0d8f8b1b03a3f76bfbab7861bde74f83f87b0722922135ef89db8975acc8c736

Analysis

max time kernel
899s
max time network
439s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
29/04/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_scripts/postinst.cmd
Size 509B
Sample260429-nplhrafs2p
SHA256 0d8f8b1b03a3f76bfbab7861bde74f83f87b0722922135ef89db8975acc8c736
MD5 a42a22a7caa88992378ba9b395ffda82
SHA1 a98179b4db72b9d583cbb83c3a9637e49d1d4eb6
SHA512 840ce2de457ec509d884b0624992efe2bbedbfef6fe08921d8298b82f5ae993f2f9329a41e948f105a659033d7915ea3eaa7a43f5a2c76dfe16f4dc503ccb837
TLSH
T1CCF00E095BC282FC1F4242E8336BE2DB422BF4080320993A58EA04FC918E6AC0D3291A
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdk-pixbuf-query-loaders.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gdk-pixbuf-query-loaders.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bash.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5044	bash.exe
Token: SeBackupPrivilege	5044	bash.exe
Token: SeDebugPrivilege	5044	bash.exe
Token: SeRestorePrivilege	4976	bash.exe
Token: SeBackupPrivilege	4976	bash.exe
Token: SeDebugPrivilege	4976	bash.exe
Token: SeRestorePrivilege	4976	bash.exe
Token: SeBackupPrivilege	4976	bash.exe
Token: SeDebugPrivilege	4976	bash.exe
Token: SeRestorePrivilege	1604	bash.exe
Token: SeBackupPrivilege	1604	bash.exe
Token: SeDebugPrivilege	1604	bash.exe
Token: SeRestorePrivilege	1604	bash.exe
Token: SeBackupPrivilege	1604	bash.exe
Token: SeDebugPrivilege	1604	bash.exe
Token: SeRestorePrivilege	5268	basename.exe
Token: SeBackupPrivilege	5268	basename.exe
Token: SeDebugPrivilege	5268	basename.exe
Token: SeRestorePrivilege	4208	bash.exe
Token: SeBackupPrivilege	4208	bash.exe
Token: SeDebugPrivilege	4208	bash.exe
Token: SeRestorePrivilege	4208	bash.exe
Token: SeBackupPrivilege	4208	bash.exe
Token: SeDebugPrivilege	4208	bash.exe
Token: SeRestorePrivilege	3896	bash.exe
Token: SeBackupPrivilege	3896	bash.exe
Token: SeDebugPrivilege	3896	bash.exe
Token: SeRestorePrivilege	3896	bash.exe
Token: SeBackupPrivilege	3896	bash.exe
Token: SeDebugPrivilege	3896	bash.exe
Token: SeRestorePrivilege	6124	bash.exe
Token: SeBackupPrivilege	6124	bash.exe
Token: SeDebugPrivilege	6124	bash.exe
Token: SeRestorePrivilege	6124	bash.exe
Token: SeBackupPrivilege	6124	bash.exe
Token: SeDebugPrivilege	6124	bash.exe
Token: SeRestorePrivilege	4776	bash.exe
Token: SeBackupPrivilege	4776	bash.exe
Token: SeDebugPrivilege	4776	bash.exe
Token: SeRestorePrivilege	4776	bash.exe
Token: SeBackupPrivilege	4776	bash.exe
Token: SeDebugPrivilege	4776	bash.exe
Token: SeRestorePrivilege	4504	bash.exe
Token: SeBackupPrivilege	4504	bash.exe
Token: SeDebugPrivilege	4504	bash.exe
Token: SeRestorePrivilege	4504	bash.exe
Token: SeBackupPrivilege	4504	bash.exe
Token: SeDebugPrivilege	4504	bash.exe
Token: SeRestorePrivilege	692	basename.exe
Token: SeBackupPrivilege	692	basename.exe
Token: SeDebugPrivilege	692	basename.exe
Token: SeRestorePrivilege	5880	bash.exe
Token: SeBackupPrivilege	5880	bash.exe
Token: SeDebugPrivilege	5880	bash.exe
Token: SeRestorePrivilege	5880	bash.exe
Token: SeBackupPrivilege	5880	bash.exe
Token: SeDebugPrivilege	5880	bash.exe
Token: SeRestorePrivilege	1628	bash.exe
Token: SeBackupPrivilege	1628	bash.exe
Token: SeDebugPrivilege	1628	bash.exe
Token: SeRestorePrivilege	1628	bash.exe
Token: SeBackupPrivilege	1628	bash.exe
Token: SeDebugPrivilege	1628	bash.exe
Token: SeRestorePrivilege	5624	cat.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 5044	4868	cmd.exe	83
PID 5044 wrote to memory of 4976	5044	bash.exe	84
PID 5044 wrote to memory of 4976	5044	bash.exe	84
PID 4976 wrote to memory of 1604	4976	bash.exe	85
PID 4976 wrote to memory of 1604	4976	bash.exe	85
PID 1604 wrote to memory of 5268	1604	bash.exe	86
PID 5044 wrote to memory of 4208	5044	bash.exe	87
PID 5044 wrote to memory of 4208	5044	bash.exe	87
PID 4208 wrote to memory of 3896	4208	bash.exe	88
PID 4208 wrote to memory of 3896	4208	bash.exe	88
PID 3896 wrote to memory of 4244	3896	bash.exe	89
PID 4208 wrote to memory of 6124	4208	bash.exe	90
PID 4208 wrote to memory of 6124	4208	bash.exe	90
PID 6124 wrote to memory of 5632	6124	bash.exe	91
PID 5044 wrote to memory of 4776	5044	bash.exe	92
PID 5044 wrote to memory of 4776	5044	bash.exe	92
PID 4776 wrote to memory of 4504	4776	bash.exe	93
PID 4776 wrote to memory of 4504	4776	bash.exe	93
PID 4504 wrote to memory of 692	4504	bash.exe	94
PID 5044 wrote to memory of 5880	5044	bash.exe	95
PID 5044 wrote to memory of 5880	5044	bash.exe	95
PID 5880 wrote to memory of 1628	5880	bash.exe	96
PID 5880 wrote to memory of 1628	5880	bash.exe	96
PID 1628 wrote to memory of 5624	1628	bash.exe	97
PID 5880 wrote to memory of 5336	5880	bash.exe	98
PID 5880 wrote to memory of 5336	5880	bash.exe	98
PID 5336 wrote to memory of 1596	5336	bash.exe	99
PID 5044 wrote to memory of 992	5044	bash.exe	100
PID 5044 wrote to memory of 992	5044	bash.exe	100
PID 992 wrote to memory of 2204	992	bash.exe	101
PID 992 wrote to memory of 2204	992	bash.exe	101
PID 2204 wrote to memory of 2536	2204	bash.exe	104
PID 5044 wrote to memory of 4092	5044	bash.exe	105
PID 5044 wrote to memory of 4092	5044	bash.exe	105
PID 4092 wrote to memory of 2916	4092	bash.exe	106
PID 4092 wrote to memory of 2916	4092	bash.exe	106
PID 2916 wrote to memory of 4120	2916	bash.exe	107
PID 4092 wrote to memory of 6060	4092	bash.exe	108
PID 4092 wrote to memory of 6060	4092	bash.exe	108
PID 6060 wrote to memory of 4176	6060	bash.exe	109
PID 5044 wrote to memory of 5496	5044	bash.exe	110
PID 5044 wrote to memory of 5496	5044	bash.exe	110
PID 5496 wrote to memory of 2632	5496	bash.exe	111
PID 5496 wrote to memory of 2632	5496	bash.exe	111
PID 2632 wrote to memory of 2172	2632	bash.exe	112
PID 5044 wrote to memory of 3876	5044	bash.exe	113
PID 5044 wrote to memory of 3876	5044	bash.exe	113
PID 3876 wrote to memory of 3040	3876	bash.exe	114
PID 3876 wrote to memory of 3040	3876	bash.exe	114
PID 3040 wrote to memory of 1508	3040	bash.exe	115
PID 3876 wrote to memory of 2952	3876	bash.exe	116
PID 3876 wrote to memory of 2952	3876	bash.exe	116
PID 2952 wrote to memory of 524	2952	bash.exe	117
PID 5044 wrote to memory of 5148	5044	bash.exe	118
PID 5044 wrote to memory of 5148	5044	bash.exe	118
PID 5148 wrote to memory of 2456	5148	bash.exe	119

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_scripts\postinst.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
  usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5044
- - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
    usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\usr\bin\basename.exe
        
        "C:\Users\Admin\AppData\Local\Temp\usr\bin\basename.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5268
- - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
    usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4208
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\mingw32\bin\gtk-update-icon-cache-3.0.exe
        
        C:\Users\Admin\AppData\Local\Temp\mingw32\bin\gtk-update-icon-cache-3.0.exe -q -t -f mingw32/share/icons/Adwaita
        5⤵
        
        PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\mingw32\bin\gdk-pixbuf-query-loaders.exe
        
        C:\Users\Admin\AppData\Local\Temp\mingw32\bin\gdk-pixbuf-query-loaders.exe --update-cache
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5632
- - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
    usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\usr\bin\basename.exe
        
        "C:\Users\Admin\AppData\Local\Temp\usr\bin\basename.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:692
- - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
    usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1628
    - - C:\Users\Admin\AppData\Local\Temp\usr\bin\cat.exe
        
        "C:\Users\Admin\AppData\Local\Temp\usr\bin\cat.exe"
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\mingw32\bin\fc-cache.exe
        
        C:\Users\Admin\AppData\Local\Temp\mingw32\bin\fc-cache.exe -f
        5⤵
        
        PID:1596
- - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
    usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:992
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\usr\bin\basename.exe
        
        "C:\Users\Admin\AppData\Local\Temp\usr\bin\basename.exe"
        5⤵
        
        PID:2536
- - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
    usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\mingw32\bin\glib-compile-schemas.exe
        
        C:\Users\Admin\AppData\Local\Temp\mingw32\bin\glib-compile-schemas.exe mingw32/share/glib-2.0/schemas
        5⤵
        
        PID:4120
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\mingw32\bin\gtk-update-icon-cache-3.0.exe
        
        C:\Users\Admin\AppData\Local\Temp\mingw32\bin\gtk-update-icon-cache-3.0.exe -qf mingw32/share/icons/hicolor
        5⤵
        
        PID:4176
- - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
    usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2632
    - - C:\Users\Admin\AppData\Local\Temp\usr\bin\basename.exe
        
        "C:\Users\Admin\AppData\Local\Temp\usr\bin\basename.exe"
        5⤵
        
        PID:2172
- - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
    usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3876
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3040
    - - C:\Users\Admin\AppData\Local\Temp\mingw32\bin\gtk-update-icon-cache-3.0.exe
        
        C:\Users\Admin\AppData\Local\Temp\mingw32\bin\gtk-update-icon-cache-3.0.exe -q -t -f mingw32/share/icons/hicolor
        5⤵
        
        PID:1508
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
      usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2952
    - - C:\Users\Admin\AppData\Local\Temp\mingw32\bin\gdk-pixbuf-query-loaders.exe
        
        C:\Users\Admin\AppData\Local\Temp\mingw32\bin\gdk-pixbuf-query-loaders.exe --update-cache
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:524
- - C:\Users\Admin\AppData\Local\Temp\usr\bin\bash.exe
    usr\bin\bash --login -c ". /_scripts/postinst.sh \"$@\"" --
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5148
  - - C:\Users\Admin\AppData\Local\Temp\usr\bin\touch.exe
      "C:\Users\Admin\AppData\Local\Temp\usr\bin\touch.exe"
      4⤵
      PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

icon-theme.cache

Path C:\Users\Admin\AppData\Local\Temp\mingw32\share\icons\hicolor\icon-theme.cache
Size 228B
SHA256 fbc75a3f7d112c41d37057cfb9321dbaf4be3120136064b8a734aa5a2a151e76
MD5 0735f6d5e12062d01e36f14072667c14
SHA1 611df15d204a42a42c8781513b2527b69e9fca0e
SHA512 fdbbec74323c21314cfb859605478e599467e7e72ec2b83004fea46669b48a50717f81155a75c853bceba0f468cf4b328f59dc84ec05032f1c8e03aa2ecaef26
TLSH
T106D08C51FE04C410E429433C8E3B8E082A237E068E036ACAE4C033593D3032499ABC00
MD5 SHA1 SHA512 TLSH

Submit Download

d031bbba323fd9e5b47e0ee5a0353f11-i686.cache-7

Path C:\Users\Admin\AppData\Local\Temp\mingw32\var\cache\fontconfig\d031bbba323fd9e5b47e0ee5a0353f11-i686.cache-7
Size 1.3MB
SHA256 f9710f9cffa29ecbbc274578cc4c964636dbc1808e644381672cb421f1889d92
MD5 1f6f0627716b9487f6118ba88b9c741c
SHA1 c9195245a2aacdbda3ee439bf836760e5d6db0fe
SHA512 ae086c886dd00379dd90eb1c518e3524335acb968755f58013ec9455a472487dbd2f6691c75fe77f20bb6b06d3a1ee447d2ee741b893e8156a2e893652e186d2
SSDEEP 3072:LxJdOFnXZJGp7hzxAb7U3VzTYOa/rqQqAXSROzM1KZ5jnKtBvsrjd3s9upPwi+ln:AcGr3o5PX
TLSH
T1F055EA02E3D4CC73CEA292B480D7935F5A21DA650BA7D783548076B83C773D72E1A6B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/692-61-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/692-69-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/992-132-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/992-146-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/1596-109-0x0000000069140000-0x0000000069177000-memory.dmp

Download

memory/1596-119-0x0000000064BC0000-0x0000000064D13000-memory.dmp

Download

memory/1596-120-0x0000000070740000-0x000000007076F000-memory.dmp

Download

memory/1596-116-0x000000006D6C0000-0x000000006D6EA000-memory.dmp

Download

memory/1596-115-0x0000000063080000-0x000000006309E000-memory.dmp

Download

memory/1596-113-0x0000000068D40000-0x0000000068D82000-memory.dmp

Download

memory/1596-112-0x00000000628C0000-0x00000000628D9000-memory.dmp

Download

memory/1596-111-0x000000006E640000-0x000000006E655000-memory.dmp

Download

memory/1596-110-0x0000000063600000-0x00000000636C1000-memory.dmp

Download

memory/1596-107-0x0000000064B40000-0x0000000064B58000-memory.dmp

Download

memory/1596-106-0x0000000066200000-0x000000006630A000-memory.dmp

Download

memory/1596-105-0x000000006EB40000-0x000000006EB66000-memory.dmp

Download

memory/1596-102-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/1596-103-0x0000000061EC0000-0x0000000061EEB000-memory.dmp

Download

memory/1596-108-0x0000000065180000-0x00000000651D5000-memory.dmp

Download

memory/1596-117-0x000000006FA40000-0x000000006FB4D000-memory.dmp

Download

memory/1604-11-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/1604-8-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/1604-2-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/1628-82-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/1628-75-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/1628-81-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/2204-137-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/2204-133-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/2536-134-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/2536-143-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/2916-161-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/2916-148-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/3896-35-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/3896-16-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/3896-37-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/4092-147-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/4092-186-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/4208-56-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/4208-58-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/4208-15-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/4244-29-0x00000000615C0000-0x0000000061777000-memory.dmp

Download

memory/4244-28-0x0000000068100000-0x0000000068159000-memory.dmp

Download

memory/4244-21-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/4244-22-0x000000006F940000-0x000000006F976000-memory.dmp

Download

memory/4244-23-0x0000000061EC0000-0x0000000061EEB000-memory.dmp

Download

memory/4244-24-0x0000000064BC0000-0x0000000064D13000-memory.dmp

Download

memory/4244-33-0x0000000071240000-0x0000000071250000-memory.dmp

Download

memory/4244-32-0x0000000069340000-0x000000006938C000-memory.dmp

Download

memory/4244-31-0x0000000063080000-0x000000006309E000-memory.dmp

Download

memory/4244-30-0x0000000064B40000-0x0000000064B58000-memory.dmp

Download

memory/4244-25-0x000000006EB40000-0x000000006EB66000-memory.dmp

Download

memory/4244-34-0x0000000000690000-0x00000000006A8000-memory.dmp

Download

memory/4244-27-0x0000000066E40000-0x0000000066E4E000-memory.dmp

Download

memory/4244-26-0x0000000066200000-0x000000006630A000-memory.dmp

Download

memory/4504-62-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/4504-63-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/4504-60-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/4776-70-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/4776-59-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/4776-72-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/4976-14-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/4976-1-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/4976-12-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/5044-0-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5044-73-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5044-104-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5044-101-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/5044-246-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5268-3-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5268-89-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5268-6-0x000000006AC00000-0x000000006AC22000-memory.dmp

Download

memory/5268-4-0x0000000062000000-0x0000000062010000-memory.dmp

Download

memory/5268-10-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5268-5-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5268-7-0x00000000618C0000-0x00000000619A7000-memory.dmp

Download

memory/5336-90-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5336-128-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5336-122-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/5496-187-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5496-197-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5624-84-0x0000000062000000-0x0000000062010000-memory.dmp

Download

memory/5624-80-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5624-88-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5624-83-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/5632-50-0x0000000069340000-0x000000006938C000-memory.dmp

Download

memory/5632-47-0x000000006EB40000-0x000000006EB66000-memory.dmp

Download

memory/5632-51-0x0000000071240000-0x0000000071250000-memory.dmp

Download

memory/5632-42-0x00000000615C0000-0x0000000061777000-memory.dmp

Download

memory/5632-41-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/5632-44-0x0000000066E40000-0x0000000066E4E000-memory.dmp

Download

memory/5632-43-0x0000000064BC0000-0x0000000064D13000-memory.dmp

Download

memory/5632-49-0x0000000064B40000-0x0000000064B58000-memory.dmp

Download

memory/5632-48-0x0000000063080000-0x000000006309E000-memory.dmp

Download

memory/5632-52-0x0000000066200000-0x000000006630A000-memory.dmp

Download

memory/5632-45-0x0000000068100000-0x0000000068159000-memory.dmp

Download

memory/5632-46-0x0000000061EC0000-0x0000000061EEB000-memory.dmp

Download

memory/5880-118-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5880-74-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/5880-114-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/5880-131-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/6060-183-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/6060-162-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/6124-53-0x0000000000400000-0x00000000005FE000-memory.dmp

Download

memory/6124-38-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

memory/6124-55-0x0000000061000000-0x00000000614C0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads