lumma | 9ef5c1a004ebafc622407137f95bfa6a6bc1f00b1b6b7cc9a7999207c27aa80f

Analysis

max time kernel
76s
max time network
79s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 18:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sоftware for cs2.rar
Size

12.0MB
MD5

cc664a093e4f476da5a8f45418d3acfa
SHA1

9a0f2598cbaaa57209ea09c63563884bb9df2f67
SHA256

9ef5c1a004ebafc622407137f95bfa6a6bc1f00b1b6b7cc9a7999207c27aa80f
SHA512

7114022338a4d5d465c401c9f23c5ea1ab340a77855b86ab70d6f36de98d510cf1dc1d79876e71f76406cf0bfe3cc584b657cafb83c24d65a8d3c03da30cfeca
SSDEEP

196608:TbPdCLU17rpJUdD5sRnivPaW+pQLRZUQdSXrwiWklnTiQ2r60w1symgzbZ5gLJ:YC7rpJUJmhiv1AQL5erwhinTizr60Pyi

Score

10^/10

lumma discovery stealer

Malware Config

Extracted

Family

lumma

https://cloudewahsj.shop/api

https://rabidcowse.shop/api

https://noisycuttej.shop/api

https://tirepublicerj.shop/api

https://framekgirus.shop/api

https://wholersorie.shop/api

https://abruptyopsn.shop/api

https://nearycrepso.shop/api

https://fancywaxxers.shop/api

Extracted

Family

lumma

https://fancywaxxers.shop/api

https://abruptyopsn.shop/api

https://wholersorie.shop/api

https://framekgirus.shop/api

https://tirepublicerj.shop/api

https://noisycuttej.shop/api

https://rabidcowse.shop/api

https://cloudewahsj.shop/api

Signatures

Lumma Stealer, LummaC
Lumma or LummaC is an infostealer written in C++ first seen in August 2022.
stealer lumma
Lumma family
lumma

Executes dropped EXE 24 IoCs

pid	Process
1580	Cheat.exe
4324	Cheat.exe
740	Cheat.exe
1576	Cheat.exe
3372	Cheat.exe
3028	Cheat.exe
8	Cheat.exe
5108	Cheat.exe
1924	Cheat.exe
1536	Cheat.exe
2052	Cheat.exe
3976	Cheat.exe
2440	Cheat.exe
4328	Cheat.exe
1184	Cheat.exe
2700	Cheat.exe
3436	Cheat.exe
5064	Cheat.exe
748	Cheat.exe
772	Cheat.exe
1632	Cheat.exe
1364	Cheat.exe
2268	Cheat.exe
4492	Cheat.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 1580 set thread context of 4324	1580	Cheat.exe	106
PID 740 set thread context of 1576	740	Cheat.exe	114
PID 3372 set thread context of 3028	3372	Cheat.exe	120
PID 8 set thread context of 1924	8	Cheat.exe	127
PID 1536 set thread context of 2052	1536	Cheat.exe	133
PID 3976 set thread context of 2440	3976	Cheat.exe	139
PID 4328 set thread context of 2700	4328	Cheat.exe	146
PID 3436 set thread context of 5064	3436	Cheat.exe	152
PID 748 set thread context of 772	748	Cheat.exe	158
PID 1632 set thread context of 1364	1632	Cheat.exe	164
PID 2268 set thread context of 4492	2268	Cheat.exe	170

Program crash 11 IoCs

pid	pid_target	Process	procid_target
1120	1580	WerFault.exe	102
3636	740	WerFault.exe	112
444	3372	WerFault.exe	118
992	8	WerFault.exe	124
1328	1536	WerFault.exe	131
4696	3976	WerFault.exe	137
4672	4328	WerFault.exe	143
2408	3436	WerFault.exe	150
4700	748	WerFault.exe	156
2764	1632	WerFault.exe	162
2816	2268	WerFault.exe	168

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cheat.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	7zFM.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5012	7zFM.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	5012	7zFM.exe
Token: 35	5012	7zFM.exe
Token: SeSecurityPrivilege	5012	7zFM.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5012	7zFM.exe
5012	7zFM.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 4324	1580	Cheat.exe	106
PID 1580 wrote to memory of 4324	1580	Cheat.exe	106
PID 1580 wrote to memory of 4324	1580	Cheat.exe	106
PID 1580 wrote to memory of 4324	1580	Cheat.exe	106
PID 1580 wrote to memory of 4324	1580	Cheat.exe	106
PID 1580 wrote to memory of 4324	1580	Cheat.exe	106
PID 1580 wrote to memory of 4324	1580	Cheat.exe	106
PID 1580 wrote to memory of 4324	1580	Cheat.exe	106
PID 1580 wrote to memory of 4324	1580	Cheat.exe	106
PID 740 wrote to memory of 1576	740	Cheat.exe	114
PID 740 wrote to memory of 1576	740	Cheat.exe	114
PID 740 wrote to memory of 1576	740	Cheat.exe	114
PID 740 wrote to memory of 1576	740	Cheat.exe	114
PID 740 wrote to memory of 1576	740	Cheat.exe	114
PID 740 wrote to memory of 1576	740	Cheat.exe	114
PID 740 wrote to memory of 1576	740	Cheat.exe	114
PID 740 wrote to memory of 1576	740	Cheat.exe	114
PID 740 wrote to memory of 1576	740	Cheat.exe	114
PID 3372 wrote to memory of 3028	3372	Cheat.exe	120
PID 3372 wrote to memory of 3028	3372	Cheat.exe	120
PID 3372 wrote to memory of 3028	3372	Cheat.exe	120
PID 3372 wrote to memory of 3028	3372	Cheat.exe	120
PID 3372 wrote to memory of 3028	3372	Cheat.exe	120
PID 3372 wrote to memory of 3028	3372	Cheat.exe	120
PID 3372 wrote to memory of 3028	3372	Cheat.exe	120
PID 3372 wrote to memory of 3028	3372	Cheat.exe	120
PID 3372 wrote to memory of 3028	3372	Cheat.exe	120
PID 8 wrote to memory of 5108	8	Cheat.exe	126
PID 8 wrote to memory of 5108	8	Cheat.exe	126
PID 8 wrote to memory of 5108	8	Cheat.exe	126
PID 8 wrote to memory of 1924	8	Cheat.exe	127
PID 8 wrote to memory of 1924	8	Cheat.exe	127
PID 8 wrote to memory of 1924	8	Cheat.exe	127
PID 8 wrote to memory of 1924	8	Cheat.exe	127
PID 8 wrote to memory of 1924	8	Cheat.exe	127
PID 8 wrote to memory of 1924	8	Cheat.exe	127
PID 8 wrote to memory of 1924	8	Cheat.exe	127
PID 8 wrote to memory of 1924	8	Cheat.exe	127
PID 8 wrote to memory of 1924	8	Cheat.exe	127
PID 1536 wrote to memory of 2052	1536	Cheat.exe	133
PID 1536 wrote to memory of 2052	1536	Cheat.exe	133
PID 1536 wrote to memory of 2052	1536	Cheat.exe	133
PID 1536 wrote to memory of 2052	1536	Cheat.exe	133
PID 1536 wrote to memory of 2052	1536	Cheat.exe	133
PID 1536 wrote to memory of 2052	1536	Cheat.exe	133
PID 1536 wrote to memory of 2052	1536	Cheat.exe	133
PID 1536 wrote to memory of 2052	1536	Cheat.exe	133
PID 1536 wrote to memory of 2052	1536	Cheat.exe	133
PID 3976 wrote to memory of 2440	3976	Cheat.exe	139
PID 3976 wrote to memory of 2440	3976	Cheat.exe	139
PID 3976 wrote to memory of 2440	3976	Cheat.exe	139
PID 3976 wrote to memory of 2440	3976	Cheat.exe	139
PID 3976 wrote to memory of 2440	3976	Cheat.exe	139
PID 3976 wrote to memory of 2440	3976	Cheat.exe	139
PID 3976 wrote to memory of 2440	3976	Cheat.exe	139
PID 3976 wrote to memory of 2440	3976	Cheat.exe	139
PID 3976 wrote to memory of 2440	3976	Cheat.exe	139
PID 4328 wrote to memory of 1184	4328	Cheat.exe	145
PID 4328 wrote to memory of 1184	4328	Cheat.exe	145
PID 4328 wrote to memory of 1184	4328	Cheat.exe	145
PID 4328 wrote to memory of 2700	4328	Cheat.exe	146
PID 4328 wrote to memory of 2700	4328	Cheat.exe	146
PID 4328 wrote to memory of 2700	4328	Cheat.exe	146
PID 4328 wrote to memory of 2700	4328	Cheat.exe	146

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\Sоftware for cs2.rar"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:960

C:\Users\Admin\Documents\Software for cs2\Cheat.exe
"C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4324
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1580 -s 796
  2⤵
  - Program crash
  PID:1120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1580 -ip 1580
1⤵
PID:1368

C:\Users\Admin\Documents\Software for cs2\Cheat.exe
"C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1576
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 740 -s 764
  2⤵
  - Program crash
  PID:3636

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 740 -ip 740
1⤵
PID:1184

C:\Users\Admin\Documents\Software for cs2\Cheat.exe
"C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3028
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3372 -s 764
  2⤵
  - Program crash
  PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3372 -ip 3372
1⤵
PID:4208

C:\Users\Admin\Documents\Software for cs2\Cheat.exe
"C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  PID:5108
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 764
  2⤵
  - Program crash
  PID:992

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 8 -ip 8
1⤵
PID:5024

C:\Users\Admin\Documents\Software for cs2\Cheat.exe
"C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2052
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 764
  2⤵
  - Program crash
  PID:1328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1536 -ip 1536
1⤵
PID:4884

C:\Users\Admin\Documents\Software for cs2\Cheat.exe
"C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2440
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3976 -s 764
  2⤵
  - Program crash
  PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 3976 -ip 3976
1⤵
PID:4820

C:\Users\Admin\Documents\Software for cs2\Cheat.exe
"C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  PID:1184
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4328 -s 784
  2⤵
  - Program crash
  PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4328 -ip 4328
1⤵
PID:1540

C:\Users\Admin\Documents\Software for cs2\Cheat.exe
"C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:3436
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5064
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3436 -s 768
  2⤵
  - Program crash
  PID:2408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3436 -ip 3436
1⤵
PID:4924

C:\Users\Admin\Documents\Software for cs2\Cheat.exe
"C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:748
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 748 -s 764
  2⤵
  - Program crash
  PID:4700

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 748 -ip 748
1⤵
PID:2856

C:\Users\Admin\Documents\Software for cs2\Cheat.exe
"C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:1632
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1364
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 160
  2⤵
  - Program crash
  PID:2764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1632 -ip 1632
1⤵
PID:5008

C:\Users\Admin\Documents\Software for cs2\Cheat.exe
"C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2268
- C:\Users\Admin\Documents\Software for cs2\Cheat.exe
  "C:\Users\Admin\Documents\Software for cs2\Cheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4492
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2268 -s 772
  2⤵
  - Program crash
  PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2268 -ip 2268
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\Documents\Software for cs2\Cheat.exe

Filesize
334KB

MD5
878e1c307e9966e5c392fd8ccf2abd95

SHA1
b6a3286245e1ad0567d6851e88fbdf7b470dcaa3

SHA256
80345b1f5d45fb8084f6e93a6bfca443f93d2aee6327da9faeed6afbeb18c97e

SHA512
3d5f37eeca8f1d11a425232ae85d4e4f172e51a2305f0588b134538108a9ab5dc6d077287d364382318efc2ba41caccaa7b2f2c06e896051a05a26133b38e483

Download Submit
memory/1580-734-0x0000000074B5E000-0x0000000074B5F000-memory.dmp

Filesize
4KB

Download
memory/1580-735-0x0000000000580000-0x00000000005DC000-memory.dmp

Filesize
368KB

Download
memory/1580-736-0x0000000005480000-0x0000000005A24000-memory.dmp

Filesize
5.6MB

Download
memory/1580-742-0x0000000074B50000-0x0000000075300000-memory.dmp

Filesize
7.7MB

Download
memory/4324-741-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4324-738-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download
memory/4324-743-0x0000000000400000-0x000000000045A000-memory.dmp

Filesize
360KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads