7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/10/2024, 01:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e.jar
Size

23.4MB
MD5

f476422a60511cd61f6754728580ce34
SHA1

370946c72b96148d33fb436a527becc9ab291b03
SHA256

7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e
SHA512

8fae7bc1a0a568b0dd4a30c21be8d8d9da1fcdc6dcc3fd5ee1c5dab940ecf2539b9fadc2e5a597d0177c19a6cad27e7619ed7174f54e0d390e5fb419b7d49d48
SSDEEP

393216:Uj2fnuMWx2Y+fTS66Na4CUid5EYa9fL8kE/Yiuyw6iPhRD/IBRsme1eZrWl+9p:CquP2Y/fDCdfElCV/tw6i5qBioKUP

Score

7^/10

persistence privilege_escalation

Malware Config

Signatures

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8-startup-manager.jar	javaw.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jre-8-startup-manager.jar	javaw.exe

Loads dropped DLL 3 IoCs

pid	Process
2940	java.exe
1684	javaw.exe
1684	javaw.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 57 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
2940	java.exe
2940	java.exe
1684	javaw.exe
1684	javaw.exe
1684	javaw.exe
1684	javaw.exe
1684	javaw.exe
1684	javaw.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1684	2940	java.exe	83
PID 2940 wrote to memory of 1684	2940	java.exe	83
PID 1684 wrote to memory of 3792	1684	javaw.exe	84
PID 1684 wrote to memory of 3792	1684	javaw.exe	84
PID 1684 wrote to memory of 3224	1684	javaw.exe	86
PID 1684 wrote to memory of 3224	1684	javaw.exe	86
PID 1684 wrote to memory of 4024	1684	javaw.exe	92
PID 1684 wrote to memory of 4024	1684	javaw.exe	92
PID 1684 wrote to memory of 3812	1684	javaw.exe	97
PID 1684 wrote to memory of 3812	1684	javaw.exe	97
PID 1684 wrote to memory of 2312	1684	javaw.exe	101
PID 1684 wrote to memory of 2312	1684	javaw.exe	101
PID 1684 wrote to memory of 4032	1684	javaw.exe	103
PID 1684 wrote to memory of 4032	1684	javaw.exe	103
PID 1684 wrote to memory of 2944	1684	javaw.exe	105
PID 1684 wrote to memory of 2944	1684	javaw.exe	105
PID 1684 wrote to memory of 3884	1684	javaw.exe	107
PID 1684 wrote to memory of 3884	1684	javaw.exe	107
PID 1684 wrote to memory of 4960	1684	javaw.exe	109
PID 1684 wrote to memory of 4960	1684	javaw.exe	109
PID 1684 wrote to memory of 2472	1684	javaw.exe	111
PID 1684 wrote to memory of 2472	1684	javaw.exe	111
PID 1684 wrote to memory of 4844	1684	javaw.exe	113
PID 1684 wrote to memory of 4844	1684	javaw.exe	113
PID 1684 wrote to memory of 972	1684	javaw.exe	115
PID 1684 wrote to memory of 972	1684	javaw.exe	115
PID 1684 wrote to memory of 2688	1684	javaw.exe	117
PID 1684 wrote to memory of 2688	1684	javaw.exe	117
PID 1684 wrote to memory of 2656	1684	javaw.exe	119
PID 1684 wrote to memory of 2656	1684	javaw.exe	119
PID 1684 wrote to memory of 1252	1684	javaw.exe	121
PID 1684 wrote to memory of 1252	1684	javaw.exe	121
PID 1684 wrote to memory of 2960	1684	javaw.exe	123
PID 1684 wrote to memory of 2960	1684	javaw.exe	123
PID 1684 wrote to memory of 3436	1684	javaw.exe	125
PID 1684 wrote to memory of 3436	1684	javaw.exe	125
PID 1684 wrote to memory of 5092	1684	javaw.exe	127
PID 1684 wrote to memory of 5092	1684	javaw.exe	127
PID 1684 wrote to memory of 4128	1684	javaw.exe	129
PID 1684 wrote to memory of 4128	1684	javaw.exe	129

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e.jar
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files\Java\jre-1.8\bin\javaw.exe
  "C:\Program Files\Java\jre-1.8\bin\javaw" -jar "C:\Users\Admin\AppData\Local\Temp\7a11f106c159e995601f6acf7cb5bf9a78f9e766a97eb63502cb9666febc7a6e.jar" DELAY:3
  2⤵
  - Drops startup file
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3792
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3224
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4024
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3812
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2312
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4032
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2944
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3884
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4960
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2472
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4844
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:972
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2688
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2656
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1252
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2960
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3436
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5092
- - C:\Windows\SYSTEM32\netsh.exe
    netsh wlan show networks mode=bssid
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\JNativeHook-385777659FA84E94A3812EB9A8AFAD27AE3CEED4.x86_64.dll

Filesize
80KB

MD5
e9a449971b9efb0a2e12b9cfdd95c076

SHA1
385777659fa84e94a3812eb9a8afad27ae3ceed4

SHA256
b8c331c9f915960201da9af9c9dc8309e95e7d533741e71f4a5d13ca007d3e18

SHA512
bbcaf66b316cb60c63bb190099bee36a0059f13fa35fdf3a9a3e7e9a5304abe57acd71d644cde554427825249b460d58f0aba79f599f0c6fa40d23ea21aa941d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jna-63116079\jna4153992730008002643.dll

Filesize
248KB

MD5
4de85f9679c3a75f6d7d3e56094aa106

SHA1
052f62fb2ebec89fbe412db480865910eab693ad

SHA256
3d1b2427b45ff5178bbb4db395758bedd3a1e91121ebb3e3640b5c4e20eb22cc

SHA512
e8357eabd548ffeba42715d891b9e1ed22b7bf720f48b1888407b9ebe7a796719c60a38f4fb8bb1cf32d3c9bed210a07cc227424ef991d356ec3acef9e6223ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-355097885-2402257403-2971294179-1000\83aa4cc77f591dfc2374580bbd95f6ba_30dd1cc1-5c25-4745-b2f5-cffa52b1a886

Filesize
45B

MD5
c8366ae350e7019aefc9d1e6e6a498c6

SHA1
5731d8a3e6568a5f2dfbbc87e3db9637df280b61

SHA256
11e6aca8e682c046c83b721eeb5c72c5ef03cb5936c60df6f4993511ddc61238

SHA512
33c980d5a638bfc791de291ebf4b6d263b384247ab27f261a54025108f2f85374b579a026e545f81395736dd40fa4696f2163ca17640dd47f1c42bc9971b18cd

Download Submit
memory/1684-87-0x0000020C38E80000-0x0000020C38E90000-memory.dmp

Filesize
64KB

Download
memory/1684-126-0x0000020C38E90000-0x0000020C38EA0000-memory.dmp

Filesize
64KB

Download
memory/1684-137-0x0000020C38F40000-0x0000020C38F50000-memory.dmp

Filesize
64KB

Download
memory/1684-136-0x0000020C38F30000-0x0000020C38F40000-memory.dmp

Filesize
64KB

Download
memory/1684-90-0x0000020C38E90000-0x0000020C38EA0000-memory.dmp

Filesize
64KB

Download
memory/1684-35-0x0000020C38BB0000-0x0000020C38E20000-memory.dmp

Filesize
2.4MB

Download
memory/1684-134-0x0000020C38F00000-0x0000020C38F10000-memory.dmp

Filesize
64KB

Download
memory/1684-44-0x0000020C372F0000-0x0000020C372F1000-memory.dmp

Filesize
4KB

Download
memory/1684-133-0x0000020C38EF0000-0x0000020C38F00000-memory.dmp

Filesize
64KB

Download
memory/1684-53-0x0000020C38E20000-0x0000020C38E30000-memory.dmp

Filesize
64KB

Download
memory/1684-55-0x0000020C38E30000-0x0000020C38E40000-memory.dmp

Filesize
64KB

Download
memory/1684-132-0x0000020C38EE0000-0x0000020C38EF0000-memory.dmp

Filesize
64KB

Download
memory/1684-60-0x0000020C38E50000-0x0000020C38E60000-memory.dmp

Filesize
64KB

Download
memory/1684-59-0x0000020C38E40000-0x0000020C38E50000-memory.dmp

Filesize
64KB

Download
memory/1684-131-0x0000020C38ED0000-0x0000020C38EE0000-memory.dmp

Filesize
64KB

Download
memory/1684-130-0x0000020C38EC0000-0x0000020C38ED0000-memory.dmp

Filesize
64KB

Download
memory/1684-64-0x0000020C38E60000-0x0000020C38E70000-memory.dmp

Filesize
64KB

Download
memory/1684-129-0x0000020C38EB0000-0x0000020C38EC0000-memory.dmp

Filesize
64KB

Download
memory/1684-128-0x0000020C38EA0000-0x0000020C38EB0000-memory.dmp

Filesize
64KB

Download
memory/1684-108-0x0000020C38EE0000-0x0000020C38EF0000-memory.dmp

Filesize
64KB

Download
memory/1684-123-0x0000020C372F0000-0x0000020C372F1000-memory.dmp

Filesize
4KB

Download
memory/1684-117-0x0000020C38E70000-0x0000020C38E80000-memory.dmp

Filesize
64KB

Download
memory/1684-118-0x0000020C38F10000-0x0000020C38F20000-memory.dmp

Filesize
64KB

Download
memory/1684-119-0x0000020C38F20000-0x0000020C38F30000-memory.dmp

Filesize
64KB

Download
memory/1684-120-0x0000020C38F30000-0x0000020C38F40000-memory.dmp

Filesize
64KB

Download
memory/1684-121-0x0000020C38F40000-0x0000020C38F50000-memory.dmp

Filesize
64KB

Download
memory/1684-77-0x0000020C38E70000-0x0000020C38E80000-memory.dmp

Filesize
64KB

Download
memory/1684-122-0x0000020C38E80000-0x0000020C38E90000-memory.dmp

Filesize
64KB

Download
memory/1684-111-0x0000020C38EF0000-0x0000020C38F00000-memory.dmp

Filesize
64KB

Download
memory/1684-100-0x0000020C38E60000-0x0000020C38E70000-memory.dmp

Filesize
64KB

Download
memory/1684-112-0x0000020C38F00000-0x0000020C38F10000-memory.dmp

Filesize
64KB

Download
memory/1684-89-0x0000020C38E20000-0x0000020C38E30000-memory.dmp

Filesize
64KB

Download
memory/1684-91-0x0000020C38E30000-0x0000020C38E40000-memory.dmp

Filesize
64KB

Download
memory/1684-92-0x0000020C38EA0000-0x0000020C38EB0000-memory.dmp

Filesize
64KB

Download
memory/1684-96-0x0000020C38EB0000-0x0000020C38EC0000-memory.dmp

Filesize
64KB

Download
memory/1684-95-0x0000020C38E50000-0x0000020C38E60000-memory.dmp

Filesize
64KB

Download
memory/1684-94-0x0000020C38E40000-0x0000020C38E50000-memory.dmp

Filesize
64KB

Download
memory/1684-98-0x0000020C38EC0000-0x0000020C38ED0000-memory.dmp

Filesize
64KB

Download
memory/1684-101-0x0000020C38ED0000-0x0000020C38EE0000-memory.dmp

Filesize
64KB

Download
memory/1684-86-0x0000020C38BB0000-0x0000020C38E20000-memory.dmp

Filesize
2.4MB

Download
memory/2940-58-0x00000260996C0000-0x0000026099930000-memory.dmp

Filesize
2.4MB

Download
memory/2940-31-0x0000026099980000-0x0000026099990000-memory.dmp

Filesize
64KB

Download
memory/2940-25-0x0000026099950000-0x0000026099960000-memory.dmp

Filesize
64KB

Download
memory/2940-11-0x0000026097DE0000-0x0000026097DE1000-memory.dmp

Filesize
4KB

Download
memory/2940-71-0x0000026099930000-0x0000026099940000-memory.dmp

Filesize
64KB

Download
memory/2940-72-0x0000026099940000-0x0000026099950000-memory.dmp

Filesize
64KB

Download
memory/2940-73-0x0000026099960000-0x0000026099970000-memory.dmp

Filesize
64KB

Download
memory/2940-74-0x0000026099970000-0x0000026099980000-memory.dmp

Filesize
64KB

Download
memory/2940-75-0x0000026099980000-0x0000026099990000-memory.dmp

Filesize
64KB

Download
memory/2940-70-0x00000260996C0000-0x0000026099930000-memory.dmp

Filesize
2.4MB

Download
memory/2940-69-0x0000026097DE0000-0x0000026097DE1000-memory.dmp

Filesize
4KB

Download
memory/2940-67-0x0000026099950000-0x0000026099960000-memory.dmp

Filesize
64KB

Download
memory/2940-65-0x0000026097DE0000-0x0000026097DE1000-memory.dmp

Filesize
4KB

Download
memory/2940-63-0x0000026099940000-0x0000026099950000-memory.dmp

Filesize
64KB

Download
memory/2940-2-0x00000260996C0000-0x0000026099930000-memory.dmp

Filesize
2.4MB

Download
memory/2940-61-0x0000026099930000-0x0000026099940000-memory.dmp

Filesize
64KB

Download
memory/2940-22-0x0000026099930000-0x0000026099940000-memory.dmp

Filesize
64KB

Download
memory/2940-23-0x0000026099940000-0x0000026099950000-memory.dmp

Filesize
64KB

Download
memory/2940-29-0x0000026099970000-0x0000026099980000-memory.dmp

Filesize
64KB

Download
memory/2940-27-0x0000026099960000-0x0000026099970000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads