  C:\Users\Admin\AppData\Local\gNT:exe 1 C:\Users\Admin\AppData\Local\Temp\Bit Paymer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\SysWOW64\net.exe
    C:\Windows\system32\net.exe view
    3⤵
    - Discovers systems in the same network
    PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db

Filesize
16KB

MD5
5fe795b0946117c943decf23c5a8e5bf

SHA1
132661430c77b17f8b8d6a5b672401bef0942f70

SHA256
96d68494a12403699a4b80ef56f7bebd5d7c2da903bb5ca49b653a87ceb9ecae

SHA512
d5e31c8770456de7af85d92fc31ecf99128a423313ea90bf92bddb40b293cb1478782e27ac70c3e7a460fd0b89f9a72ed4a4d4cd9bca55c869edbddfd0fe043d

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db

Filesize
289KB

MD5
d35a51e72d507d85f6ca64225d7fcd5b

SHA1
f94d07e0aed1087f12324b9d55212bfd43025c75

SHA256
86b0a92394b29216197ac8bca73aaee6be9f761bd282c4a7cc763234fcf1fa72

SHA512
ca1a3bf5d0ef9ed552ea486d336a75cc893f5d9b974cb8893a408307af17b8547ca5f64355c4c804812a363bb9a07ba2458c7ffc8d52d6c5f3165f6b88e4a40d

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{74C88255-AA9F-481E-979B-5BC07C364F25}.2.ver0x0000000000000001.db

Filesize
1KB

MD5
19b579389820cd1fb908b9d8870a7142

SHA1
70e3dcccc5a29268fa2c6f1c4d86e0f7a3b52935

SHA256
3c1e56c193980f4638a44575826b1605496ffa858a52ea3b2fdcd72094661cfe

SHA512
220e1672dda8a4e951c0924b7d467a7ac78ae1865546fa4026f75539745696c9dc6658edfeddd6f701e02b9c23916f1e91764d787a85e91ac2a122a65041c36e

Download Submit
C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db

Filesize
622KB

MD5
e8b24556b7ff24bcccf44c2823749e41

SHA1
24b989916199f6c3268e50393a763b3ee8cfea10

SHA256
f7732d46879e5fd25c5f4e1a1f6bdf18ea5987af1b6de1ee973ecfa523c8e21a

SHA512
da205c221d93de7e71a2c75c38487b293038dff0e01c2fa6fcaae4ecc925885b640082905580445f503e8a884c9205d6d8980b51984ae93d3bf35850f9284002

Download Submit
C:\Users\Admin\AppData\Local\gNT:exe

Filesize
92KB

MD5
998246bd0e51f9582b998ca514317c33

SHA1
5a2d799ac4cca8954fc117c7fb3e868f93c6f009

SHA256
d693c33dd550529f3634e3c7e53d82df70c9d4fbd0c339dbc1849ada9e539ea2

SHA512
773d9838be9c09bd43a22aa1eada8f623f95739b21828712236a4a209c6d9266647ef43592d072d68399224965253c37f9ce9ef36e46e8191169c03ac7789130

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt

Filesize
4B

MD5
76390d3429ba451f1e37daae6bc85b51

SHA1
c8e633f4a5ad8991f348fa8bf85dfec134e2c4dc

SHA256
31d694956ddcdb8b2d61ee7b91beb5af37ce0557b6ca44438d2c3ca9f96c56d9

SHA512
cff8a95d7efbabc3ac3c06b721166ac26254eadcbed6296bb17712be07c1b7245ab22fb9b558371b0a69e855451706180ef20ccb57f639cbe818c14d90bd3e54

Download Submit
C:\vcredist2010_x86.log-MSI_vc_red.msi.txt.readme_txt

Filesize
1KB

MD5
51fab08a170e3c398e696a5d36cde259

SHA1
b60d83b9db3831998bb5672e4a4a1610cf4e1cb1

SHA256
bab1199a9b43d11429c79f0b15c7e8c8d61ec612aca223aa66fd253eab11f1cb

SHA512
50b95e5bd31ab894e997773c374592bda8a0cf44f92c9b92aad8155928240c1a2d177f81bcdefe72d686413dd9494f8010f66f9e191b7a549fb99902c6f2c3d6

Download Submit
memory/556-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/556-0-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/556-11-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/1268-74623-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/1268-9954-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/1268-26-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/1268-86048-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/1268-86357-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/1484-9953-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/1484-15-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/3820-23-0x0000000001000000-0x0000000001020000-memory.dmp

Filesize
128KB

Download
memory/3820-19-0x0000000000A00000-0x0000000000A06000-memory.dmp

Filesize
24KB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads