xred | d51776621cd1ac69169b594b2bc892ca4d9c6040bb6aadd62207285e51cc79b9

Analysis

max time kernel
16s
max time network
17s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02/01/2025, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fix_device_gameloop/fix_device.exe
Size 1.6MB
Sample250102-rt2mbavnhy
SHA256 1cab7709001cc2f7a9d341f185cb79495ad86fa5dfcfddc0a9aad8cb3c49911f
MD5 e0551d8cf33f2f8443a390c3b07d0f68
SHA1 4eaa9c4fbb626f30a9041710096d16a2cf0decb5
SHA512 6134d41c44c8854ff9d251412d8e10e2768902fde1ab9761a55cccacb500d68921479edf0acbf4a3367025512531dc5af74f1eb7d9de93d6b51164c39b46f704
SSDEEP 24576:NaVasdFeWsN3skA4RV1Hom2KXMmHaqEZThuu1OUjezCk4o5BSj17QRDms33Z:8/ZkldoPK8YaqQhuukUjez+PpQRqs3p
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xred backdoor discovery persistence

Malware Config

Extracted

Family

xred

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Signatures

Xred
Xred is backdoor written in Delphi.
backdoor xred
Xred family
xred

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	fix_device.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation	Synaptics.exe

Executes dropped EXE 10 IoCs

pid	Process
2524	svchost.exe
876	fix_device.exe
784	svchost.exe
3308	._cache_fix_device.exe
3728	svchost.exe
4816	._cache_fix_device.exe
2948	Synaptics.exe
3792	._cache_Synaptics.exe
4596	svchost.exe
2464	._cache_Synaptics.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver = "C:\\ProgramData\\Synaptics\\Synaptics.exe"	fix_device.exe

AutoIT Executable 12 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/2280-3-0x0000000000400000-0x00000000004FF000-memory.dmp	autoit_exe
behavioral2/files/0x000a000000023b98-8.dat	autoit_exe
behavioral2/files/0x000a000000023b97-14.dat	autoit_exe
behavioral2/files/0x000a000000023b97-31.dat	autoit_exe
behavioral2/memory/4816-32-0x0000000000110000-0x00000000001EE000-memory.dmp	autoit_exe
behavioral2/memory/876-92-0x0000000000400000-0x00000000005A3000-memory.dmp	autoit_exe
behavioral2/files/0x000b000000023b9b-97.dat	autoit_exe
behavioral2/memory/2464-160-0x0000000000D90000-0x0000000000E6E000-memory.dmp	autoit_exe
behavioral2/memory/2464-217-0x0000000000D90000-0x0000000000E6E000-memory.dmp	autoit_exe
behavioral2/memory/4816-219-0x0000000000110000-0x00000000001EE000-memory.dmp	autoit_exe
behavioral2/memory/2948-220-0x0000000000400000-0x00000000005A3000-memory.dmp	autoit_exe
behavioral2/memory/4816-221-0x0000000000110000-0x00000000001EE000-memory.dmp	autoit_exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	svchost.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	svchost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	svchost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	._cache_Synaptics.exe
File created	C:\Windows\svchost.exe	fix_device.exe
File created	C:\Windows\svchost.exe	._cache_fix_device.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fix_device.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_fix_device.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_fix_device.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	._cache_Synaptics.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fix_device.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	fix_device.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Synaptics.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3408	EXCEL.EXE

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3408	EXCEL.EXE
3408	EXCEL.EXE
3408	EXCEL.EXE
3408	EXCEL.EXE
3408	EXCEL.EXE
3408	EXCEL.EXE
3408	EXCEL.EXE
3408	EXCEL.EXE

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 2524	2280	fix_device.exe	82
PID 2280 wrote to memory of 2524	2280	fix_device.exe	82
PID 2280 wrote to memory of 2524	2280	fix_device.exe	82
PID 2524 wrote to memory of 876	2524	svchost.exe	83
PID 2524 wrote to memory of 876	2524	svchost.exe	83
PID 2524 wrote to memory of 876	2524	svchost.exe	83
PID 876 wrote to memory of 3308	876	fix_device.exe	85
PID 876 wrote to memory of 3308	876	fix_device.exe	85
PID 876 wrote to memory of 3308	876	fix_device.exe	85
PID 3308 wrote to memory of 3728	3308	._cache_fix_device.exe	86
PID 3308 wrote to memory of 3728	3308	._cache_fix_device.exe	86
PID 3308 wrote to memory of 3728	3308	._cache_fix_device.exe	86
PID 3728 wrote to memory of 4816	3728	svchost.exe	87
PID 3728 wrote to memory of 4816	3728	svchost.exe	87
PID 3728 wrote to memory of 4816	3728	svchost.exe	87
PID 876 wrote to memory of 2948	876	fix_device.exe	88
PID 876 wrote to memory of 2948	876	fix_device.exe	88
PID 876 wrote to memory of 2948	876	fix_device.exe	88
PID 2948 wrote to memory of 3792	2948	Synaptics.exe	89
PID 2948 wrote to memory of 3792	2948	Synaptics.exe	89
PID 2948 wrote to memory of 3792	2948	Synaptics.exe	89
PID 3792 wrote to memory of 4596	3792	._cache_Synaptics.exe	90
PID 3792 wrote to memory of 4596	3792	._cache_Synaptics.exe	90
PID 3792 wrote to memory of 4596	3792	._cache_Synaptics.exe	90
PID 4596 wrote to memory of 2464	4596	svchost.exe	92
PID 4596 wrote to memory of 2464	4596	svchost.exe	92
PID 4596 wrote to memory of 2464	4596	svchost.exe	92

C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\fix_device.exe
"C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\fix_device.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Windows\svchost.exe
  "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\fix_device.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\fix_device.exe
    "C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\fix_device.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:876
  - - C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_fix_device.exe
      "C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_fix_device.exe"
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3308
    - - C:\Windows\svchost.exe
        
        "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_fix_device.exe"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3728
      - C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_fix_device.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_fix_device.exe"
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4816
  - - C:\ProgramData\Synaptics\Synaptics.exe
      "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
      4⤵
      Checks computer location settings
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_Synaptics.exe" InjUpdate
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3792
      - C:\Windows\svchost.exe
        
        "C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_Synaptics.exe" InjUpdate
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4596
        
        C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_Synaptics.exe
        
        "C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_Synaptics.exe" InjUpdate
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2464

C:\Windows\svchost.exe
C:\Windows\svchost.exe
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:784

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

71875E00

Path C:\Users\Admin\AppData\Local\Temp\71875E00
Size 20KB
SHA256 53734dab884d820313ea86c5731ecf9bdfec5c7f20649baf51829c797b2aa25d
MD5 d8969d429ef66a9b9d74c3f0bd6ca651
SHA1 58333025f22c605a841a34f51fb65344ac5aa560
SHA512 6c8d56948c66e4c9a93bd2611ee2d42f153a60645d57529a2c4e4f8ed6b8ef7f6540359786d3cb373bc9a4b9267f2834e2789ae322dab8b29b1fa26e54cc49a2
SSDEEP 384:M1BGR5Vdp+o5bOSV5lU/Or0pl44lWMsOsWIGhIIcM0UBccp:MPS4o5bzJKO7Q3tsjg0UBccp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ps4f3t2T.xlsm

Path C:\Users\Admin\AppData\Local\Temp\Ps4f3t2T.xlsm
Size 17KB
SHA256 8e574b4ae6502230c0829e2319a6c146aebd51b7008bf5bbfb731424d7952c15
MD5 e566fc53051035e1e6fd0ed1823de0f9
SHA1 00bc96c48b98676ecd67e81a6f1d7754e4156044
SHA512 a12f56ff30ea35381c2b8f8af2446cf1daa21ee872e98cad4b863db060acd4c33c5760918c277dadb7a490cb4ca2f925d59c70dc5171e16601a11bc4a6542b04
SSDEEP 384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_Synaptics.exe

Path C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_Synaptics.exe
Size 897KB
SHA256 db9d357b2ec908814f357d54bd0657d22d43d82f5b76de43201f99b68e2bc5b2
MD5 8b07d76ec57ec6318ba2b11184d4660b
SHA1 dd19f8115c74474280e0a111e4aed880589c4a9e
SHA512 25c317f85407274a3aaa4d3b218df9dae672943f95f5166c463105b7aafa1554c65772c71718a9306b34d940055ea1fdfb58f4eecc25a65f2ae1c340eae8c2d9
SSDEEP 12288:Yak7dFemNsqI3etnBHYPpAkApyRV3jRfP4S5LH28U3mcQuKXQoggdnYgafCEZTj:YasdFeWsN3skA4RV1Hom2KXMmHaqEZTj
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_fix_device.exe

Path C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_fix_device.exe
Size 862KB
SHA256 f131ccf12dd54d7cb7e17913d0d13c9f3c5adfb69f978387df328a88cfbf4473
MD5 1f85b6ae7834b3f8c9e4b234c7e6264c
SHA1 159742f5cca121b659bac208609dcac9e34a8a64
SHA512 d8bba178e8f97268c5a2ebb0fdb473c090e9cdaffe83e00bbd0311203e5e7d6eab2ac4b94c2eb6792108d5a67fbc4960f58ebd35098cfa75542e0c15cb65808c
SSDEEP 12288:Yak7dFemNsqI3etnBHYPpAkApyRV3jRfP4S5LH28U3mcQuKXQoggdnYga97dA2C:YasdFeWsN3skA4RV1Hom2KXMmHaRdA5
MD5 SHA1 SHA512 SSDEEP

Submit Download

._cache_fix_device.exe

Path C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\._cache_fix_device.exe
Size 862KB
SHA256 33c85146a06edc2d7bbe77e277e88a27a3ea9109a7bd14025bf30d66937f6a26
MD5 bb6313c9386fec91dee75c4782b43687
SHA1 3793824aa931adefaad27d29e8e17886966e6ba6
SHA512 2c87791c0ecc922c947b4337ea1ff56145e40e8fd5d20352518249d3725e9838d35f8bbd5b13252ec11eb06847abe9ae800cb8988ad486cd83976e09e9e5c0e5
SSDEEP 24576:+AHnh+eWsN3skA4RV1Hom2KXMmHaRdA5:ph+ZkldoPK8YaRc
MD5 SHA1 SHA512 SSDEEP

Submit Download

fix_device.exe

Path C:\Users\Admin\AppData\Local\Temp\fix_device_gameloop\fix_device.exe
Size 1.6MB
SHA256 a86d51a4c4ca79adae8ac8540d8ee7be96b8c0259c61d933ba88657fa6342f74
MD5 1bae18d3be9196a6c913827bc72f5cb5
SHA1 06123ee722eac2184bab0e0236a229d6bd0a935c
SHA512 39fc5f6714b1c29a876aeb34173a39a36920366e28f372f3a4a5fc40d7ef2569002f7e5ca0bcc675f11b6f1c80c0ef1f1a2acff76eb20f99b3257293d099fcc3
SSDEEP 24576:YnsJ39LyjbJkQFMhmC+6GD9masdFeWsN3skA4RV1Hom2KXMmHaqEZT3:YnsHyjtk2MYC5GDy/ZkldoPK8YaqQ3
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\svchost.exe
Size 35KB
SHA256 20af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
MD5 9e3c13b6556d5636b745d3e466d47467
SHA1 2ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA512 5a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b
SSDEEP 768:tkOumaoDu3hAyN95/KTSZsOTb/Kc6H0anc6HEvT66vlm3GWBk5hr2C56r:SmaoDu3BN95/g4byc6H5c6HcT66vlm3j
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/784-218-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/876-13-0x00000000006D0000-0x00000000006D1000-memory.dmp

Download

memory/876-92-0x0000000000400000-0x00000000005A3000-memory.dmp

Download

memory/2280-3-0x0000000000400000-0x00000000004FF000-memory.dmp

Download

memory/2464-217-0x0000000000D90000-0x0000000000E6E000-memory.dmp

Download

memory/2464-160-0x0000000000D90000-0x0000000000E6E000-memory.dmp

Download

memory/2524-10-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/2948-220-0x0000000000400000-0x00000000005A3000-memory.dmp

Download

memory/3308-18-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/3408-168-0x00007FF844410000-0x00007FF844420000-memory.dmp

Download

memory/3408-163-0x00007FF846470000-0x00007FF846480000-memory.dmp

Download

memory/3408-165-0x00007FF846470000-0x00007FF846480000-memory.dmp

Download

memory/3408-166-0x00007FF846470000-0x00007FF846480000-memory.dmp

Download

memory/3408-167-0x00007FF844410000-0x00007FF844420000-memory.dmp

Download

memory/3408-164-0x00007FF846470000-0x00007FF846480000-memory.dmp

Download

memory/3408-162-0x00007FF846470000-0x00007FF846480000-memory.dmp

Download

memory/3728-30-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3792-153-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4596-159-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4816-32-0x0000000000110000-0x00000000001EE000-memory.dmp

Download

memory/4816-219-0x0000000000110000-0x00000000001EE000-memory.dmp

Download

memory/4816-221-0x0000000000110000-0x00000000001EE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads