ae0ba7ecf43d1ee0a4cb8784d3730d56b773b95e7518bd9842d8defed69e83e8

Analysis

max time kernel
146s
max time network
125s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
08-11-2024 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Raid_Recovery.exe
Size

7.6MB
MD5

2535e906ec2e36ef9fb2c94ce851ca8d
SHA1

31518d602483f06560010effaa12e99f6610d726
SHA256

ae0ba7ecf43d1ee0a4cb8784d3730d56b773b95e7518bd9842d8defed69e83e8
SHA512

cf86f3a70a377eee31e8fbab4b2b71cd96e71f81ea04c7475f92ad8d9022b283f7e21eb61c17f52b6c28b4cdafee8f1c914cc3a43063aab6cbcf64f1c55a3dc1
SSDEEP

196608:9nrp/d1H8ERh5xMYkegR8M4r2lFQKekvuGrilmtAonBdrLLEAq:rPzd+5v+M6mtuG/dx/2

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	raid_recovery.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	raid_recovery.exe

Executes dropped EXE 1 IoCs

pid	Process
1664	raid_recovery.exe

Loads dropped DLL 8 IoCs

pid	Process
2616	Raid_Recovery.exe
2616	Raid_Recovery.exe
2716	regsvr32.exe
2520	regsvr32.exe
2616	Raid_Recovery.exe
2616	Raid_Recovery.exe
1664	raid_recovery.exe
1664	raid_recovery.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\g:	raid_recovery.exe
File opened (read-only)	\??\h:	raid_recovery.exe
File opened (read-only)	\??\j:	raid_recovery.exe
File opened (read-only)	\??\k:	raid_recovery.exe
File opened (read-only)	\??\A:	raid_recovery.exe
File opened (read-only)	\??\b:	raid_recovery.exe
File opened (read-only)	\??\B:	raid_recovery.exe
File opened (read-only)	\??\F:	raid_recovery.exe
File opened (read-only)	\??\T:	raid_recovery.exe
File opened (read-only)	\??\P:	raid_recovery.exe
File opened (read-only)	\??\u:	raid_recovery.exe
File opened (read-only)	\??\W:	raid_recovery.exe
File opened (read-only)	\??\x:	raid_recovery.exe
File opened (read-only)	\??\H:	raid_recovery.exe
File opened (read-only)	\??\J:	raid_recovery.exe
File opened (read-only)	\??\o:	raid_recovery.exe
File opened (read-only)	\??\p:	raid_recovery.exe
File opened (read-only)	\??\t:	raid_recovery.exe
File opened (read-only)	\??\U:	raid_recovery.exe
File opened (read-only)	\??\r:	raid_recovery.exe
File opened (read-only)	\??\s:	raid_recovery.exe
File opened (read-only)	\??\V:	raid_recovery.exe
File opened (read-only)	\??\a:	raid_recovery.exe
File opened (read-only)	\??\E:	raid_recovery.exe
File opened (read-only)	\??\i:	raid_recovery.exe
File opened (read-only)	\??\M:	raid_recovery.exe
File opened (read-only)	\??\m:	raid_recovery.exe
File opened (read-only)	\??\q:	raid_recovery.exe
File opened (read-only)	\??\R:	raid_recovery.exe
File opened (read-only)	\??\S:	raid_recovery.exe
File opened (read-only)	\??\e:	raid_recovery.exe
File opened (read-only)	\??\I:	raid_recovery.exe
File opened (read-only)	\??\K:	raid_recovery.exe
File opened (read-only)	\??\l:	raid_recovery.exe
File opened (read-only)	\??\w:	raid_recovery.exe
File opened (read-only)	\??\N:	raid_recovery.exe
File opened (read-only)	\??\Q:	raid_recovery.exe
File opened (read-only)	\??\v:	raid_recovery.exe
File opened (read-only)	\??\X:	raid_recovery.exe
File opened (read-only)	\??\G:	raid_recovery.exe
File opened (read-only)	\??\L:	raid_recovery.exe
File opened (read-only)	\??\z:	raid_recovery.exe
File opened (read-only)	\??\Z:	raid_recovery.exe
File opened (read-only)	\??\Y:	raid_recovery.exe
File opened (read-only)	\??\D:	raid_recovery.exe
File opened (read-only)	\??\n:	raid_recovery.exe
File opened (read-only)	\??\O:	raid_recovery.exe
File opened (read-only)	\??\y:	raid_recovery.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	raid_recovery.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\IO.VXD	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\Alligator.k52	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_load.di	Raid_Recovery.exe
File opened for modification	C:\Program Files (x86)\DiskInternals\RaidRecovery\fsm.ini	raid_recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\License.txt	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\Uninstall.exe	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\fsm.ini	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\StarBurn.dll	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\MIG_29.dll	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\PascalStreams.dll	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_wm.di	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\cbfs.cab	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\raid_recovery.exe	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\click.wav	Raid_Recovery.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Raid_Recovery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	raid_recovery.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0005000000018739-92.dat	nsis_installer_1
behavioral1/files/0x0005000000018739-92.dat	nsis_installer_2

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3E0FA044-926C-42D9-BA12-EF16E980913B}\CLSID = "{3E0FA044-926C-42D9-BA12-EF16E980913B}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3E0FA044-926C-42D9-BA12-EF16E980913B}\FilterData = 020000000000200001000000000000003070693308000000000000000100000000000000000000003074793300000000380000000000000083eb36e44f52ce119f530020af0ba770	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}\ = "AsyncEx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}\InprocServer32\ = "C:\\Program Files (x86)\\DiskInternals\\RaidRecovery\\bs_load.di"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3E0FA044-926C-42D9-BA12-EF16E980913B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3E0FA044-926C-42D9-BA12-EF16E980913B}\FriendlyName = "AsyncEx"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe
Token: SeBackupPrivilege	1664	raid_recovery.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1664	raid_recovery.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1664	raid_recovery.exe
1664	raid_recovery.exe
1664	raid_recovery.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 2520	2616	Raid_Recovery.exe	31
PID 2616 wrote to memory of 2520	2616	Raid_Recovery.exe	31
PID 2616 wrote to memory of 2520	2616	Raid_Recovery.exe	31
PID 2616 wrote to memory of 2520	2616	Raid_Recovery.exe	31
PID 2616 wrote to memory of 2520	2616	Raid_Recovery.exe	31
PID 2616 wrote to memory of 2520	2616	Raid_Recovery.exe	31
PID 2616 wrote to memory of 2520	2616	Raid_Recovery.exe	31
PID 2616 wrote to memory of 2716	2616	Raid_Recovery.exe	32
PID 2616 wrote to memory of 2716	2616	Raid_Recovery.exe	32
PID 2616 wrote to memory of 2716	2616	Raid_Recovery.exe	32
PID 2616 wrote to memory of 2716	2616	Raid_Recovery.exe	32
PID 2616 wrote to memory of 2716	2616	Raid_Recovery.exe	32
PID 2616 wrote to memory of 2716	2616	Raid_Recovery.exe	32
PID 2616 wrote to memory of 2716	2616	Raid_Recovery.exe	32
PID 2616 wrote to memory of 1664	2616	Raid_Recovery.exe	33
PID 2616 wrote to memory of 1664	2616	Raid_Recovery.exe	33
PID 2616 wrote to memory of 1664	2616	Raid_Recovery.exe	33
PID 2616 wrote to memory of 1664	2616	Raid_Recovery.exe	33

C:\Users\Admin\AppData\Local\Temp\Raid_Recovery.exe
"C:\Users\Admin\AppData\Local\Temp\Raid_Recovery.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_load.di"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2520
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_wm.di"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2716
- C:\Program Files (x86)\DiskInternals\RaidRecovery\raid_recovery.exe
  "C:\Program Files (x86)\DiskInternals\RaidRecovery\raid_recovery.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DiskInternals\RaidRecovery\PascalStreams.dll

Filesize
86KB

MD5
15aacef96e0673400bddae0c3a97462c

SHA1
51fdb75bd4a27386b960a19308620868c48cff1d

SHA256
a767d213f1fa41bddfaad8540f987fbf39516802ace609916f336cb808afd40a

SHA512
e07b43379ccc42d8d86342db8437d78bfecca4c9e1033d9691557c27480c98bbed081486db34c74e1f1ce2ecf26376aa92ebd5e0b4e32fcdcabc6a49a26963af

Download Submit
C:\Program Files (x86)\DiskInternals\RaidRecovery\STARBURN.DLL

Filesize
634KB

MD5
56c8cd1368ffcf4b1bdfc2e0b5030d70

SHA1
6186f2983412d0ee5456915550db2012738f9521

SHA256
07d3b623c763bd1039b35897933159a264bf127b707d335ddf340ee01d09bda4

SHA512
4e082103d09dbcc29fd2e8c0bd844a4856122e0e1d00a22c151703c06381057d1d6a83e2a1266a3bcd60a1a5d686d4081ae7f2d442b820ba921bfdb10b3699dc

Download Submit
C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_load.di

Filesize
466KB

MD5
15abbe3c15e018da7ef56841af33cb74

SHA1
7a91dca0f03b175929ded67625d79a5430c3ceff

SHA256
c0980bfddf43bbd6df2441f2dfa46f98f04b7b4d0f4f079b60abaaa21a1ab3e0

SHA512
c84e95cca9f8b901fe904937b70c23f7b86dc1037905d8bf0c6f8602a41abf4305bc1eb925447c1b74123d974b2f752eccfdd184ddf6cef6d7eb7194832d2ce1

Download Submit
C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_wm.di

Filesize
64KB

MD5
1321edc324c693184631b27870745b75

SHA1
aadda09fe92940aaac81c7733c3b636ea9592f34

SHA256
c00718b18ed6d0ee5021ff1a35f164676385c5b23f40ae332af6ea7805af3a9a

SHA512
5ce976ef98ee882f5dc2ae5366e5e08461ffa292b26bc1a24cf2bff52543f4ebd1eeaa3bf07616520d689d7b1afbdde6c3483ce9dfba59eb0ebaca3f170a9a4b

Download Submit
C:\Program Files (x86)\DiskInternals\RaidRecovery\fsm.ini

Filesize
563B

MD5
a1864a915f325991d70fba392d0de155

SHA1
cec19619d4f562cc14cadfe3a4c04675c4db9198

SHA256
68392cd7c819c2ad799e05a1d1298bb4a6c1f535fbfdcb1ded346805ad5ac99a

SHA512
6ab5a907937d42372a02fe5b49dd9fbef4d2a828f164f84b279eec3a47b13d812588dd410a0ae040478272f0eff5ae00838d7ec96f203f8a4df31a0bc4ffe13d

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdB146.tmp\ioSpecial.ini

Filesize
711B

MD5
49bc24794fb68d7c55a1c7453c7d60de

SHA1
9820ac4bef9396b08f1d36e64857547e16a69d24

SHA256
ae5f6086556c82e823968c0701daa6cacf0fdd278a87a0222af16f20b1fcc047

SHA512
369eca1940d27f765d50ddab94a4c6f2e4762dd460cf46d519ad9a25fab3146798046a9947d33d5c242aff06f36269ca339704fa05bb94fb287350071cbecdde

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdB146.tmp\ioSpecial.ini

Filesize
761B

MD5
b63f7fe14880c39c0ff5042434e96df6

SHA1
56ba28f7b2907a723910123aa166234c2a74912b

SHA256
70bf7f6871c7f3d10fc2d04ee1a0e0a0848f2b10e0b9035587835a27a4a3315c

SHA512
4b43b6421c4f42e25926e7ca17aea072132ee22175fc09045249c2e6dd4850050d5d63e9733eff5867e6237000410701b3d37dcab9470869e69468eb9cd231fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsdB146.tmp\ioSpecial.ini

Filesize
722B

MD5
7ce5488368993376c034d58463f987d1

SHA1
def778bff146293e3746cbabbcbd4f01c038ee79

SHA256
833e9e3cfaf705d11fa526b14a68bb1fad0c6a50bf8984db61ac59bc5bb840e2

SHA512
684e22160f550f8ef280919b05c07a86239e76aea888a3043384ad7c541178c3bd8329273207dce090425728050278f7b1a1faf7b20f3e67bb9fd838e91845bf

Download Submit
\Program Files (x86)\DiskInternals\RaidRecovery\Uninstall.exe

Filesize
66KB

MD5
ad4408b7e7d47924a9e1d8442fe06c69

SHA1
441821e2444406529168059ffce99516227b7af8

SHA256
d56802ef3c2d22037de0da86ea96789a36a95ffec018d414abdce47f31f82920

SHA512
5f4917141b839b3729472cf12780e3fb31e31ed3d7c4e4cd3a530bacc8746ce608afcbf8a72aa6f744d0c4eb3c44f4f60009e4de25a8fb21cfb795e3aa59bb7e

Download Submit
\Program Files (x86)\DiskInternals\RaidRecovery\raid_recovery.exe

Filesize
3.9MB

MD5
8738ac2b86e0e4feacd61ef379fd8c3c

SHA1
3ad50fc46b8cdb54945d0d53980a3b2c05981860

SHA256
0128c1a51b30a5d7f47bbed834abdb84f89c81cd4f19101c4dfcfa13d3d9c9c2

SHA512
bf8ec6fcc2a8cf9f27fb74307464b3e08475cf2329d03287c2f6a81f42cc5f563184ed2e2b97517700bbecf43d7aaef6bce506f8a82a2b34795247fddcbcb4a2

Download Submit
\Users\Admin\AppData\Local\Temp\nsdB146.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
memory/1664-231-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-237-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-216-0x0000000000180000-0x000000000019B000-memory.dmp

Filesize
108KB

Download
memory/1664-246-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-203-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-217-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-244-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-220-0x0000000000180000-0x000000000019B000-memory.dmp

Filesize
108KB

Download
memory/1664-219-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-223-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-226-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-230-0x0000000000180000-0x000000000019B000-memory.dmp

Filesize
108KB

Download
memory/1664-229-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-242-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-233-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-235-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-213-0x0000000003B50000-0x0000000003BF2000-memory.dmp

Filesize
648KB

Download
memory/1664-239-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/1664-240-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2520-100-0x0000000001DD0000-0x0000000001E4A000-memory.dmp

Filesize
488KB

Download
memory/2616-103-0x00000000003D0000-0x00000000003E0000-memory.dmp

Filesize
64KB

Download
memory/2616-210-0x0000000003F70000-0x0000000004AB7000-memory.dmp

Filesize
11.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads