2a3dd7969a06729a32ace0a6ece5f2327e29bdf460b8b39e6a8b0875e545632e

Resubmissions

08/08/2026, 02:54

260808-dd85kabc983

08/08/2026, 02:42

260808-c7c4jsbc553

Analysis

user interaction
yes
max time kernel
144s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ddlc-win.zip
Size 220.9MB
Sample260808-c7c4jsbc55
SHA256 2a3dd7969a06729a32ace0a6ece5f2327e29bdf460b8b39e6a8b0875e545632e
MD5 09a4e1bf2ab801908b3199f901bd8b0d
SHA1 53182ba15f04c9acac2b9fe5112f85415d09f95f
SHA512 f5ecaa288f076c16532ceeada75e0086fdfb35544e5ac267a1de90eac20a4e1746d9edbd1d3b429153f611edfc2454b9efc86309d7059cd502d14a997117de70
SSDEEP 6291456:CRbvcXNpXzPzOHC701yOX1FgV8npcmsPQIOzs6lQtdbyUwsbCmXzCeLh:CZvcbPCHx1yOX1/njsPQN4uUwoRCeLh
TLSH
T135B833A98B75E1C6C52790B688B23C9762220DB7E18A7253A7F3379435F36D4C709C9C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-107 = "Microsoft Excel Comma Separated Values File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000018b9230ce126dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000684a570de126dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9902 = "Movie Clip"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000db6b150ce126dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000653ae70ce126dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9939 = "ADTS Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9935 = "MPEG-2 TS Video"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d2713f0de126dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008dcd170ce126dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005009130ce126dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b4a9d20be126dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f81ea0be126dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000068b8420ce126dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000d1f6ff0be126dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-111 = "Microsoft Excel Macro-Enabled Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf	SearchProtocolHost.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: 33	3760	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3760	SearchIndexer.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 4952	3760	SearchIndexer.exe	100
PID 3760 wrote to memory of 2080	3760	SearchIndexer.exe	101

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\ddlc-win.zip
1⤵
PID:3904

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2376

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4952
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
  2⤵
  - Modifies data under HKEY_USERS
  PID:2080

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-39-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-38-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-40-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-43-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-42-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-41-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-50-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-53-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-52-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-51-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-49-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-48-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-47-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-46-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-45-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-44-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-54-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-55-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-56-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-59-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-58-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-57-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-60-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-64-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-67-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-66-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-69-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-68-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-65-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-63-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-71-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-75-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-74-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-73-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-83-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-85-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-84-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-82-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-81-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-80-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-79-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-78-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-77-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-76-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-72-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-70-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-62-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-61-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-86-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-87-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-88-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-90-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-91-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-89-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-97-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-96-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-95-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-94-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-93-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/2080-92-0x0000023962030000-0x0000023962040000-memory.dmp

Download

memory/3760-0-0x0000011E84460000-0x0000011E84470000-memory.dmp

Download

memory/3760-16-0x0000011E84690000-0x0000011E846A0000-memory.dmp

Download

memory/3760-32-0x0000011E8CA50000-0x0000011E8CA58000-memory.dmp

Download

memory/3760-36-0x0000011E8E100000-0x0000011E8E108000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads