56791fd065358e899c581ebefe2ad871399b7c7ae83fb85e1154c08a75a44147

Analysis

user interaction
yes
max time kernel
142s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ReShade_Setup_6.7.3.exe
Size 3.8MB
Sample260701-mrr8msbz4m
SHA256 56791fd065358e899c581ebefe2ad871399b7c7ae83fb85e1154c08a75a44147
MD5 d1aade32886987db543fc171027b865d
SHA1 816cfb69d8f262a2c6073b5f8d28e1b56a147a6d
SHA512 788813cf2529cdc7c83726737887f453c2b681d6e7c8cb5bd1cf09e2bbd25cd50020a84340b45bf310927b7fdd0f03da5ec951f9f979bed42d5840a4a603d9d8
SSDEEP 98304:NSZN5qt2fPnfaf65RCfC3Xs89C3RWA1aGD34OpFLoTz2:NS35CY/faARV4gijI6Fe2
TLSH
T1B20633C702D91458EAF7AF39B4324A4285B3B8822631D69836DE388C5FF0798D5357B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
4	raw.githubusercontent.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000\Control Panel\Colors	ReShade_Setup_6.7.3.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	ReShade_Setup_6.7.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	ReShade_Setup_6.7.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 3a001f483accbfb42cdb4c42b0297fe99a87c641260001002600efbe11000000d10d7301cb07dd0124af7085d507dd01d6de7385d507dd0114000000	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\NotificationData	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\MRUListEx = ffffffff	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	ReShade_Setup_6.7.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	ReShade_Setup_6.7.3.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	ReShade_Setup_6.7.3.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	ReShade_Setup_6.7.3.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	ReShade_Setup_6.7.3.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	ReShade_Setup_6.7.3.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6104	ReShade_Setup_6.7.3.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	6104	ReShade_Setup_6.7.3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6104	ReShade_Setup_6.7.3.exe

C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.7.3.exe
"C:\Users\Admin\AppData\Local\Temp\ReShade_Setup_6.7.3.exe"
1⤵
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6104

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReShade.ini

Path C:\Users\Admin\Desktop\ReShade.ini
Size 347B
SHA256 8dd61c317753abc0720718c02675f27215f7f0e3e1ece0c3cfad2d0571b2305e
MD5 b953cce29ed83a6188d17ef9113a3401
SHA1 06bc598693626504a992cb873736fd2c0c3fdd12
SHA512 a92afbf2abde04a6bd3957e71559727168922e4eafa2a27c220434fd164c5786e9a699d74d88f28054eb69c6d1022983d1f072cf96a8cd654d00cbfc791ad8fc
TLSH
T113E0263878A2118E5973022660B23BC22873F05DD4AB80849216DB4FB8E27BDC133B0E
MD5 SHA1 SHA512 TLSH

Submit Download

ReShade.ini

Path C:\Users\Admin\Desktop\ReShade.ini
Size 249B
SHA256 ed11cf9cf89c6ab701ca796ab23ad9743f843105fd74b00696f9093511f07f27
MD5 b82180aa128363c33f35d67b387a8cfe
SHA1 beca6284fbce849c9e5c68b0f3284db9f5802018
SHA512 37d3a807062adab06cf8c4c970028cb164bac176c508202a5df40b5d81a7cdb5d5043bbba8f151bff13300d90b826e5899afb646308854280e8200903e371dbf
TLSH
T1D1D0A778B463218A8A62023760B357C524B3F4AD98EA8141D001DB0FDD403FAC233F5E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6104-14-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-25-0x0000021B7C530000-0x0000021B7C53A000-memory.dmp

Download

memory/6104-4-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-5-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-6-0x0000021B78B30000-0x0000021B78B38000-memory.dmp

Download

memory/6104-8-0x0000021B78C60000-0x0000021B78C6E000-memory.dmp

Download

memory/6104-7-0x0000021B78CD0000-0x0000021B78D0E000-memory.dmp

Download

memory/6104-9-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-10-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-11-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-12-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-13-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-3-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-0-0x00007FFB508BF000-0x00007FFB508C0000-memory.dmp

Download

memory/6104-21-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-17-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-18-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-19-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-16-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-22-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-23-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-24-0x0000021B7C540000-0x0000021B7C552000-memory.dmp

Download

memory/6104-15-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-2-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

memory/6104-1-0x0000021B76DE0000-0x0000021B76E0A000-memory.dmp

Download

memory/6104-237-0x00007FFB50730000-0x00007FFB510D4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads