ae0ba7ecf43d1ee0a4cb8784d3730d56b773b95e7518bd9842d8defed69e83e8

Analysis

max time kernel
146s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2024 12:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Raid_Recovery.exe
Size

7.6MB
MD5

2535e906ec2e36ef9fb2c94ce851ca8d
SHA1

31518d602483f06560010effaa12e99f6610d726
SHA256

ae0ba7ecf43d1ee0a4cb8784d3730d56b773b95e7518bd9842d8defed69e83e8
SHA512

cf86f3a70a377eee31e8fbab4b2b71cd96e71f81ea04c7475f92ad8d9022b283f7e21eb61c17f52b6c28b4cdafee8f1c914cc3a43063aab6cbcf64f1c55a3dc1
SSDEEP

196608:9nrp/d1H8ERh5xMYkegR8M4r2lFQKekvuGrilmtAonBdrLLEAq:rPzd+5v+M6mtuG/dx/2

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	raid_recovery.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	raid_recovery.exe

Executes dropped EXE 1 IoCs

pid	Process
2848	raid_recovery.exe

Loads dropped DLL 8 IoCs

pid	Process
1972	Raid_Recovery.exe
1988	regsvr32.exe
1988	regsvr32.exe
2436	regsvr32.exe
2848	raid_recovery.exe
2848	raid_recovery.exe
2848	raid_recovery.exe
2848	raid_recovery.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\r:	raid_recovery.exe
File opened (read-only)	\??\w:	raid_recovery.exe
File opened (read-only)	\??\Z:	raid_recovery.exe
File opened (read-only)	\??\H:	raid_recovery.exe
File opened (read-only)	\??\k:	raid_recovery.exe
File opened (read-only)	\??\o:	raid_recovery.exe
File opened (read-only)	\??\p:	raid_recovery.exe
File opened (read-only)	\??\h:	raid_recovery.exe
File opened (read-only)	\??\j:	raid_recovery.exe
File opened (read-only)	\??\Q:	raid_recovery.exe
File opened (read-only)	\??\s:	raid_recovery.exe
File opened (read-only)	\??\b:	raid_recovery.exe
File opened (read-only)	\??\e:	raid_recovery.exe
File opened (read-only)	\??\E:	raid_recovery.exe
File opened (read-only)	\??\F:	raid_recovery.exe
File opened (read-only)	\??\u:	raid_recovery.exe
File opened (read-only)	\??\v:	raid_recovery.exe
File opened (read-only)	\??\g:	raid_recovery.exe
File opened (read-only)	\??\n:	raid_recovery.exe
File opened (read-only)	\??\R:	raid_recovery.exe
File opened (read-only)	\??\W:	raid_recovery.exe
File opened (read-only)	\??\S:	raid_recovery.exe
File opened (read-only)	\??\y:	raid_recovery.exe
File opened (read-only)	\??\z:	raid_recovery.exe
File opened (read-only)	\??\D:	raid_recovery.exe
File opened (read-only)	\??\K:	raid_recovery.exe
File opened (read-only)	\??\L:	raid_recovery.exe
File opened (read-only)	\??\m:	raid_recovery.exe
File opened (read-only)	\??\G:	raid_recovery.exe
File opened (read-only)	\??\i:	raid_recovery.exe
File opened (read-only)	\??\J:	raid_recovery.exe
File opened (read-only)	\??\Y:	raid_recovery.exe
File opened (read-only)	\??\P:	raid_recovery.exe
File opened (read-only)	\??\T:	raid_recovery.exe
File opened (read-only)	\??\U:	raid_recovery.exe
File opened (read-only)	\??\x:	raid_recovery.exe
File opened (read-only)	\??\A:	raid_recovery.exe
File opened (read-only)	\??\B:	raid_recovery.exe
File opened (read-only)	\??\I:	raid_recovery.exe
File opened (read-only)	\??\O:	raid_recovery.exe
File opened (read-only)	\??\M:	raid_recovery.exe
File opened (read-only)	\??\V:	raid_recovery.exe
File opened (read-only)	\??\X:	raid_recovery.exe
File opened (read-only)	\??\t:	raid_recovery.exe
File opened (read-only)	\??\a:	raid_recovery.exe
File opened (read-only)	\??\l:	raid_recovery.exe
File opened (read-only)	\??\N:	raid_recovery.exe
File opened (read-only)	\??\q:	raid_recovery.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	raid_recovery.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\Alligator.k52	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\License.txt	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_wm.di	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\raid_recovery.exe	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\IO.VXD	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\click.wav	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\MIG_29.dll	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\fsm.ini	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\Uninstall.exe	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_load.di	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\cbfs.cab	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\PascalStreams.dll	Raid_Recovery.exe
File created	C:\Program Files (x86)\DiskInternals\RaidRecovery\StarBurn.dll	Raid_Recovery.exe
File opened for modification	C:\Program Files (x86)\DiskInternals\RaidRecovery\fsm.ini	raid_recovery.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Raid_Recovery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	raid_recovery.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3E0FA044-926C-42D9-BA12-EF16E980913B}\CLSID = "{3E0FA044-926C-42D9-BA12-EF16E980913B}"	regsvr32.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3E0FA044-926C-42D9-BA12-EF16E980913B}\FilterData = 020000000000200001000000000000003070693308000000000000000100000000000000000000003074793300000000380000000000000083eb36e44f52ce119f530020af0ba770	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3E0FA044-926C-42D9-BA12-EF16E980913B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{3E0FA044-926C-42D9-BA12-EF16E980913B}\FriendlyName = "AsyncEx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}\InprocServer32\ = "C:\\Program Files (x86)\\DiskInternals\\RaidRecovery\\bs_load.di"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E0FA044-926C-42D9-BA12-EF16E980913B}\ = "AsyncEx"	regsvr32.exe

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe
Token: SeBackupPrivilege	2848	raid_recovery.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2848	raid_recovery.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2848	raid_recovery.exe
2848	raid_recovery.exe
2848	raid_recovery.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1988	1972	Raid_Recovery.exe	99
PID 1972 wrote to memory of 1988	1972	Raid_Recovery.exe	99
PID 1972 wrote to memory of 1988	1972	Raid_Recovery.exe	99
PID 1972 wrote to memory of 2436	1972	Raid_Recovery.exe	100
PID 1972 wrote to memory of 2436	1972	Raid_Recovery.exe	100
PID 1972 wrote to memory of 2436	1972	Raid_Recovery.exe	100
PID 1972 wrote to memory of 2848	1972	Raid_Recovery.exe	102
PID 1972 wrote to memory of 2848	1972	Raid_Recovery.exe	102
PID 1972 wrote to memory of 2848	1972	Raid_Recovery.exe	102

C:\Users\Admin\AppData\Local\Temp\Raid_Recovery.exe
"C:\Users\Admin\AppData\Local\Temp\Raid_Recovery.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_load.di"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1988
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_wm.di"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2436
- C:\Program Files (x86)\DiskInternals\RaidRecovery\raid_recovery.exe
  "C:\Program Files (x86)\DiskInternals\RaidRecovery\raid_recovery.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Enumerates connected drives
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\DiskInternals\RaidRecovery\PascalStreams.dll

Filesize
86KB

MD5
15aacef96e0673400bddae0c3a97462c

SHA1
51fdb75bd4a27386b960a19308620868c48cff1d

SHA256
a767d213f1fa41bddfaad8540f987fbf39516802ace609916f336cb808afd40a

SHA512
e07b43379ccc42d8d86342db8437d78bfecca4c9e1033d9691557c27480c98bbed081486db34c74e1f1ce2ecf26376aa92ebd5e0b4e32fcdcabc6a49a26963af

Download Submit
C:\Program Files (x86)\DiskInternals\RaidRecovery\STARBURN.DLL

Filesize
634KB

MD5
56c8cd1368ffcf4b1bdfc2e0b5030d70

SHA1
6186f2983412d0ee5456915550db2012738f9521

SHA256
07d3b623c763bd1039b35897933159a264bf127b707d335ddf340ee01d09bda4

SHA512
4e082103d09dbcc29fd2e8c0bd844a4856122e0e1d00a22c151703c06381057d1d6a83e2a1266a3bcd60a1a5d686d4081ae7f2d442b820ba921bfdb10b3699dc

Download Submit
C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_load.di

Filesize
466KB

MD5
15abbe3c15e018da7ef56841af33cb74

SHA1
7a91dca0f03b175929ded67625d79a5430c3ceff

SHA256
c0980bfddf43bbd6df2441f2dfa46f98f04b7b4d0f4f079b60abaaa21a1ab3e0

SHA512
c84e95cca9f8b901fe904937b70c23f7b86dc1037905d8bf0c6f8602a41abf4305bc1eb925447c1b74123d974b2f752eccfdd184ddf6cef6d7eb7194832d2ce1

Download Submit
C:\Program Files (x86)\DiskInternals\RaidRecovery\bs_wm.di

Filesize
64KB

MD5
1321edc324c693184631b27870745b75

SHA1
aadda09fe92940aaac81c7733c3b636ea9592f34

SHA256
c00718b18ed6d0ee5021ff1a35f164676385c5b23f40ae332af6ea7805af3a9a

SHA512
5ce976ef98ee882f5dc2ae5366e5e08461ffa292b26bc1a24cf2bff52543f4ebd1eeaa3bf07616520d689d7b1afbdde6c3483ce9dfba59eb0ebaca3f170a9a4b

Download Submit
C:\Program Files (x86)\DiskInternals\RaidRecovery\fsm.ini

Filesize
563B

MD5
a1864a915f325991d70fba392d0de155

SHA1
cec19619d4f562cc14cadfe3a4c04675c4db9198

SHA256
68392cd7c819c2ad799e05a1d1298bb4a6c1f535fbfdcb1ded346805ad5ac99a

SHA512
6ab5a907937d42372a02fe5b49dd9fbef4d2a828f164f84b279eec3a47b13d812588dd410a0ae040478272f0eff5ae00838d7ec96f203f8a4df31a0bc4ffe13d

Download Submit
C:\Program Files (x86)\DiskInternals\RaidRecovery\raid_recovery.exe

Filesize
3.9MB

MD5
8738ac2b86e0e4feacd61ef379fd8c3c

SHA1
3ad50fc46b8cdb54945d0d53980a3b2c05981860

SHA256
0128c1a51b30a5d7f47bbed834abdb84f89c81cd4f19101c4dfcfa13d3d9c9c2

SHA512
bf8ec6fcc2a8cf9f27fb74307464b3e08475cf2329d03287c2f6a81f42cc5f563184ed2e2b97517700bbecf43d7aaef6bce506f8a82a2b34795247fddcbcb4a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB3C0.tmp\InstallOptions.dll

Filesize
14KB

MD5
325b008aec81e5aaa57096f05d4212b5

SHA1
27a2d89747a20305b6518438eff5b9f57f7df5c3

SHA256
c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b

SHA512
18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB3C0.tmp\ioSpecial.ini

Filesize
699B

MD5
69869235f6b105ad9b0d18ae014c24eb

SHA1
44f6338adcda03e0bb68c1bf61c59b63f3dba565

SHA256
de8aa18c9e89db1296aed23847417ba1fdad5cba2eccf19738129f881fd2472a

SHA512
1cc1a948bba33e47baffd89362b7b321a0c0bf8bc8b655f0213f519ce94fb40b74ee7f5ea2a0ee68974857b7d8d0608f0bbdd88d87e15987c8a590aabe29ebca

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB3C0.tmp\ioSpecial.ini

Filesize
712B

MD5
69cc7ad9c1e01d652f3d2a978627de87

SHA1
61af2412dae24606c2de90629ee5e4ea945c135e

SHA256
66b542659d2bb0a2e4395b67adeb36e4982da4bdfa1a3c86647bc7549b94886d

SHA512
9941dac81a9bf4115649e675d0c8013d3291d91961793bf3e58b55d75f9869df86f9ac42e937bf1e95cfb1e1a2e09d380f5ca1d7ab882d405b43ba5867ed05fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsxB3C0.tmp\ioSpecial.ini

Filesize
722B

MD5
12459eb468729862b7409fc9040e15f2

SHA1
0002a5e68a69864c433633f770620d54f4b8f698

SHA256
179e9207c7f3f11dfa69283d5c87deccacd631eb0026bd2a3ab488e4ef8b1eaa

SHA512
81b23c09a0b67c0238c22c668cb338e7be2f0da1685ec52c2cf4f97a8e3a928901f11300008e9b6ef315bca7ea78550fe3bfcca1370298b2fa529e479ced5cd7

Download Submit
memory/1988-93-0x0000000000A40000-0x0000000000ABA000-memory.dmp

Filesize
488KB

Download
memory/2848-216-0x0000000000B75000-0x0000000000F46000-memory.dmp

Filesize
3.8MB

Download
memory/2848-227-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-214-0x0000000005940000-0x000000000595B000-memory.dmp

Filesize
108KB

Download
memory/2848-210-0x0000000002170000-0x0000000002212000-memory.dmp

Filesize
648KB

Download
memory/2848-200-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-219-0x0000000005940000-0x000000000595B000-memory.dmp

Filesize
108KB

Download
memory/2848-218-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-222-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-225-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-215-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-229-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-231-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-233-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-235-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-237-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-238-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-240-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-242-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download
memory/2848-244-0x0000000000400000-0x0000000000F47000-memory.dmp

Filesize
11.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads