48aff6b64510ad7044079f1d7b203f987e557dc6cc389e306e5d78e576b7493b

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_5f156472e4ef83e5ecba7e40ce1b9ff6_elex_wannacry.exe
Size 84KB
Sample260415-sjsr4abs2k
SHA256 48aff6b64510ad7044079f1d7b203f987e557dc6cc389e306e5d78e576b7493b
MD5 5f156472e4ef83e5ecba7e40ce1b9ff6
SHA1 3f7cb3815efce4ffc1255393fe428bf6f8b56186
SHA512 43d3d9e99dcdbf675c2c645effd85adeabd30dbc80259359ed54dffdad2f9a374404225cc54825040bb89bdcb4adbe641584f2a8ee21ba33d62c0af12a8224a7
SSDEEP 384:6jibD2liXsafEHsc4gsFW6e/hHjNN4/ClsrGz:6jif24cafxisFW7/hHjNN4/QQ
TLSH
T1C8831A436BAA9CF2F3912171086D9E79A77FC9D5911DFE9FAB80DD044063581F82A20A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 8 IoCs

pid	Process
460	y1BB37702d8742f4c4ecB9A7hF4DADB948B12e.exe
5092	yD404C82FdF50Ef49eccA868h34106847969Ce.exe
4872	yCF136AFAdF204f47accB0B9hE09B94B75B72e.exe
3736	y79541B2DdC3B8f4aa3cB8F5h5B1943E0ADF2e.exe
3288	y26631655d8F17f4f04cB2CDh3D1852ACD600e.exe
4536	y3275A627dC762f4daccB7B3h7F6487020BB9e.exe
6088	y627861DEdFCD5f4194cAE85hF6316117EB10e.exe
2820	y0F62E2ECdFFCFf499fcA406hD2C1F0A28FF7e.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\yCF136AFAdF204f47accB0B9hE09B94B75B72e.exe	yD404C82FdF50Ef49eccA868h34106847969Ce.exe
File created	C:\Windows\y79541B2DdC3B8f4aa3cB8F5h5B1943E0ADF2e.exe	yCF136AFAdF204f47accB0B9hE09B94B75B72e.exe
File created	C:\Windows\y26631655d8F17f4f04cB2CDh3D1852ACD600e.exe	y79541B2DdC3B8f4aa3cB8F5h5B1943E0ADF2e.exe
File created	C:\Windows\y3275A627dC762f4daccB7B3h7F6487020BB9e.exe	y26631655d8F17f4f04cB2CDh3D1852ACD600e.exe
File created	C:\Windows\y627861DEdFCD5f4194cAE85hF6316117EB10e.exe	y3275A627dC762f4daccB7B3h7F6487020BB9e.exe
File created	C:\Windows\y0F62E2ECdFFCFf499fcA406hD2C1F0A28FF7e.exe	y627861DEdFCD5f4194cAE85hF6316117EB10e.exe
File created	C:\Windows\y1BB37702d8742f4c4ecB9A7hF4DADB948B12e.exe	2026-04-15_5f156472e4ef83e5ecba7e40ce1b9ff6_elex_wannacry.exe
File created	C:\Windows\yD404C82FdF50Ef49eccA868h34106847969Ce.exe	y1BB37702d8742f4c4ecB9A7hF4DADB948B12e.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y3275A627dC762f4daccB7B3h7F6487020BB9e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y0F62E2ECdFFCFf499fcA406hD2C1F0A28FF7e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_5f156472e4ef83e5ecba7e40ce1b9ff6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y26631655d8F17f4f04cB2CDh3D1852ACD600e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y627861DEdFCD5f4194cAE85hF6316117EB10e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y1BB37702d8742f4c4ecB9A7hF4DADB948B12e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	y79541B2DdC3B8f4aa3cB8F5h5B1943E0ADF2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yD404C82FdF50Ef49eccA868h34106847969Ce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yCF136AFAdF204f47accB0B9hE09B94B75B72e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3316	2026-04-15_5f156472e4ef83e5ecba7e40ce1b9ff6_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	460	y1BB37702d8742f4c4ecB9A7hF4DADB948B12e.exe
Token: SeIncBasePriorityPrivilege	5092	yD404C82FdF50Ef49eccA868h34106847969Ce.exe
Token: SeIncBasePriorityPrivilege	4872	yCF136AFAdF204f47accB0B9hE09B94B75B72e.exe
Token: SeIncBasePriorityPrivilege	3736	y79541B2DdC3B8f4aa3cB8F5h5B1943E0ADF2e.exe
Token: SeIncBasePriorityPrivilege	3288	y26631655d8F17f4f04cB2CDh3D1852ACD600e.exe
Token: SeIncBasePriorityPrivilege	4536	y3275A627dC762f4daccB7B3h7F6487020BB9e.exe
Token: SeIncBasePriorityPrivilege	6088	y627861DEdFCD5f4194cAE85hF6316117EB10e.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3316 wrote to memory of 460	3316	2026-04-15_5f156472e4ef83e5ecba7e40ce1b9ff6_elex_wannacry.exe	80
PID 3316 wrote to memory of 5084	3316	2026-04-15_5f156472e4ef83e5ecba7e40ce1b9ff6_elex_wannacry.exe	81
PID 460 wrote to memory of 5092	460	y1BB37702d8742f4c4ecB9A7hF4DADB948B12e.exe	82
PID 460 wrote to memory of 4904	460	y1BB37702d8742f4c4ecB9A7hF4DADB948B12e.exe	83
PID 5092 wrote to memory of 4872	5092	yD404C82FdF50Ef49eccA868h34106847969Ce.exe	84
PID 5092 wrote to memory of 5064	5092	yD404C82FdF50Ef49eccA868h34106847969Ce.exe	85
PID 4872 wrote to memory of 3736	4872	yCF136AFAdF204f47accB0B9hE09B94B75B72e.exe	86
PID 4872 wrote to memory of 2336	4872	yCF136AFAdF204f47accB0B9hE09B94B75B72e.exe	87
PID 3736 wrote to memory of 3288	3736	y79541B2DdC3B8f4aa3cB8F5h5B1943E0ADF2e.exe	88
PID 3736 wrote to memory of 3408	3736	y79541B2DdC3B8f4aa3cB8F5h5B1943E0ADF2e.exe	89
PID 3288 wrote to memory of 4536	3288	y26631655d8F17f4f04cB2CDh3D1852ACD600e.exe	90
PID 3288 wrote to memory of 488	3288	y26631655d8F17f4f04cB2CDh3D1852ACD600e.exe	91
PID 4536 wrote to memory of 6088	4536	y3275A627dC762f4daccB7B3h7F6487020BB9e.exe	92
PID 4536 wrote to memory of 3644	4536	y3275A627dC762f4daccB7B3h7F6487020BB9e.exe	93
PID 6088 wrote to memory of 2820	6088	y627861DEdFCD5f4194cAE85hF6316117EB10e.exe	94
PID 6088 wrote to memory of 8	6088	y627861DEdFCD5f4194cAE85hF6316117EB10e.exe	95

C:\Users\Admin\AppData\Local\Temp\2026-04-15_5f156472e4ef83e5ecba7e40ce1b9ff6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_5f156472e4ef83e5ecba7e40ce1b9ff6_elex_wannacry.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3316
- C:\Windows\y1BB37702d8742f4c4ecB9A7hF4DADB948B12e.exe
  C:\Windows\y1BB37702d8742f4c4ecB9A7hF4DADB948B12e.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:460
- - C:\Windows\yD404C82FdF50Ef49eccA868h34106847969Ce.exe
    C:\Windows\yD404C82FdF50Ef49eccA868h34106847969Ce.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\yCF136AFAdF204f47accB0B9hE09B94B75B72e.exe
      C:\Windows\yCF136AFAdF204f47accB0B9hE09B94B75B72e.exe
      4⤵
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4872
    - - C:\Windows\y79541B2DdC3B8f4aa3cB8F5h5B1943E0ADF2e.exe
        
        C:\Windows\y79541B2DdC3B8f4aa3cB8F5h5B1943E0ADF2e.exe
        5⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3736
      - C:\Windows\y26631655d8F17f4f04cB2CDh3D1852ACD600e.exe
        
        C:\Windows\y26631655d8F17f4f04cB2CDh3D1852ACD600e.exe
        6⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3288
        
        C:\Windows\y3275A627dC762f4daccB7B3h7F6487020BB9e.exe
        
        C:\Windows\y3275A627dC762f4daccB7B3h7F6487020BB9e.exe
        7⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4536
        
        C:\Windows\y627861DEdFCD5f4194cAE85hF6316117EB10e.exe
        
        C:\Windows\y627861DEdFCD5f4194cAE85hF6316117EB10e.exe
        8⤵
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:6088
        
        C:\Windows\y0F62E2ECdFFCFf499fcA406hD2C1F0A28FF7e.exe
        
        C:\Windows\y0F62E2ECdFFCFf499fcA406hD2C1F0A28FF7e.exe
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\Y62786~1.EXE > nul
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\Y3275A~1.EXE > nul
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3644
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\Y26631~1.EXE > nul
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:488
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\Y79541~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\YCF136~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2336
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\YD404C~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:5064
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\Y1BB37~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

y0F62E2ECdFFCFf499fcA406hD2C1F0A28FF7e.exe

Path C:\Windows\y0F62E2ECdFFCFf499fcA406hD2C1F0A28FF7e.exe
Size 84KB
SHA256 a0073af0d1d81cc93b26df2a36384143df55022e6884eb8df7c7209b54aa411d
MD5 cdaec7315a217109cbef6019d0a4cf61
SHA1 585ec59dff871ef436af9f9c491fb36b0196bd1f
SHA512 fb226a633516a86011c73b0b4f55ecc15a6938db9d6035b71977959de8fa82763bd56da52ce6306e6947a88b351b4df7dbeb0ac32b4c4a195c4311712015f0bb
SSDEEP 384:6jibD2liXsafEHsc4gsFW6e/hHjNG4/ClsrGz:6jif24cafxisFW7/hHjNG4/QQ
TLSH
T1508319436BAE9CF2F3912171186D9E79A77BC9D5901DFE9FAB80DD044063581F82A20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y1BB37702d8742f4c4ecB9A7hF4DADB948B12e.exe

Path C:\Windows\y1BB37702d8742f4c4ecB9A7hF4DADB948B12e.exe
Size 84KB
SHA256 bef31c3531518ddb4bfdc9bda1dc570d1e20e357d1349c7e04a04358388d6585
MD5 508abb1eda44676f6047cd89563485a4
SHA1 dec0de6729b29b0d27f5bdd5a3d2158239047703
SHA512 0030bcb5ba51e0904fb67ecd636ad807742ab37e05f1d84db3cdb1c001318884cb25894f419f0681166f6705890f60da28604b4e1966815d5e75d9133a6a05cf
SSDEEP 384:6jibD2liXsafEHsc4gsFW6e/hHjNyh4/ClsrGz:6jif24cafxisFW7/hHjNyh4/QQ
TLSH
T19A831A436F9A9CF2F3912271086D9E79A77FC9D5901DFE9FAB80DD044067581F82A207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y26631655d8F17f4f04cB2CDh3D1852ACD600e.exe

Path C:\Windows\y26631655d8F17f4f04cB2CDh3D1852ACD600e.exe
Size 84KB
SHA256 e2b4efb594b93fa4a2845ba881f80847b0e5443aa6bdc1f3eb00ab420f47151d
MD5 e15526c895a94ea9a79ccaf93ce850cf
SHA1 3480cc220bd5bb7e752d2338becc592cf6bf8bad
SHA512 1c40cbb6cfdf2d0730425e3d09297a2bc92a6f1891d0ad0ef4253d5d81512de54bc8e1bbcd62f0d3c847ea8d8fe289c99660001804086bc1159928d8b2ea96bc
SSDEEP 384:6jibD2liXsafEHsc4gsFW6e/hHjNV4/ClsrGz:6jif24cafxisFW7/hHjNV4/QQ
TLSH
T1EE830A436B9E9CF2F3912171086D9E79A77FC9D5901DFE9FAB80DD044067581F82A207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y3275A627dC762f4daccB7B3h7F6487020BB9e.exe

Path C:\Windows\y3275A627dC762f4daccB7B3h7F6487020BB9e.exe
Size 84KB
SHA256 c384542e21daf76627dd5a10d0904df20edc7082f930f41616627a469f049f52
MD5 66329e91fbe3e7a0cd7939f2b6cdadba
SHA1 74bf12d8f4e6655b20364b6ddced08a2eaef1072
SHA512 d4618859519b2d198479d902ff825feeae08ce9f9856e98f39b6dce358d3bae85c9ffb9ca23a2fc5ede6846ed34d6691627833d6b27f341cd193a6c9094d3cb0
SSDEEP 384:6jibD2liXsafEHsc4gsFW6e/hHjNx4/ClsrGz:6jif24cafxisFW7/hHjNx4/QQ
TLSH
T15D831A436B9E9CF2F3912171086D9E79A77FC9D5911DFE9FAB80DD044063581F82A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y627861DEdFCD5f4194cAE85hF6316117EB10e.exe

Path C:\Windows\y627861DEdFCD5f4194cAE85hF6316117EB10e.exe
Size 84KB
SHA256 f3a49f3c6c01c264171fef62ccae722e470bc50276aab0ae8ab5ecb3f9b169bc
MD5 05bec95f27c97289c7614d9dc0c7e4db
SHA1 75b2fc9183c0e4ce775e02fec6da56dce154b451
SHA512 91c53b523f6d8b3751ca0927c6e11b7e876fc3db361b7227e0afde0cd67bcf522fc85e4d1bc58c5957a515620f82f10e5ae64f76dd4ea9b53cebd163f3e6b916
SSDEEP 384:6jibD2liXsafEHsc4gsFW6e/hHjN84/ClsrGz:6jif24cafxisFW7/hHjN84/QQ
TLSH
T1A68319436FAA9CF2F3912171086D9EB5A77BC9D5911DFE9FAB80DD044063581F82A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

y79541B2DdC3B8f4aa3cB8F5h5B1943E0ADF2e.exe

Path C:\Windows\y79541B2DdC3B8f4aa3cB8F5h5B1943E0ADF2e.exe
Size 84KB
SHA256 b1fcdedec73e1ca06d63a33db18827ac872ad9df0a7d67b818263297d0cf2373
MD5 799ad60bac0c1382da58b77e36f42822
SHA1 e1a28804b8643185aebe66f55c6c57bd576c1fba
SHA512 9aee732d1456c35cb16ce44bea8b7fde403c8e05492fac65c4030562dd1a884681e820f0b90267d3e8374ef48d85288784ec15c9b9ba21231987a83bc4591213
SSDEEP 384:6jibD2liXsafEHsc4gsFW6e/hHjN34/ClsrGz:6jif24cafxisFW7/hHjN34/QQ
TLSH
T17C831A436BAE9CF2F3912271086D9E75A77FC9D5901DFE9FAB80DD044067581F82A20B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yCF136AFAdF204f47accB0B9hE09B94B75B72e.exe

Path C:\Windows\yCF136AFAdF204f47accB0B9hE09B94B75B72e.exe
Size 84KB
SHA256 fc836ec69fc1b3db0aebdba1175879ce323bc833602842ed04ed94ed0919e82d
MD5 ab787b79cc084db0326ae24351db0572
SHA1 806d3b6f30f8747d37a5401089898135334cab1e
SHA512 3458102fb3b10621b41c955cbc700fc0a70d973fd20bb3995c77c3502c7556b240ee9c8fc6fbb5d841ed0df949293ade88b80ac9a31300731782d312f4679971
SSDEEP 384:6jibD2liXsafEHsc4gsFW6e/hHjNE4/ClsrGz:6jif24cafxisFW7/hHjNE4/QQ
TLSH
T16B8309436B9E9CF2F3912271086D9E79A77FC9D5901DFE9FAB80D9044067581F82A207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yD404C82FdF50Ef49eccA868h34106847969Ce.exe

Path C:\Windows\yD404C82FdF50Ef49eccA868h34106847969Ce.exe
Size 84KB
SHA256 49571b115f9ee3daab937ffde4ce18cc1214a5b459c7dae60d4d3d248f94ad0f
MD5 4644d467bbfd68d8c41e70b214aff519
SHA1 96e5ed0b89735905f699f0979035d2a702a0df09
SHA512 a106a60e5e6080aee923d9ead7156efaea2b7e6fc4e77953ec516808ef08b71672f125e02fdb37fb4851a6068b0000a8c0ac3786b2da19f0408a16dc14948c31
SSDEEP 384:6jibD2liXsafEHsc4gsFW6e/hHjNFM4/ClsrGz:6jif24cafxisFW7/hHjNm4/QQ
TLSH
T1A08319436BAE9CF2F3912271086D9E75A77FC9D5901DFE9FAB80DD044067581F82A20A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/460-10-0x00000000021F0000-0x00000000022CA000-memory.dmp

Download

memory/460-6-0x00000000021F0000-0x00000000022CA000-memory.dmp

Download

memory/2820-48-0x0000000002210000-0x00000000022EA000-memory.dmp

Download

memory/3288-34-0x0000000003CD0000-0x0000000003DAA000-memory.dmp

Download

memory/3288-30-0x0000000003CD0000-0x0000000003DAA000-memory.dmp

Download

memory/3316-0-0x0000000003C00000-0x0000000003CDA000-memory.dmp

Download

memory/3316-5-0x0000000003C00000-0x0000000003CDA000-memory.dmp

Download

memory/3736-24-0x00000000021F0000-0x00000000022CA000-memory.dmp

Download

memory/3736-28-0x00000000021F0000-0x00000000022CA000-memory.dmp

Download

memory/4536-36-0x0000000002240000-0x000000000231A000-memory.dmp

Download

memory/4536-40-0x0000000002240000-0x000000000231A000-memory.dmp

Download

memory/4872-22-0x0000000003CE0000-0x0000000003DBA000-memory.dmp

Download

memory/4872-18-0x0000000003CE0000-0x0000000003DBA000-memory.dmp

Download

memory/5092-16-0x0000000003BF0000-0x0000000003CCA000-memory.dmp

Download

memory/5092-12-0x0000000003BF0000-0x0000000003CCA000-memory.dmp

Download

memory/6088-42-0x0000000003BF0000-0x0000000003CCA000-memory.dmp

Download

memory/6088-46-0x0000000003BF0000-0x0000000003CCA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads