banload | 46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9a

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/01/2025, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Size

3.0MB
MD5

a9319755c7ba195c900d2338c3f724b0
SHA1

c7fe88f37443d014fcfc7c350f62cbb847d87ae0
SHA256

46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9a
SHA512

e59b3c2a2a616398586b221492cb3ab9a0d429f222cebce30b090f05ecd3df06d6c209eef3276797806df4e5afc8beee44c3b57d9894b8c525d92b736a7d1be0
SSDEEP

49152:RVvn8Q5CHCtE4jPTTm4uBLq9gtMyMpy7nEvV47RIgoqE:RF8QUitE4iLqaPWGnEvK7R6

Score

10^/10

banload discovery downloader dropper evasion ransomware trojan

Malware Config

Signatures

Banload
Banload variants download malicious files, then install and execute the files.
trojan dropper downloader banload
Banload family
banload

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe

Renames multiple (564) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.SecureString.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\7-Zip\Lang\sr-spc.txt.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.he-il.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\micaut.dll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.VisualBasic.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Concurrent.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mip.exe.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\7-Zip\Lang\ug.txt.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-locale-l1-1-0.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\ucrtbase.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.zh-cn.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Linq.Parallel.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVIsvApi.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-crt-runtime-l1-1-0.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\7-Zip\Lang\si.txt.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.Contracts.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\dotnet.exe.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.InteropServices.RuntimeInformation.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.de-de.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tabskb.dll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\api-ms-win-core-synch-l1-2-0.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pl-pl.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\sqloledb.rll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Dynamic.Runtime.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\System\ado\msado28.tlb.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\tipresx.dll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\mshwjpn.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Buffers.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Globalization.Calendars.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Private.Xml.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-math-l1-1-0.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad.xml.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOMessageProvider.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.IO.IsolatedStorage.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XPath.XDocument.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\Content.xml.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\tipresx.dll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Xml.XDocument.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Buffers.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\System\wab32.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\uk-UA\TabTip.exe.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\msdasqlr.dll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.StackTrace.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.Mail.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\clretwrc.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\7-Zip\7z.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.kk-kz.dll.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui.tmp	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ = "Constructor for Scriptlet Behavior Handler"	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Implemented Categories	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ThreadingModel = "Apartment"	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\InprocServer32\ = "C:\\Windows\\SysWOW64\\scrobj.dll"	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ADD62E2-4A23-86F4-8704-0C62BF6886E2}\ProgID\ = "ScriptletHandler.Behavior"	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3972	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
Token: SeIncBasePriorityPrivilege	3972	46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe

C:\Users\Admin\AppData\Local\Temp\46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe
"C:\Users\Admin\AppData\Local\Temp\46804581330e01afc25cffb6abe156110270b660d10d1f6a5bf1bfdd3d4b6d9aN.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1045960512-3948844814-3059691613-1000\desktop.ini.tmp

Filesize
3.1MB

MD5
8887d0f3035cbbf61e83c02982fac16c

SHA1
7098c79d6bcb46a16c8f83d88385f7b3f59f1f38

SHA256
33d9734e208b5fd1e5eb92c8c63398a8fe152bfa2f576dcd9af8bfde13cd5e08

SHA512
8a5a834872939e2ab1bb504fe108877ac02863fbb2c852f1583fba5e0cfbc3552e2cf48cc2a9a38f7c29a7f7641549b8fcf882af2dbb1c11c82130852941d0e8

Download Submit
C:\Program Files\7-Zip\7-zip.dll.tmp

Filesize
3.2MB

MD5
aa674cecf1abbc89e6c348247ac4d896

SHA1
2b3b6e14aa7e33998c0d6c1447eadd2cbcb389ad

SHA256
e7222509b8ed9e0e7aed7112a4984cbd3acb80e606fbf8efe7d1dae0eb9e75c9

SHA512
f91e893c5a87858e9d113a7d3a9789629cef52bef5d49d57e7ca1231596f47551eb850ac64a17b56fbf752732f9867371295bde1794f3e030b5010957b25835d

Download Submit
memory/3972-0-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/3972-2-0x0000000004950000-0x0000000004B5C000-memory.dmp

Filesize
2.0MB

Download
memory/3972-9-0x0000000004950000-0x0000000004B5C000-memory.dmp

Filesize
2.0MB

Download
memory/3972-12-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/3972-13-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/3972-14-0x0000000004950000-0x0000000004B5C000-memory.dmp

Filesize
2.0MB

Download
memory/3972-46-0x0000000004950000-0x0000000004B5C000-memory.dmp

Filesize
2.0MB

Download
memory/3972-47-0x0000000004950000-0x0000000004B5C000-memory.dmp

Filesize
2.0MB

Download
memory/3972-134-0x0000000000400000-0x0000000000616000-memory.dmp

Filesize
2.1MB

Download
memory/3972-154-0x0000000004950000-0x0000000004B5C000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads