trigona | d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
12/02/2025, 06:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
Size

1.1MB
MD5

1852be15aa8dcf664291b3849bd348e4
SHA1

eea811d2a304101cc0b0edebe6590ea0f3da0a27
SHA256

d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a
SHA512

91ca1d44fa98a43dbc53541cecb8ca656df01d6dc57783f12c70df49347520e150796834731b56107976b5b9dc915006d18caf39ac6792187d605542452bd4eb
SSDEEP

24576:hY6frxBDmkY+Jr0Iql2v4sx+uxtTyJuqe:bKuTvBwSdCud

Score

10^/10

trigona discovery persistence ransomware

Malware Config

Signatures

Detects Trigona ransomware 14 IoCs

resource	yara_rule
behavioral1/memory/2628-0-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-1-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-2-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-5-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-6-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-7-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-14-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-316-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-810-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-6719-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-11568-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-11666-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-11760-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona
behavioral1/memory/2628-14104-0x0000000000400000-0x0000000000526000-memory.dmp	family_trigona

Trigona
A ransomware first seen at the beginning of the 2022.
ransomware trigona
Trigona family
trigona

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\15C6F14BFBA70BB9E1786EA3064C9DB2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe"	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe

Drops desktop.ini file(s) 13 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Chess\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Solitaire\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\FreeCell\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Hearts\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Mahjong\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Microsoft Games\Purble Place\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\desktop.ini	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\d3d9\libdirect3d9_filters_plugin.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00726_.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199755.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Auckland	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler.jar	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jre7\bin\instrument.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\clock.js	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0290548.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\7-Zip\License.txt	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+1	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\VideoLAN\VLC\locale\ps\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00732_.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\it-IT\WMM2CLIP.dll.mui	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Rarotonga	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\JMC.profile\.lock	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Windows Photo Viewer\en-US\PhotoAcq.dll.mui	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341738.JPG	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Omsk	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18184_.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsScenesBackground_PAL.wmv	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\settings.css	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200163.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\THMBNAIL.PNG	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\System\msadc\de-DE\msaddsr.dll.mui	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00932_.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\lua\modules\simplexml.luac	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\VideoLAN\VLC\plugins\audio_mixer\libinteger_mixer_plugin.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00049_.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.runtime_0.10.0.v201209301036.jar	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\css\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00419_.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0158071.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\security\java.security	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\UIAutomationClientsideProviders.dll	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\ResolveUninstall.mpv2	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Windows Media Player\setup_wm.exe	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\20.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00524_.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\ta.txt	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\ink\de-DE\IpsMigrationPlugin.dll.mui	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-2	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107316.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0285780.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Java\jdk1.7.0_80\include\win32\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\PYCC.pf	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-uihandler_zh_CN.jar	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0239967.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01357_.WMF	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File created	\??\c:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\how_to_decrypt.hta	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
File opened for modification	\??\c:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_zh_4.4.0.v20140623020002.jar	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe

C:\Users\Admin\AppData\Local\Temp\d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe
"C:\Users\Admin\AppData\Local\Temp\d743daa22fdf4313a10da027b034c603eda255be037cb45b28faea23114d3b8a.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2628

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1163522206-1469769407-485553996-1000\desktop.ini

Filesize
2KB

MD5
9e0ba776cdf99a60c2cdbe5561c43afa

SHA1
7b3dfb67f2341610651daeffc2cc3bbf13e59b5f

SHA256
162b1045f22818eedcc1be6f795015b0755a6d23d87b4273b5037e83840320e9

SHA512
a2aa54649aaf8aa65130bdd4a2c2b0ae2070d2af929ed76479eda56222d89605dacef9d9188284fe55cbdf622ff405ac22ad36713c44d749dc38b00d3801a978

Download Submit
C:\how_to_decrypt.hta

Filesize
11KB

MD5
33d96f8733cd0891b1e2b647bcf8669e

SHA1
0d00018b6d682c54bb16ee9fb1f2caa6c6734ba2

SHA256
41b8caf39cb14d33c3048b4898b58c808d3fd1d473f010eedd146c581717ff54

SHA512
8b493ce34b7862a4235d8a6bea2606a1cc00c872059f7cf3d080f7664545f7440e22b27de34b0e84b8ec63813cab22fe40a6029d54b6e9a68b8a0311dfd5e150

Download Submit
memory/2628-6-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-316-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-0-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-7-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-14-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-2-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-1-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-5-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-810-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-6719-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-11568-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-11666-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-11760-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download
memory/2628-14104-0x0000000000400000-0x0000000000526000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads