7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e

Analysis

max time kernel
150s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
05/10/2024, 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

s.jar
Size

23.4MB
MD5

f476422a60511cd61f6754728580ce34
SHA1

370946c72b96148d33fb436a527becc9ab291b03
SHA256

7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e
SHA512

8fae7bc1a0a568b0dd4a30c21be8d8d9da1fcdc6dcc3fd5ee1c5dab940ecf2539b9fadc2e5a597d0177c19a6cad27e7619ed7174f54e0d390e5fb419b7d49d48
SSDEEP

393216:Uj2fnuMWx2Y+fTS66Na4CUid5EYa9fL8kE/Yiuyw6iPhRD/IBRsme1eZrWl+9p:CquP2Y/fDCdfElCV/tw6i5qBioKUP

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8-startup-manager.jar	javaw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8-startup-manager.jar	javaw.exe

Loads dropped DLL 3 IoCs

pid	Process
832	java.exe
4164	javaw.exe
4164	javaw.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 60 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
832	java.exe
832	java.exe
4164	javaw.exe
4164	javaw.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 832 wrote to memory of 4164	832	java.exe	79
PID 832 wrote to memory of 4164	832	java.exe	79
PID 4164 wrote to memory of 1832	4164	javaw.exe	80
PID 4164 wrote to memory of 1832	4164	javaw.exe	80
PID 4164 wrote to memory of 1608	4164	javaw.exe	82
PID 4164 wrote to memory of 1608	4164	javaw.exe	82
PID 4164 wrote to memory of 3124	4164	javaw.exe	84
PID 4164 wrote to memory of 3124	4164	javaw.exe	84
PID 4164 wrote to memory of 1724	4164	javaw.exe	86
PID 4164 wrote to memory of 1724	4164	javaw.exe	86
PID 4164 wrote to memory of 3216	4164	javaw.exe	88
PID 4164 wrote to memory of 3216	4164	javaw.exe	88
PID 4164 wrote to memory of 2652	4164	javaw.exe	90
PID 4164 wrote to memory of 2652	4164	javaw.exe	90
PID 4164 wrote to memory of 3228	4164	javaw.exe	92
PID 4164 wrote to memory of 3228	4164	javaw.exe	92
PID 4164 wrote to memory of 4564	4164	javaw.exe	94
PID 4164 wrote to memory of 4564	4164	javaw.exe	94
PID 4164 wrote to memory of 772	4164	javaw.exe	96
PID 4164 wrote to memory of 772	4164	javaw.exe	96
PID 4164 wrote to memory of 960	4164	javaw.exe	98
PID 4164 wrote to memory of 960	4164	javaw.exe	98
PID 4164 wrote to memory of 3152	4164	javaw.exe	100
PID 4164 wrote to memory of 3152	4164	javaw.exe	100
PID 4164 wrote to memory of 352	4164	javaw.exe	102
PID 4164 wrote to memory of 352	4164	javaw.exe	102
PID 4164 wrote to memory of 1432	4164	javaw.exe	104
PID 4164 wrote to memory of 1432	4164	javaw.exe	104
PID 4164 wrote to memory of 2012	4164	javaw.exe	106
PID 4164 wrote to memory of 2012	4164	javaw.exe	106
PID 4164 wrote to memory of 836	4164	javaw.exe	108
PID 4164 wrote to memory of 836	4164	javaw.exe	108
PID 4164 wrote to memory of 696	4164	javaw.exe	110
PID 4164 wrote to memory of 696	4164	javaw.exe	110
PID 4164 wrote to memory of 2408	4164	javaw.exe	112
PID 4164 wrote to memory of 2408	4164	javaw.exe	112
PID 4164 wrote to memory of 2320	4164	javaw.exe	114
PID 4164 wrote to memory of 2320	4164	javaw.exe	114
PID 4164 wrote to memory of 2572	4164	javaw.exe	116
PID 4164 wrote to memory of 2572	4164	javaw.exe	116
PID 4164 wrote to memory of 3240	4164	javaw.exe	118
PID 4164 wrote to memory of 3240	4164	javaw.exe	118

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\s.jar
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:832
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\s.jar" DELAY:3
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4164
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1832
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1608
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3124
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1724
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3216
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2652
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3228
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4564
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:772
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:960
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3152
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:352
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1432
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2012
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:836
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:696
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2408
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2320
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2572
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JNativeHook-385777659FA84E94A3812EB9A8AFAD27AE3CEED4.x86_64.dll

Filesize
80KB

MD5
e9a449971b9efb0a2e12b9cfdd95c076

SHA1
385777659fa84e94a3812eb9a8afad27ae3ceed4

SHA256
b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18

SHA512
bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna1020850071868958298.dll

Filesize
248KB

MD5
4de85f9679c3a75f6d7d3e56094aa106

SHA1
052f62fb2ebec89fbe412db480865910eab693ad

SHA256
3d1b2427b45ff5178bbb4db395758bedd3a1e91121ebb3e3640b5c4e20eb22cc

SHA512
e8357eabd548ffeba42715d891b9e1ed22b7bf720f48b1888407b9ebe7a796719c60a38f4fb8bb1cf32d3c9bed210a07cc227424ef991d356ec3acef9e6223ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1287768749-810021449-2672985988-1000\83aa4cc77f591dfc2374580bbd95f6ba_ecb443ad-7c99-4a47-9f82-4d321990d32e

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
memory/832-62-0x0000021B00280000-0x0000021B00290000-memory.dmp

Filesize
64KB

Download
memory/832-2-0x0000021B00000000-0x0000021B00270000-memory.dmp

Filesize
2.4MB

Download
memory/832-23-0x0000021B00280000-0x0000021B00290000-memory.dmp

Filesize
64KB

Download
memory/832-25-0x0000021B00290000-0x0000021B002A0000-memory.dmp

Filesize
64KB

Download
memory/832-28-0x0000021B002A0000-0x0000021B002B0000-memory.dmp

Filesize
64KB

Download
memory/832-29-0x0000021B002B0000-0x0000021B002C0000-memory.dmp

Filesize
64KB

Download
memory/832-68-0x0000021B00290000-0x0000021B002A0000-memory.dmp

Filesize
64KB

Download
memory/832-61-0x0000021B00270000-0x0000021B00280000-memory.dmp

Filesize
64KB

Download
memory/832-11-0x0000021B78770000-0x0000021B78771000-memory.dmp

Filesize
4KB

Download
memory/832-22-0x0000021B00270000-0x0000021B00280000-memory.dmp

Filesize
64KB

Download
memory/832-75-0x0000021B00000000-0x0000021B00270000-memory.dmp

Filesize
2.4MB

Download
memory/832-74-0x0000021B002B0000-0x0000021B002C0000-memory.dmp

Filesize
64KB

Download
memory/832-73-0x0000021B002A0000-0x0000021B002B0000-memory.dmp

Filesize
64KB

Download
memory/832-72-0x0000021B00280000-0x0000021B00290000-memory.dmp

Filesize
64KB

Download
memory/832-71-0x0000021B00270000-0x0000021B00280000-memory.dmp

Filesize
64KB

Download
memory/832-58-0x0000021B00000000-0x0000021B00270000-memory.dmp

Filesize
2.4MB

Download
memory/832-63-0x0000021B78770000-0x0000021B78771000-memory.dmp

Filesize
4KB

Download
memory/832-70-0x0000021B78770000-0x0000021B78771000-memory.dmp

Filesize
4KB

Download
memory/4164-90-0x000001F90CC80000-0x000001F90CC90000-memory.dmp

Filesize
64KB

Download
memory/4164-105-0x000001F90CCE0000-0x000001F90CCF0000-memory.dmp

Filesize
64KB

Download
memory/4164-59-0x000001F90CC30000-0x000001F90CC40000-memory.dmp

Filesize
64KB

Download
memory/4164-60-0x000001F90CC40000-0x000001F90CC50000-memory.dmp

Filesize
64KB

Download
memory/4164-55-0x000001F90CC20000-0x000001F90CC30000-memory.dmp

Filesize
64KB

Download
memory/4164-52-0x000001F90CC00000-0x000001F90CC10000-memory.dmp

Filesize
64KB

Download
memory/4164-53-0x000001F90CC10000-0x000001F90CC20000-memory.dmp

Filesize
64KB

Download
memory/4164-76-0x000001F90C990000-0x000001F90CC00000-memory.dmp

Filesize
2.4MB

Download
memory/4164-77-0x000001F90CC60000-0x000001F90CC70000-memory.dmp

Filesize
64KB

Download
memory/4164-42-0x000001F90C970000-0x000001F90C971000-memory.dmp

Filesize
4KB

Download
memory/4164-86-0x000001F90CC70000-0x000001F90CC80000-memory.dmp

Filesize
64KB

Download
memory/4164-85-0x000001F90CC00000-0x000001F90CC10000-memory.dmp

Filesize
64KB

Download
memory/4164-32-0x000001F90C990000-0x000001F90CC00000-memory.dmp

Filesize
2.4MB

Download
memory/4164-89-0x000001F90CC10000-0x000001F90CC20000-memory.dmp

Filesize
64KB

Download
memory/4164-92-0x000001F90CC90000-0x000001F90CCA0000-memory.dmp

Filesize
64KB

Download
memory/4164-91-0x000001F90CC20000-0x000001F90CC30000-memory.dmp

Filesize
64KB

Download
memory/4164-95-0x000001F90CCA0000-0x000001F90CCB0000-memory.dmp

Filesize
64KB

Download
memory/4164-94-0x000001F90CC30000-0x000001F90CC40000-memory.dmp

Filesize
64KB

Download
memory/4164-98-0x000001F90CCB0000-0x000001F90CCC0000-memory.dmp

Filesize
64KB

Download
memory/4164-97-0x000001F90CC40000-0x000001F90CC50000-memory.dmp

Filesize
64KB

Download
memory/4164-101-0x000001F90CCC0000-0x000001F90CCD0000-memory.dmp

Filesize
64KB

Download
memory/4164-100-0x000001F90CC50000-0x000001F90CC60000-memory.dmp

Filesize
64KB

Download
memory/4164-103-0x000001F90CCD0000-0x000001F90CCE0000-memory.dmp

Filesize
64KB

Download
memory/4164-65-0x000001F90CC50000-0x000001F90CC60000-memory.dmp

Filesize
64KB

Download
memory/4164-112-0x000001F90CCF0000-0x000001F90CD00000-memory.dmp

Filesize
64KB

Download
memory/4164-116-0x000001F90CD00000-0x000001F90CD10000-memory.dmp

Filesize
64KB

Download
memory/4164-118-0x000001F90CD10000-0x000001F90CD20000-memory.dmp

Filesize
64KB

Download
memory/4164-117-0x000001F90CC70000-0x000001F90CC80000-memory.dmp

Filesize
64KB

Download
memory/4164-115-0x000001F90CC60000-0x000001F90CC70000-memory.dmp

Filesize
64KB

Download
memory/4164-123-0x000001F90CD20000-0x000001F90CD30000-memory.dmp

Filesize
64KB

Download
memory/4164-125-0x000001F90CC90000-0x000001F90CCA0000-memory.dmp

Filesize
64KB

Download
memory/4164-126-0x000001F90CD30000-0x000001F90CD40000-memory.dmp

Filesize
64KB

Download
memory/4164-129-0x000001F90CCA0000-0x000001F90CCB0000-memory.dmp

Filesize
64KB

Download
memory/4164-128-0x000001F90CD50000-0x000001F90CD60000-memory.dmp

Filesize
64KB

Download
memory/4164-127-0x000001F90CD40000-0x000001F90CD50000-memory.dmp

Filesize
64KB

Download
memory/4164-121-0x000001F90CC80000-0x000001F90CC90000-memory.dmp

Filesize
64KB

Download
memory/4164-130-0x000001F90C970000-0x000001F90C971000-memory.dmp

Filesize
4KB

Download
memory/4164-133-0x000001F90CCB0000-0x000001F90CCC0000-memory.dmp

Filesize
64KB

Download
memory/4164-135-0x000001F90CCC0000-0x000001F90CCD0000-memory.dmp

Filesize
64KB

Download
memory/4164-136-0x000001F90CCD0000-0x000001F90CCE0000-memory.dmp

Filesize
64KB

Download
memory/4164-137-0x000001F90CCE0000-0x000001F90CCF0000-memory.dmp

Filesize
64KB

Download
memory/4164-138-0x000001F90CCF0000-0x000001F90CD00000-memory.dmp

Filesize
64KB

Download
memory/4164-139-0x000001F90CD00000-0x000001F90CD10000-memory.dmp

Filesize
64KB

Download
memory/4164-140-0x000001F90CD10000-0x000001F90CD20000-memory.dmp

Filesize
64KB

Download
memory/4164-141-0x000001F90CD20000-0x000001F90CD30000-memory.dmp

Filesize
64KB

Download
memory/4164-143-0x000001F90CD40000-0x000001F90CD50000-memory.dmp

Filesize
64KB

Download
memory/4164-144-0x000001F90CD50000-0x000001F90CD60000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads