7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 14:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

s.jar
Size

23.4MB
MD5

f476422a60511cd61f6754728580ce34
SHA1

370946c72b96148d33fb436a527becc9ab291b03
SHA256

7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e
SHA512

8fae7bc1a0a568b0dd4a30c21be8d8d9da1fcdc6dcc3fd5ee1c5dab940ecf2539b9fadc2e5a597d0177c19a6cad27e7619ed7174f54e0d390e5fb419b7d49d48
SSDEEP

393216:Uj2fnuMWx2Y+fTS66Na4CUid5EYa9fL8kE/Yiuyw6iPhRD/IBRsme1eZrWl+9p:CquP2Y/fDCdfElCV/tw6i5qBioKUP

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8-startup-manager.jar	javaw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8-startup-manager.jar	javaw.exe

Loads dropped DLL 3 IoCs

pid	Process
1580	java.exe
3036	javaw.exe
3036	javaw.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 57 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1580	java.exe
1580	java.exe
3036	javaw.exe
3036	javaw.exe
3036	javaw.exe
3036	javaw.exe
3036	javaw.exe
3036	javaw.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 3036	1580	java.exe	83
PID 1580 wrote to memory of 3036	1580	java.exe	83
PID 3036 wrote to memory of 4544	3036	javaw.exe	84
PID 3036 wrote to memory of 4544	3036	javaw.exe	84
PID 3036 wrote to memory of 4952	3036	javaw.exe	91
PID 3036 wrote to memory of 4952	3036	javaw.exe	91
PID 3036 wrote to memory of 4696	3036	javaw.exe	95
PID 3036 wrote to memory of 4696	3036	javaw.exe	95
PID 3036 wrote to memory of 3104	3036	javaw.exe	97
PID 3036 wrote to memory of 3104	3036	javaw.exe	97
PID 3036 wrote to memory of 4624	3036	javaw.exe	101
PID 3036 wrote to memory of 4624	3036	javaw.exe	101
PID 3036 wrote to memory of 4568	3036	javaw.exe	103
PID 3036 wrote to memory of 4568	3036	javaw.exe	103
PID 3036 wrote to memory of 532	3036	javaw.exe	105
PID 3036 wrote to memory of 532	3036	javaw.exe	105
PID 3036 wrote to memory of 3688	3036	javaw.exe	107
PID 3036 wrote to memory of 3688	3036	javaw.exe	107
PID 3036 wrote to memory of 2748	3036	javaw.exe	109
PID 3036 wrote to memory of 2748	3036	javaw.exe	109
PID 3036 wrote to memory of 4328	3036	javaw.exe	111
PID 3036 wrote to memory of 4328	3036	javaw.exe	111
PID 3036 wrote to memory of 3780	3036	javaw.exe	113
PID 3036 wrote to memory of 3780	3036	javaw.exe	113
PID 3036 wrote to memory of 4360	3036	javaw.exe	115
PID 3036 wrote to memory of 4360	3036	javaw.exe	115
PID 3036 wrote to memory of 4996	3036	javaw.exe	117
PID 3036 wrote to memory of 4996	3036	javaw.exe	117
PID 3036 wrote to memory of 1384	3036	javaw.exe	119
PID 3036 wrote to memory of 1384	3036	javaw.exe	119
PID 3036 wrote to memory of 4620	3036	javaw.exe	121
PID 3036 wrote to memory of 4620	3036	javaw.exe	121
PID 3036 wrote to memory of 2964	3036	javaw.exe	123
PID 3036 wrote to memory of 2964	3036	javaw.exe	123
PID 3036 wrote to memory of 2104	3036	javaw.exe	125
PID 3036 wrote to memory of 2104	3036	javaw.exe	125
PID 3036 wrote to memory of 4864	3036	javaw.exe	127
PID 3036 wrote to memory of 4864	3036	javaw.exe	127
PID 3036 wrote to memory of 1124	3036	javaw.exe	129
PID 3036 wrote to memory of 1124	3036	javaw.exe	129

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\s.jar
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\s.jar" DELAY:3
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4544
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4952
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4696
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3104
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4624
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4568
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:532
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3688
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2748
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4328
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3780
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4360
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4996
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1384
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4620
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2964
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2104
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4864
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Oracle\Java\.oracle_jre_usage\3903daac9bc4a3b7.timestamp

Filesize
46B

MD5
7483c873a7c4eddd04a1bf9f964c8d64

SHA1
faa5b6a65093695e290b4c8cb64f30832a7e21e9

SHA256
b925d5d1aef5c915f1e60177ab5145e4afb564f682e58b42c37fec934f26a08c

SHA512
d66dda1cf290597aa72bad048758ced631c978b438d53ee9b627ee277df7e363ef312cae68e25c47a2fd8af08a15d5e149557cc2c48b216b3b5eb2b969ad06c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\JNativeHook-385777659FA84E94A3812EB9A8AFAD27AE3CEED4.x86_64.dll

Filesize
80KB

MD5
e9a449971b9efb0a2e12b9cfdd95c076

SHA1
385777659fa84e94a3812eb9a8afad27ae3ceed4

SHA256
b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18

SHA512
bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna2389881483699723881.dll

Filesize
248KB

MD5
4de85f9679c3a75f6d7d3e56094aa106

SHA1
052f62fb2ebec89fbe412db480865910eab693ad

SHA256
3d1b2427b45ff5178bbb4db395758bedd3a1e91121ebb3e3640b5c4e20eb22cc

SHA512
e8357eabd548ffeba42715d891b9e1ed22b7bf720f48b1888407b9ebe7a796719c60a38f4fb8bb1cf32d3c9bed210a07cc227424ef991d356ec3acef9e6223ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-2718105630-359604950-2820636825-1000\83aa4cc77f591dfc2374580bbd95f6ba_32404286-a0b5-4a93-9620-6f13fd83251a

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
memory/1580-27-0x00000159825D0000-0x00000159825E0000-memory.dmp

Filesize
64KB

Download
memory/1580-75-0x00000159825A0000-0x00000159825B0000-memory.dmp

Filesize
64KB

Download
memory/1580-71-0x00000159825D0000-0x00000159825E0000-memory.dmp

Filesize
64KB

Download
memory/1580-29-0x00000159825E0000-0x00000159825F0000-memory.dmp

Filesize
64KB

Download
memory/1580-31-0x00000159825F0000-0x0000015982600000-memory.dmp

Filesize
64KB

Download
memory/1580-23-0x00000159825B0000-0x00000159825C0000-memory.dmp

Filesize
64KB

Download
memory/1580-22-0x00000159825A0000-0x00000159825B0000-memory.dmp

Filesize
64KB

Download
memory/1580-2-0x0000015982330000-0x00000159825A0000-memory.dmp

Filesize
2.4MB

Download
memory/1580-11-0x0000015982310000-0x0000015982311000-memory.dmp

Filesize
4KB

Download
memory/1580-25-0x00000159825C0000-0x00000159825D0000-memory.dmp

Filesize
64KB

Download
memory/1580-76-0x00000159825B0000-0x00000159825C0000-memory.dmp

Filesize
64KB

Download
memory/1580-63-0x00000159825B0000-0x00000159825C0000-memory.dmp

Filesize
64KB

Download
memory/1580-77-0x00000159825D0000-0x00000159825E0000-memory.dmp

Filesize
64KB

Download
memory/1580-62-0x00000159825A0000-0x00000159825B0000-memory.dmp

Filesize
64KB

Download
memory/1580-78-0x00000159825E0000-0x00000159825F0000-memory.dmp

Filesize
64KB

Download
memory/1580-79-0x00000159825F0000-0x0000015982600000-memory.dmp

Filesize
64KB

Download
memory/1580-59-0x0000015982330000-0x00000159825A0000-memory.dmp

Filesize
2.4MB

Download
memory/1580-74-0x0000015982330000-0x00000159825A0000-memory.dmp

Filesize
2.4MB

Download
memory/1580-66-0x00000159825C0000-0x00000159825D0000-memory.dmp

Filesize
64KB

Download
memory/1580-73-0x0000015982310000-0x0000015982311000-memory.dmp

Filesize
4KB

Download
memory/3036-81-0x00000293802D0000-0x00000293802E0000-memory.dmp

Filesize
64KB

Download
memory/3036-104-0x00000293802C0000-0x00000293802D0000-memory.dmp

Filesize
64KB

Download
memory/3036-67-0x00000293802C0000-0x00000293802D0000-memory.dmp

Filesize
64KB

Download
memory/3036-60-0x0000029380290000-0x00000293802A0000-memory.dmp

Filesize
64KB

Download
memory/3036-61-0x00000293802A0000-0x00000293802B0000-memory.dmp

Filesize
64KB

Download
memory/3036-64-0x00000293802B0000-0x00000293802C0000-memory.dmp

Filesize
64KB

Download
memory/3036-54-0x0000029380270000-0x0000029380280000-memory.dmp

Filesize
64KB

Download
memory/3036-55-0x0000029380280000-0x0000029380290000-memory.dmp

Filesize
64KB

Download
memory/3036-80-0x0000029380000000-0x0000029380270000-memory.dmp

Filesize
2.4MB

Download
memory/3036-44-0x00000293F69E0000-0x00000293F69E1000-memory.dmp

Filesize
4KB

Download
memory/3036-34-0x0000029380000000-0x0000029380270000-memory.dmp

Filesize
2.4MB

Download
memory/3036-89-0x0000029380270000-0x0000029380280000-memory.dmp

Filesize
64KB

Download
memory/3036-91-0x00000293802E0000-0x00000293802F0000-memory.dmp

Filesize
64KB

Download
memory/3036-90-0x0000029380280000-0x0000029380290000-memory.dmp

Filesize
64KB

Download
memory/3036-97-0x00000293802A0000-0x00000293802B0000-memory.dmp

Filesize
64KB

Download
memory/3036-96-0x0000029380290000-0x00000293802A0000-memory.dmp

Filesize
64KB

Download
memory/3036-95-0x0000029380300000-0x0000029380310000-memory.dmp

Filesize
64KB

Download
memory/3036-94-0x00000293802F0000-0x0000029380300000-memory.dmp

Filesize
64KB

Download
memory/3036-99-0x0000029380310000-0x0000029380320000-memory.dmp

Filesize
64KB

Download
memory/3036-102-0x0000029380320000-0x0000029380330000-memory.dmp

Filesize
64KB

Download
memory/3036-101-0x00000293802B0000-0x00000293802C0000-memory.dmp

Filesize
64KB

Download
memory/3036-70-0x00000293F69E0000-0x00000293F69E1000-memory.dmp

Filesize
4KB

Download
memory/3036-105-0x0000029380330000-0x0000029380340000-memory.dmp

Filesize
64KB

Download
memory/3036-112-0x0000029380340000-0x0000029380350000-memory.dmp

Filesize
64KB

Download
memory/3036-116-0x0000029380360000-0x0000029380370000-memory.dmp

Filesize
64KB

Download
memory/3036-115-0x0000029380350000-0x0000029380360000-memory.dmp

Filesize
64KB

Download
memory/3036-118-0x00000293802D0000-0x00000293802E0000-memory.dmp

Filesize
64KB

Download
memory/3036-128-0x00000293803A0000-0x00000293803B0000-memory.dmp

Filesize
64KB

Download
memory/3036-125-0x0000029380390000-0x00000293803A0000-memory.dmp

Filesize
64KB

Download
memory/3036-127-0x0000029380300000-0x0000029380310000-memory.dmp

Filesize
64KB

Download
memory/3036-126-0x00000293802F0000-0x0000029380300000-memory.dmp

Filesize
64KB

Download
memory/3036-124-0x0000029380380000-0x0000029380390000-memory.dmp

Filesize
64KB

Download
memory/3036-123-0x00000293802E0000-0x00000293802F0000-memory.dmp

Filesize
64KB

Download
memory/3036-119-0x0000029380370000-0x0000029380380000-memory.dmp

Filesize
64KB

Download
memory/3036-129-0x00000293F69E0000-0x00000293F69E1000-memory.dmp

Filesize
4KB

Download
memory/3036-131-0x0000029380310000-0x0000029380320000-memory.dmp

Filesize
64KB

Download
memory/3036-133-0x0000029380320000-0x0000029380330000-memory.dmp

Filesize
64KB

Download
memory/3036-134-0x0000029380330000-0x0000029380340000-memory.dmp

Filesize
64KB

Download
memory/3036-135-0x0000029380340000-0x0000029380350000-memory.dmp

Filesize
64KB

Download
memory/3036-136-0x0000029380350000-0x0000029380360000-memory.dmp

Filesize
64KB

Download
memory/3036-137-0x0000029380360000-0x0000029380370000-memory.dmp

Filesize
64KB

Download
memory/3036-138-0x0000029380370000-0x0000029380380000-memory.dmp

Filesize
64KB

Download
memory/3036-139-0x0000029380390000-0x00000293803A0000-memory.dmp

Filesize
64KB

Download
memory/3036-142-0x00000293803A0000-0x00000293803B0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads