banload | 72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e

Analysis

max time kernel
60s
max time network
37s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-12-2024 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Size

5.7MB
MD5

8ecd0b2213473f6e093149672f129b81
SHA1

d3d6696668b10a68a84f77ec13e6faf9b1fb093e
SHA256

72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e
SHA512

a0e98369b0d00223e186d2f2e7e1971339289a28ccbe6511ba3cd0782bafd0af89bec64fa2f63b5ba8ce66d723887a58a1d0bc5008b24f86539c9a52c73e8cf7
SSDEEP

98304:RF8QUitE4iLqaPWGnEvK7RkOEEo+A7mOkooq2Vjnmn:RFQWEPnPBnEXNGnM

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe

Renames multiple (219) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClient.man.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.lt-lt.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvStreamingManager.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\ja.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-conio-l1-1-0.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-convert-l1-1-0.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-multibyte-l1-1-0.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\pt-br.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\sa.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-process-l1-1-0.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-br.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\az.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\es.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fi-fi.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\da-DK\tipresx.dll.mui.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-file-l2-1-0.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-string-l1-1-0.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.bg-bg.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\cs.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\nn.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\hy.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ro-ro.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\be.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\fy.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVPolicy.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.fr-fr.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\ar.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\kab.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\mng2.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.cs-cz.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\tipresx.dll.mui.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\ky.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.nl-nl.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\it.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\mk.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R32.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2R64.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\de.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\hu.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\lt.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\pt.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\vccorlib140.dll.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\el-GR\tipresx.dll.mui.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\mshwLatin.dll.mui.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\7-Zip\Lang\et.txt.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Elevation	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Both"	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "EditionUpgradeHelperObj.EditionUpgradeHelper.1"	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\AppID = "{6F65B602-F798-4094-8A41-A2A61961E5E8}"	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Programmable	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\VersionIndependentProgID\ = "EditionUpgradeHelperObj.EditionUpgradeHelper"	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\LocalizedString = "@%SystemRoot%\\System32\\EditionUpgradeHelper.dll,-3100"	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Elevation\Enabled = "1"	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "EditionUpgradeHelper Class"	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "%SystemRoot%\\SysWow64\\EditionUpgradeHelper.dll"	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\TypeLib\ = "{09C6A793-92DC-4D27-A11D-3921C9314DED}"	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	952	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
Token: SeIncBasePriorityPrivilege	952	72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe

C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe
"C:\Users\Admin\AppData\Local\Temp\72c5512cf8937d76a5d9e0aa9985fdf07a59e9bb582454779245c8716dd6675e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3442511616-637977696-3186306149-1000\desktop.ini.tmp

Filesize
5.8MB

MD5
d6b2efe177675b9c3320fe8cdec21361

SHA1
dbfafdd6190246beb447c02867049af1f41fcd47

SHA256
2dc0a65bad1806b0c7a887715ba8995077cf9e24af0d8ec516be85a97d444fe2

SHA512
ad5391686aa42507701b13802f66d45d457b05764ac5578779ef524680cf39edb7a020f42a106f31b2d802bf2ec3cde0d6199835f52abce8c4c243a084a1db3d

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
5.9MB

MD5
00bffaf6b2816719362221cfbc4ef2be

SHA1
f76c408704e6cad9fe9dac702f3bd61a9d4a824e

SHA256
518806d3e6389d4dd031480187ea8bd0e348731b08acfbbf3f4bd58939a64dcc

SHA512
ca2cd2092563959da64bb361863af395b1d09043ba9c77fbf495dd84eac50aae6bd944259e6555d9e70ddf22e5c26baf85c823e3296cb15a6300df4b45d328b5

Download Submit
memory/952-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/952-2-0x0000000004970000-0x0000000004B7C000-memory.dmp

Filesize
2.0MB

Download
memory/952-9-0x0000000004970000-0x0000000004B7C000-memory.dmp

Filesize
2.0MB

Download
memory/952-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/952-13-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/952-14-0x0000000004970000-0x0000000004B7C000-memory.dmp

Filesize
2.0MB

Download
memory/952-36-0x0000000004970000-0x0000000004B7C000-memory.dmp

Filesize
2.0MB

Download
memory/952-37-0x0000000004970000-0x0000000004B7C000-memory.dmp

Filesize
2.0MB

Download
memory/952-80-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/952-92-0x0000000004970000-0x0000000004B7C000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads