d0b5b5b6b6a9c1b5743a73c30b02d98080e87c03fc3d6a58373aa5f55a9eba49

Analysis

user interaction
yes
max time kernel
29s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kristonium.exe
Size 231KB
Sample260416-stlrjafz21
SHA256 d0b5b5b6b6a9c1b5743a73c30b02d98080e87c03fc3d6a58373aa5f55a9eba49
MD5 515c95f749b333836cc295097a010f77
SHA1 e1c5cac8c951e9df6ad5214a0079a0d1fcb3fe39
SHA512 9f2efbf991cef649edd3d64a59cafa0f3e91216725693147ddb2f3daab77fe34772f1a1c71ebb18b43d5801724353a932de254ffeaf522c158b524eb7bdabb20
SSDEEP 3072:eVxO0llDQ4psyidxHZFPYRzv3BNIu8uwZBcifH8Wpy9z:eVxOQljidxHZFPYRzv3BNJVwfcm8t
TLSH
T107348E18F3C0D485DCA22D384DA0DA79123B7D6C2B0B924B36E4BE1FBF756526C5C25A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

bootkit defense_evasion discovery persistence

Malware Config

Signatures

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Kristonium.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kristonium.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
1052	taskkill.exe
4800	taskkill.exe
3568	taskkill.exe
4272	taskkill.exe
4052	taskkill.exe
2452	taskkill.exe
840	taskkill.exe
2472	taskkill.exe
1676	taskkill.exe
4980	taskkill.exe
1324	taskkill.exe
1172	taskkill.exe
2876	taskkill.exe
1332	taskkill.exe
784	taskkill.exe
2776	taskkill.exe
3112	taskkill.exe
4768	taskkill.exe
4844	taskkill.exe
1052	taskkill.exe
1248	taskkill.exe
3308	taskkill.exe
4788	taskkill.exe
3360	taskkill.exe
3132	taskkill.exe
1832	taskkill.exe
4780	taskkill.exe
2856	taskkill.exe
3140	taskkill.exe
1220	taskkill.exe
3356	taskkill.exe
2020	taskkill.exe
1636	taskkill.exe
4020	taskkill.exe
4380	taskkill.exe
128	taskkill.exe
2968	taskkill.exe
3356	taskkill.exe
1824	taskkill.exe
4208	taskkill.exe
1048	taskkill.exe
4496	taskkill.exe
2132	taskkill.exe
2336	taskkill.exe
2920	taskkill.exe
1352	taskkill.exe
2984	taskkill.exe
1540	taskkill.exe
2388	taskkill.exe
1568	taskkill.exe
4712	taskkill.exe
1052	taskkill.exe
4596	taskkill.exe
684	taskkill.exe
1440	taskkill.exe
4316	taskkill.exe
1116	taskkill.exe
4460	taskkill.exe
1688	taskkill.exe
3392	taskkill.exe
3364	taskkill.exe
1596	taskkill.exe
3088	taskkill.exe
3348	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3100	Kristonium.exe

C:\Users\Admin\AppData\Local\Temp\Kristonium.exe
"C:\Users\Admin\AppData\Local\Temp\Kristonium.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3100
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:5004
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:2056
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  PID:4012
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:3356
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:3648
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:3308
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1688
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:3240
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2452
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:4380
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:1568
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2776
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:1704
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:2336
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:3112
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2968
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:1880
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:4788
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:2936
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:1072
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:4768
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1052
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:4844
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:840
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:3392
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:3360
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:784
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:4800
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2132
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  PID:2396
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:1352
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:3364
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:3568
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2472
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:1704
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:2336
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:3984
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:4712
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:3132
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:5108
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:4404
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1832
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1052
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2920
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  PID:2876
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:3356
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:1332
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  PID:3572
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:2396
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:1352
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:4316
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:420
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:4596
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1220
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:4280
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2984
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1540
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:1116
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:2020
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1636
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:1832
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:1052
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1824
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:564
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:1676
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:4272
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:4780
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:684
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1596
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2388
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:1656
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:4208
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:2980
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:1248
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:3088
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:4980
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:1324
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:4052
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2856
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:4020
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1172
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:680
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:4912
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:3348
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:2876
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:3140
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1048
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:1388
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:4268
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  PID:1524
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:4380
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  - Kills process with taskkill
  PID:4496
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:1440
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  PID:4812
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:1792
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im cmd.exe
  2⤵
  - Kills process with taskkill
  PID:128
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im taskmgr.exe
  2⤵
  - Kills process with taskkill
  PID:4460
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im regedit.exe
  2⤵
  PID:3788

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004CC
1⤵
PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/420-51-0x0000000001420000-0x0000000001484000-memory.dmp

Download

memory/564-63-0x0000000001190000-0x00000000011F4000-memory.dmp

Download

memory/784-26-0x00000000009D0000-0x0000000000A34000-memory.dmp

Download

memory/840-23-0x0000000001180000-0x00000000011E4000-memory.dmp

Download

memory/1052-42-0x0000000000900000-0x0000000000964000-memory.dmp

Download

memory/1052-61-0x00000000013F0000-0x0000000001454000-memory.dmp

Download

memory/1052-21-0x0000000000B00000-0x0000000000B64000-memory.dmp

Download

memory/1072-19-0x0000000000E40000-0x0000000000EA4000-memory.dmp

Download

memory/1116-57-0x0000000000B20000-0x0000000000B84000-memory.dmp

Download

memory/1220-53-0x0000000000BD0000-0x0000000000C34000-memory.dmp

Download

memory/1332-46-0x00000000012A0000-0x0000000001304000-memory.dmp

Download

memory/1352-49-0x0000000000B60000-0x0000000000BC4000-memory.dmp

Download

memory/1352-30-0x00000000013F0000-0x0000000001454000-memory.dmp

Download

memory/1540-56-0x0000000000E70000-0x0000000000ED4000-memory.dmp

Download

memory/1568-10-0x0000000001040000-0x00000000010A4000-memory.dmp

Download

memory/1636-59-0x0000000001190000-0x00000000011F4000-memory.dmp

Download

memory/1688-6-0x0000000001400000-0x0000000001464000-memory.dmp

Download

memory/1704-12-0x0000000001590000-0x00000000015F4000-memory.dmp

Download

memory/1704-34-0x0000000000AD0000-0x0000000000B34000-memory.dmp

Download

memory/1824-62-0x0000000001010000-0x0000000001074000-memory.dmp

Download

memory/1832-41-0x00000000014C0000-0x0000000001524000-memory.dmp

Download

memory/1832-60-0x0000000001380000-0x00000000013E4000-memory.dmp

Download

memory/1880-16-0x0000000000750000-0x00000000007B4000-memory.dmp

Download

memory/2020-58-0x00000000007D0000-0x0000000000834000-memory.dmp

Download

memory/2056-1-0x0000000000830000-0x0000000000894000-memory.dmp

Download

memory/2132-28-0x0000000000C90000-0x0000000000CF4000-memory.dmp

Download

memory/2336-35-0x0000000000BF0000-0x0000000000C54000-memory.dmp

Download

memory/2336-13-0x0000000000640000-0x00000000006A4000-memory.dmp

Download

memory/2396-48-0x00000000012E0000-0x0000000001344000-memory.dmp

Download

memory/2396-29-0x0000000001610000-0x0000000001674000-memory.dmp

Download

memory/2452-8-0x00000000016B0000-0x0000000001714000-memory.dmp

Download

memory/2472-33-0x0000000001580000-0x00000000015E4000-memory.dmp

Download

memory/2776-11-0x0000000001420000-0x0000000001484000-memory.dmp

Download

memory/2876-44-0x00000000013C0000-0x0000000001424000-memory.dmp

Download

memory/2920-43-0x0000000000C60000-0x0000000000CC4000-memory.dmp

Download

memory/2936-18-0x0000000000890000-0x00000000008F4000-memory.dmp

Download

memory/2968-15-0x0000000000820000-0x0000000000884000-memory.dmp

Download

memory/2984-55-0x0000000001260000-0x00000000012C4000-memory.dmp

Download

memory/3112-14-0x0000000000D40000-0x0000000000DA4000-memory.dmp

Download

memory/3132-38-0x0000000001450000-0x00000000014B4000-memory.dmp

Download

memory/3240-7-0x0000000001210000-0x0000000001274000-memory.dmp

Download

memory/3308-5-0x0000000000910000-0x0000000000974000-memory.dmp

Download

memory/3356-45-0x00000000014D0000-0x0000000001534000-memory.dmp

Download

memory/3356-3-0x0000000000F00000-0x0000000000F64000-memory.dmp

Download

memory/3360-25-0x0000000000830000-0x0000000000894000-memory.dmp

Download

memory/3364-31-0x0000000000A00000-0x0000000000A64000-memory.dmp

Download

memory/3392-24-0x0000000001600000-0x0000000001664000-memory.dmp

Download

memory/3568-32-0x0000000000700000-0x0000000000764000-memory.dmp

Download

memory/3572-47-0x00000000016C0000-0x0000000001724000-memory.dmp

Download

memory/3648-4-0x0000000000DF0000-0x0000000000E54000-memory.dmp

Download

memory/3984-36-0x0000000000840000-0x00000000008A4000-memory.dmp

Download

memory/4012-2-0x0000000001380000-0x00000000013E4000-memory.dmp

Download

memory/4280-54-0x0000000000940000-0x00000000009A4000-memory.dmp

Download

memory/4316-50-0x0000000001630000-0x0000000001694000-memory.dmp

Download

memory/4380-9-0x0000000001200000-0x0000000001264000-memory.dmp

Download

memory/4404-40-0x0000000000900000-0x0000000000964000-memory.dmp

Download

memory/4596-52-0x0000000000C70000-0x0000000000CD4000-memory.dmp

Download

memory/4712-37-0x00000000012F0000-0x0000000001354000-memory.dmp

Download

memory/4768-20-0x0000000000D00000-0x0000000000D64000-memory.dmp

Download

memory/4788-17-0x0000000001140000-0x00000000011A4000-memory.dmp

Download

memory/4800-27-0x0000000000CC0000-0x0000000000D24000-memory.dmp

Download

memory/4844-22-0x0000000000AD0000-0x0000000000B34000-memory.dmp

Download

memory/5004-0-0x00000000006C0000-0x0000000000724000-memory.dmp

Download

memory/5108-39-0x0000000000AC0000-0x0000000000B24000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads