mydoom | 3a57efd18e4a2057bbe41e1935d068cd4f729e1d5fb81c3dbb575015857e6c78

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/01/2025, 13:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe
Size

28KB
MD5

79dc4011f08861bc0205b223d1a20013
SHA1

938d6d3fc4b27228e567e59b6f7e7b5bd9712f8d
SHA256

3a57efd18e4a2057bbe41e1935d068cd4f729e1d5fb81c3dbb575015857e6c78
SHA512

2c147ea126094936bcffc7826cbae50739e52752cd8017c946d28d4459b00dd2640a33edd6aa12d139ac0fc8d7d260cad9a8da3fe65d465e2f852804cbbd41b3
SSDEEP

384:1vxBbK26lj5Id8SpHx9jLhsznnVxA1WmP5w7GGCJlqqwMyNkae:Dv8IRRdsxq1DjJcqfvz

Score

10^/10

mydoom discovery persistence upx worm

Malware Config

Signatures

Detects MyDoom family 7 IoCs

resource	yara_rule
behavioral1/memory/2404-17-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/2404-42-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/2404-65-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/2404-70-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/2404-72-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/2404-82-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom
behavioral1/memory/2404-103-0x0000000000500000-0x0000000000510000-memory.dmp	family_mydoom

MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom
Mydoom family
mydoom

Executes dropped EXE 1 IoCs

pid	Process
1912	services.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 27 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2404-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2404-4-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0007000000016cd7-7.dat	upx
behavioral1/memory/1912-11-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2404-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1912-20-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1912-21-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1912-26-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1912-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1912-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1912-38-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2404-42-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1912-43-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1912-45-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/files/0x0005000000004ed7-55.dat	upx
behavioral1/memory/2404-65-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1912-66-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2404-70-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1912-71-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2404-72-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1912-73-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1912-78-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2404-82-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1912-83-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/1912-85-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral1/memory/2404-103-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1912-104-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\services.exe	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe
File opened for modification	C:\Windows\java.exe	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe
File created	C:\Windows\java.exe	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 1912	2404	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe	31
PID 2404 wrote to memory of 1912	2404	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe	31
PID 2404 wrote to memory of 1912	2404	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe	31
PID 2404 wrote to memory of 1912	2404	JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_79dc4011f08861bc0205b223d1a20013.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f88e117d94654a4da047998caa85a520

SHA1
31cb57a3972ce6e3a5b0d86c0714acf4f0999bb5

SHA256
8961737d4d611fd66be48da2e8b64b8ea9ecf53f28a13e182314bb1093b440d4

SHA512
39b4218006ae2271a90436fb71baded2235e7267f5bfa4a41650aeb5bc64125842d5cfd665eef97ce15a493830a489da86d28291ca2a1dbff633d92abea8b18e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
81361dbf0aea6d2f9179622d9272d896

SHA1
7856e15bf14fbeeb87de94422884743927d1291d

SHA256
8a5d025c018ac66c553c285abf58fb08b4bfa1c7c8f02615c0c9d5581876ea54

SHA512
fa3308a0c741e07286bf303174d625cdf27d0c91194d2d435b4f878b0a0c412884dab6f80745a3aba8c990637d8ca8101ac282e75615c3c0d8cd5cb7335b188f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
504239d1d6ee1cbc2733f0033f968424

SHA1
b6efdd436b68660cb316e75e23910316175eb154

SHA256
24d74e67caf7a1faa49c779b87d41b7f4a3bfcc4318605eae15654bc8b396aef

SHA512
d9f7028c216bf9acac0aafa3cd8e5e2d0229b85e8467b23175fdd604137a511d97d2192a21acf424e5f01860e8ffe4437a5d1d0e6f04e18a1d846397270e76d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UQFHO95Z\search[2].htm

Filesize
25B

MD5
8ba61a16b71609a08bfa35bc213fce49

SHA1
8374dddcc6b2ede14b0ea00a5870a11b57ced33f

SHA256
6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1

SHA512
5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab5B5.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar654.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpF910.tmp

Filesize
28KB

MD5
49a7a989df9c337b83dc3d2f5302fad1

SHA1
4ec013e5964317287f6f380af3d6e7e9430089c0

SHA256
d69ec823e6565cffa2ed0cda19c58d282b36e0688f4f90329ed4df3c878e2419

SHA512
3dd483111a309a3ffbf2c0f50f5e58850270c7d0e67886f1cc73678a09986e281bccd92ee10d9ac5409c1ac78b503d9d4cf90601702f0e40a40d8b41743b8f9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
c5395efdc31007764fa5ff4549dc3e10

SHA1
886ed14269eb522b4b6ddc5bc2acc339bfe54136

SHA256
d7b8fc39ece1e130dda81e6c273147abef70fbf50f602fc15cfe9cb926f5f3fb

SHA512
aea60a5e4d7fe30e4b3e7682666091ccad11daaad8ff36dd68cc6751d2e8c49baa1e696afc66f751ebbdb088da403c3aec5c54bf18dbe0a31be2b61554d460f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\zincite.log

Filesize
1KB

MD5
57ee1fc87aad39af5bddb1e29a7ef0da

SHA1
79ca9b0decfcc41737e9e379c1f86506cfe5f3eb

SHA256
f2cf68828f2372fef718d167e37512a31cb0efba59ed6b683f0293fae18e7701

SHA512
8d4d89f802a48a471d8cf3f70cf091238ac47bbf2c2ec65f0e24fc4ee91056ce6f321c91a0a6eb46e58527fe5f55ed10a0dc15b123504193b1211d72b3e5333c

Download Submit
C:\Windows\services.exe

Filesize
8KB

MD5
b0fe74719b1b647e2056641931907f4a

SHA1
e858c206d2d1542a79936cb00d85da853bfc95e2

SHA256
bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c

SHA512
9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2

Download Submit
memory/1912-21-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-73-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-38-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-11-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-43-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-45-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-31-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-26-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-66-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-104-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-71-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-85-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-33-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-78-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/1912-83-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2404-82-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2404-72-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2404-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2404-103-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2404-70-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2404-65-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2404-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2404-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2404-9-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2404-42-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2404-4-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads