125b4582b7dd2221044fb257f580da57e4dc61b03a6c35e208fed973f71c28a1

General

Target

Paraffinerer.ps1
Size

53KB
MD5

6f2c225ff02a35f64c6157286f9e90b1
SHA1

fdfb286088fd3cb3c3fa39f39e2e7ba48b3c6624
SHA256

0f4caa809a6b9ad70a305958af34e60b82f3080bbb7067f316ca85702ffba443
SHA512

c5fb4eafb4c29b774648bcec26736ad0808815d10618c95b723de9296240e6f9cbc35e90cc4439266f013810f16dde0f44a840fa928d8be2a8562cc5ac8d2eb5
SSDEEP

1536:qBW8/PWnOQz17PFJoL9Wt34bzGFC3fm5Xa5Z9YwsklLt7:qj/PWnOa7NG9034fGQ3fmFTI7

Score

8^/10

execution persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2736	powershell.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3350944739-639801879-157714471-1000\{32B74384-3F4B-4EB4-8C28-FD00A25222B7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2736	powershell.exe
2736	powershell.exe
2736	powershell.exe
2736	powershell.exe
2736	powershell.exe
2736	powershell.exe
2736	powershell.exe
2736	powershell.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeIncreaseQuotaPrivilege	2736	powershell.exe
Token: SeSecurityPrivilege	2736	powershell.exe
Token: SeTakeOwnershipPrivilege	2736	powershell.exe
Token: SeLoadDriverPrivilege	2736	powershell.exe
Token: SeSystemProfilePrivilege	2736	powershell.exe
Token: SeSystemtimePrivilege	2736	powershell.exe
Token: SeProfSingleProcessPrivilege	2736	powershell.exe
Token: SeIncBasePriorityPrivilege	2736	powershell.exe
Token: SeCreatePagefilePrivilege	2736	powershell.exe
Token: SeBackupPrivilege	2736	powershell.exe
Token: SeRestorePrivilege	2736	powershell.exe
Token: SeShutdownPrivilege	2736	powershell.exe
Token: SeDebugPrivilege	2736	powershell.exe
Token: SeSystemEnvironmentPrivilege	2736	powershell.exe
Token: SeRemoteShutdownPrivilege	2736	powershell.exe
Token: SeUndockPrivilege	2736	powershell.exe
Token: SeManageVolumePrivilege	2736	powershell.exe
Token: 33	2736	powershell.exe
Token: 34	2736	powershell.exe
Token: 35	2736	powershell.exe
Token: 36	2736	powershell.exe
Token: SeShutdownPrivilege	4336	explorer.exe
Token: SeCreatePagefilePrivilege	4336	explorer.exe
Token: SeShutdownPrivilege	4336	explorer.exe
Token: SeCreatePagefilePrivilege	4336	explorer.exe
Token: SeShutdownPrivilege	4336	explorer.exe
Token: SeCreatePagefilePrivilege	4336	explorer.exe
Token: SeShutdownPrivilege	4336	explorer.exe
Token: SeCreatePagefilePrivilege	4336	explorer.exe
Token: SeShutdownPrivilege	4336	explorer.exe
Token: SeCreatePagefilePrivilege	4336	explorer.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe

Suspicious use of SendNotifyMessage 9 IoCs

pid	Process
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\Paraffinerer.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736

C:\Windows\explorer.exe
explorer.exe
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4336

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:916

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1160

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:5092

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5044

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4592

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4132

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2692

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1696

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2732

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:868

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4192

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3024

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3612

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4148

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3380

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4952

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:1284

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3832

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2320

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4380

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:2152

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:724

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4176

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:444

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:4188

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:5052

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:1224

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:5108

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:1016

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4608

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3624

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3352

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3452

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Filesize
471B

MD5
62c508511a794bcc4d6228a0b4ef61d1

SHA1
b4e378c16fa898c3a2169f9fecad811becae6635

SHA256
5ed56c9d8284974af69a48b972977e0fe4467995eb74e8741094cb99d8ff498a

SHA512
458bfbe6ed86badb5a1ca2368828e048da6cb641c334f09943d47cd61a58e9f15f054de28e6d4289351405792a3f68ce2bff3766613149e61cca6a4ab439193d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04

Filesize
412B

MD5
d04c3e874a340f2f25bae8adcde19474

SHA1
3a01a3d917f6ff42061e3ecf4d3883a6e0bae3d3

SHA256
422faeb61d62741dfc24f56778758bcd3be0634ad9b5faa961a4164de95ca4e9

SHA512
88cbfa677d84940459c6121d8233932054ce892e77865d8d8a9059fb27b8db42ef69295daf6a8a24cd28869e615a09f126d9dd06f3d27491b6bc246ecf15cebc

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

Filesize
2KB

MD5
f620ee6c5778dd693867b0143c0821d1

SHA1
4fd63db3099df35b517a90cb5e89080a5af7a1be

SHA256
35d8b9c9e5cb4f102f744f313f86721bc1f340c453540e14bd933fd07467044c

SHA512
80ccf816a3d1f63a414d24b5a941c8f56bea82d3f4d125a77f41d98e613bc817ea257c7ea5219200ee54fe464b2f17eb522e6bb43fc6366b1b02ad5eeceb2b73

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133740796843561848.txt

Filesize
75KB

MD5
560aa9bfeea6925928cf89b0b8452723

SHA1
d2cf1b905b037809d5a4ccd54db2bad4929ff943

SHA256
5a7a751c28f85d4c73198e401e8bdf898c517cdd03e19dbbd2ddb1bb8c486ff7

SHA512
07d222302925f6498fd4ee2cbda9f90fbcb57816a85818816314b043ac3e2e5b5213cd991fae62a47833cbbe80a48ff9e620715350ed05e9014fed83e3e02603

Download Submit
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\1QK7O5FT\microsoft.windows[1].xml

Filesize
97B

MD5
d999f65105ba511b9a85c92595366aa5

SHA1
acd1800ccb77d1ed5bf43fd29c05fbcdd9d14adb

SHA256
626774fae7cf7de253841c4d2244fa2a50cc4a5abf5cb2d2006afd836412ba5a

SHA512
c793a44c17918e30348fe2b836bfbcf0edacb4f76b99f6dc6a67d8047cfbd2079645a853500e9520b202883f8cce2433690406edf47b08cf334272df6c4c60f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0iwl5qjv.bm4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1284-68-0x000002CC8C250000-0x000002CC8C270000-memory.dmp

Filesize
128KB

Download
memory/1284-60-0x000002CC8C110000-0x000002CC8C130000-memory.dmp

Filesize
128KB

Download
memory/1284-39-0x000002CC8AD00000-0x000002CC8AE00000-memory.dmp

Filesize
1024KB

Download
memory/1284-44-0x000002CC8BE40000-0x000002CC8BE60000-memory.dmp

Filesize
128KB

Download
memory/1284-41-0x000002CC8AD00000-0x000002CC8AE00000-memory.dmp

Filesize
1024KB

Download
memory/1284-40-0x000002CC8AD00000-0x000002CC8AE00000-memory.dmp

Filesize
1024KB

Download
memory/2152-197-0x0000000004450000-0x0000000004451000-memory.dmp

Filesize
4KB

Download
memory/2320-204-0x0000021233760000-0x0000021233780000-memory.dmp

Filesize
128KB

Download
memory/2320-199-0x0000021232C00000-0x0000021232D00000-memory.dmp

Filesize
1024KB

Download
memory/2320-215-0x0000021233AA0000-0x0000021233AC0000-memory.dmp

Filesize
128KB

Download
memory/2320-218-0x0000021233720000-0x0000021233740000-memory.dmp

Filesize
128KB

Download
memory/2736-11-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

Filesize
10.8MB

Download
memory/2736-10-0x0000023DFB920000-0x0000023DFB942000-memory.dmp

Filesize
136KB

Download
memory/2736-18-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

Filesize
10.8MB

Download
memory/2736-17-0x00007FFBC48C3000-0x00007FFBC48C5000-memory.dmp

Filesize
8KB

Download
memory/2736-15-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

Filesize
10.8MB

Download
memory/2736-14-0x0000023DFB9C0000-0x0000023DFB9E4000-memory.dmp

Filesize
144KB

Download
memory/2736-13-0x0000023DFB9C0000-0x0000023DFB9EA000-memory.dmp

Filesize
168KB

Download
memory/2736-12-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

Filesize
10.8MB

Download
memory/2736-24-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

Filesize
10.8MB

Download
memory/2736-25-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

Filesize
10.8MB

Download
memory/2736-0-0x00007FFBC48C3000-0x00007FFBC48C5000-memory.dmp

Filesize
8KB

Download
memory/2736-21-0x00007FFBC48C0000-0x00007FFBC5381000-memory.dmp

Filesize
10.8MB

Download
memory/3024-34-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/3380-38-0x00000000048B0000-0x00000000048B1000-memory.dmp

Filesize
4KB

Download
memory/4176-333-0x00000000031A0000-0x00000000031A1000-memory.dmp

Filesize
4KB

Download
memory/4188-340-0x000001CE9BA80000-0x000001CE9BAA0000-memory.dmp

Filesize
128KB

Download
memory/4188-357-0x000001CE9BA40000-0x000001CE9BA60000-memory.dmp

Filesize
128KB

Download
memory/4188-370-0x000001CE9BEF0000-0x000001CE9BF10000-memory.dmp

Filesize
128KB

Download
memory/5052-464-0x00000000030D0000-0x00000000030D1000-memory.dmp

Filesize
4KB

Download
memory/5108-471-0x0000028EB17F0000-0x0000028EB1810000-memory.dmp

Filesize
128KB

Download
memory/5108-473-0x0000028EB17B0000-0x0000028EB17D0000-memory.dmp

Filesize
128KB

Download
memory/5108-483-0x0000028EB1C50000-0x0000028EB1C70000-memory.dmp

Filesize
128KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads