d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b

Analysis

max time kernel
149s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe
Size 5.3MB
Sample260817-ec5lessgmd
SHA256 d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b
MD5 ab863e94b1f232863b93c45c791788f1
SHA1 21f5cf77721196214ef8b7a78d6038386d1dcd6f
SHA512 54a3f879738c39a36cdf425a77341f8ae55b409e2cb54b7c8d60123e2031fb018d87c3fdb26a29261d8b6e344da4ed7a3a8272d228d0e2c257763611fae8f72c
SSDEEP 98304:8KAU58Eek+V0VyZG1vCqLfWrtX6FmrH9HTk1hlWcsrpyPVb7p7:8s+kYZenotX6IrH9HTwbWub7p7
TLSH
T136462349E7A405FDE4A3D1B8DD820A17F7717C9907A19BDF13A0A9A21F233905E3DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 20 IoCs

description	pid	Process	procid_target
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89
PID 4536 created 5556	4536	patch.exe	89

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\DriverData\setup123.bat	d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe
File opened for modification	C:\Windows\System32\drivers\DriverData\setup123.bat	d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe
File created	C:\Windows\System32\drivers\DriverData\AcpiDev.dat	d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe
File opened for modification	C:\Windows\System32\drivers\DriverData\AcpiDev.dat	d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe
File created	C:\Windows\System32\drivers\DriverData\__tmp_rar_sfx_access_check_240696343	d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe
File created	C:\Windows\System32\drivers\DriverData\usbcir.dat	d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe
File opened for modification	C:\Windows\System32\drivers\DriverData\usbcir.dat	d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe
File created	C:\Windows\System32\drivers\DriverData\patch.exe	d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe
File opened for modification	C:\Windows\System32\drivers\DriverData\patch.exe	d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe

Executes dropped EXE 1 IoCs

pid	Process
4536	patch.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5556	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	patch.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 5556	2580	d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe	89
PID 5556 wrote to memory of 4536	5556	cmd.exe	91
PID 4536 wrote to memory of 4240	4536	patch.exe	92
PID 4240 wrote to memory of 2920	4240	csc.exe	94
PID 4536 wrote to memory of 4644	4536	patch.exe	95
PID 4644 wrote to memory of 5740	4644	csc.exe	97

C:\Users\Admin\AppData\Local\Temp\d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe
"C:\Users\Admin\AppData\Local\Temp\d4fca6b637494981077cb99b3cfc5571cbc8abecab6760d4d07d2b4db4db900b.exe"
1⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\System32\drivers\DriverData\setup123.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\System32\drivers\DriverData\patch.exe
    C:\Windows\System32\drivers\DriverData\patch.exe
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4536
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tzyokzfo\tzyokzfo.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4240
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC2DE.tmp" "c:\Users\Admin\AppData\Local\Temp\tzyokzfo\CSC5E2F984B2ACA48C8A8D8B22F81417627.TMP"
        5⤵
        
        PID:2920
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tzyokzfo\tzyokzfo.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4644
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC407.tmp" "c:\Users\Admin\AppData\Local\Temp\tzyokzfo\CSC85C6FA0598134E439AA5A0D97585173F.TMP"
        5⤵
        
        PID:5740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESC2DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC2DE.tmp
Size 1KB
SHA256 9c6cffb6c19bcacaa3b70d11f95ae827210e0bd4a1fde1f1df3d6e777fe91268
MD5 e8aa8ace7a025e73001f9c8f205b0437
SHA1 4b980b2125aec7eea32fa953a2ca8f78c833b18d
SHA512 91f1db1686a8e673ef3b4db5bcac116a8d991480919260aac9b5891470fa8c55a7573592a4480d31ee1b279acf17a2a32f281ae4d9421896bddac7e3e25b396b
TLSH
T14421AA0253E9461BF0B70731A9FA172BA675FD65EFB2D3AA8541022C2C11248DEA0B73
MD5 SHA1 SHA512 TLSH

Submit Download

RESC407.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESC407.tmp
Size 1KB
SHA256 3cc9d253a3dc20e8021a385d279a526c8adbb6466c89b76bd1707f0599b26485
MD5 a691fe742cfe143b763b7e7c8114e7b5
SHA1 7d137fd2dafed4e7e7703bcb7342b2f20498fb24
SHA512 0d025e5f694635c858365d3b578385eedcb67c7f98409cc28d07ca04760b2af162a5730531c621c7de692bfa5d7ea1a74556c379acbcb1dc96415efe76abec10
TLSH
T1B321AD0653E8461FF0B70731A8FA571B9675FD55EF72D39A4441022C1C40608EEA0F73
MD5 SHA1 SHA512 TLSH

Submit Download

tzyokzfo.dll

Path C:\Users\Admin\AppData\Local\Temp\tzyokzfo\tzyokzfo.dll
Size 3KB
SHA256 ab927d4a95944e3e0bb32c99fdf11ac13509edd6cdf7603bb4ba049b30fa9471
MD5 eb2f648bd27a53950893972058695f05
SHA1 76ec0509955e02b4fefa14c2daaeddec3fb3063c
SHA512 d8fbc6255134197e6166873c725675e65785c467e6e47fd2a1262330c43842738966fae67086d026cbb2d08a9fa5f97b5c4932164d54195ef2b67ff163e0d729
TLSH
T19171DE1693F8426BE0BF4331AEE387172674E860AB63937A1E8002686C543741D61B71
MD5 SHA1 SHA512 TLSH

Submit Download

tzyokzfo.dll

Path C:\Users\Admin\AppData\Local\Temp\tzyokzfo\tzyokzfo.dll
Size 4KB
SHA256 962713e5d60d4e40977e30761d24e398fa329667556f2fcc620b006fb91844c8
MD5 9800744bd61f1e5118f9350c5e2dce93
SHA1 8affba66d71713d865d63672c7eefaf54622f61c
SHA512 c0a4b88e537fd92b5cb87a94f42244c34a185def0c3f8b07bd98725f4dc6879eb4298b1d8047e96bd73a2422a23d292b97ca7feb155c9315e95abc952b5df135
TLSH
T188810F1667FD4A67E0BF0B70ADF3431623B0E964AA66E36B1980025CAC613746D62F70
MD5 SHA1 SHA512 TLSH

Submit Download

tzyokzfo.pdb

Path C:\Users\Admin\AppData\Local\Temp\tzyokzfo\tzyokzfo.pdb
Size 11KB
SHA256 df1b21b7e8e3215822c527ff39433874d6128a2f8e087f93d38d127682bde6c6
MD5 dc34aa7b635017709d4a2cebe7a5d916
SHA1 95131e7dc80072090098f895c4e9b5c297c25c46
SHA512 afa2b52cae36216fffaa2d2629cb1bdac64d53c78a0a0343be0c6181dedbad0595a8222d254efec31875b9a204a7bc8e6f4f82c89921db7cb87d8350e4e0b1b9
SSDEEP 24:zZmsG3Zj3wGx8wzB2/pLnzQDkUHXBnM7GCzyL5eH2/gztbU:zZY5AQ2/pLbaJM7xOL5eH2/gzt
TLSH
T1F3328740379AD6B2C05C52B54CA78ACC5B20FC69AD86674B3B40B70E3C766D96E91284
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzyokzfo.pdb

Path C:\Users\Admin\AppData\Local\Temp\tzyokzfo\tzyokzfo.pdb
Size 11KB
SHA256 45dd8b649962e0da07026deca68731ddfab74ec77ec3e045bb0c83ae9960cd3d
MD5 0bb350d38097090c2e5ddeebf1d024d6
SHA1 152ef40e5dae7a7c7ba740f6b2871f2c7ee7a5d1
SHA512 c7e1b750147dd556aca2621c11cae9d3cf0a66e9d561fc3b46e4b6f7af4542cb83141bac2926fc3a6e60137ff36a6e145b5e5f979faaf0e29a1b1a531b8d0579
SSDEEP 24:zZmsjNZj3wGx8fL2/pLnsQuoUBKnhwqpNPGGFaIByLZeH2/gz5nU:zZxAp2/pLSQnOqpNPPyLZeH2/gz5
TLSH
T1503285803B8AD672C05C96780CEB87C96B60FC5AAEC5674B3741B31D3C7A6D9ACD1280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

acpidev.dat

Path C:\Windows\System32\Drivers\DriverData\acpidev.dat
Size 4.6MB
SHA256 0a04701067d10e1ec22a8fd8f73782afd0d9f5b26cd238a105cc2539ecda4ccc
MD5 9ea0512c7442ea7d5de483fc833b4478
SHA1 421faec73f2539d04958a7c3ee4149c31ffcad58
SHA512 f242e37e38c467701bc12e44b3a78e66745a28b283c158df426509753d84cddb4a5c8f25ecfdefee8c61feaa221c7b5125efb55689cd68e5d5a82998eb382956
SSDEEP 98304:9pXIyghPhcUdkHPKlbrzgR0IwGb5e4OZrDaNBRZ8WZNnicT1l:HXrmeHo82IwGb/QrEq893T1l
TLSH
T1443612D52BE26D39798DA22B0907D83451BFD92D5EED3E32A472DF8D292F13C1702648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

usbcir.dat

Path C:\Windows\System32\Drivers\DriverData\usbcir.dat
Size 386KB
SHA256 dc6f6a1dae57a1014b0cc071018a8b0928a858a566d4f81994bc2e5f1b4c2cbd
MD5 13dc3ed60b6877de128d3086f296e422
SHA1 d4af13b7800b3e95619bb214e4465879e5722b93
SHA512 b958f0113ff78d76435e53cd3775ba06728181bb52fe1a6d8e311e41cd40efbb02ff8744b1bb5038e248681deefc1c864af85276343ee95ff7f6d7ade3b263af
SSDEEP 6144:9JssfSs6G3UDfcNevdl0drZr+Hq/9NZPuFm6aXeSWDUv2Et4uZHfxf0qUn7yY6h4:wIQvvdl0dMK/ZPuEJLxWuVxYESjt
TLSH
T17584E16C086A0254784A27696FD5347FFE3B138962AFC1A595B580C998C2D2C1BCAFF1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

patch.exe

Path C:\Windows\System32\drivers\DriverData\patch.exe
Size 13KB
SHA256 9b5ff51fc4b10f91ea4248f73359a5ce042f837dd424200bfab167b4fb5feb85
MD5 c1430dc38192984a989a9c13d2f54d49
SHA1 3e746eb2b388daf2fa3dda4a8e6d3594b3ccf6af
SHA512 352787e136350cef5d109dbc5c6730240d752e33de65b2fe2114a1f3f72c44973fa290b3c0e0f10710ba4a03e83e5e072f2d294de10ff509d220db9c2104b436
SSDEEP 384:tRDvO1Ycn+9lrShtLU0a0/HFTWrk7+BL6OMMW:/7wGAE0I4Cs
TLSH
T1AF522954BBE88737DAF71B765C33105407B6FA016E22CF9E9CC5204A99A2F044756B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup123.bat

Path C:\Windows\System32\drivers\DriverData\setup123.bat
Size 228B
SHA256 d69f00bb41d2404560106d6878c16d3819e134288229536c47040c15c5fb5038
MD5 ae0ef38e06c261de33e685b93f680033
SHA1 f04c21f33542ebdd001c72c5e15932e67edc60a8
SHA512 24158c9575e8f143991a81c6064e0dbb1627ad99d5b715bf5940443044f8c19cff45881fbe33d01a8558aefff81ffc870de220b6951844b8b2bd7a551fa94090
TLSH
T1F9D0E9F10FE48475D07A0D40692BE7A5E755F68E67F6543417E32298F80980D7E90CBD
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5E2F984B2ACA48C8A8D8B22F81417627.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\tzyokzfo\CSC5E2F984B2ACA48C8A8D8B22F81417627.TMP
Size 652B
SHA256 a35bd0d2f28ac57bedc02ea7847d3a4daf046ff8396026671e661f088c813816
MD5 3d9506e133742449eb11d295bd12cabf
SHA1 2256138f5fdcc06350349576cc3894a535c1dc41
SHA512 657dc3f6c68bce641307685e7b5220115882d35083db763143d868748c6b628f756c1959da2cf1185530918f296f1a15082086534ab209ca1e9b0534e6cd1025
TLSH
T16AF03A0A63F8020AF0F34B31B9F6436791A8BC64DE3293ED1441035D28646248962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

tzyokzfo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tzyokzfo\tzyokzfo.0.cs
Size 82B
SHA256 dc4fe976865cf1f53de8f1f81206fbb0c1c562a96c90f57c4cd5bfb0ffecbcd9
MD5 9bc16e67b2cefd03bee7e7af74eb78f3
SHA1 de2d546df11efac03ef38c73a7662ac662cd0da5
SHA512 b45020fe02f6bc72c136cdfec49ad9844de9f9a9e60942fd2e785488e1277da73efc111c7bc3c096580f2091e3e3ea184844f0aa068e63b4bcd11619aa6a51df
TLSH
T1E5A012105E79D432564201D7A2240452B120C06442843400E8B01C9331020044438519
MD5 SHA1 SHA512 TLSH

Submit Download

tzyokzfo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\tzyokzfo\tzyokzfo.0.cs
Size 283B
SHA256 7f3b52e5000161d78b030777007a2451d0ed9faa665eed4f7efb5d50a9f3fa08
MD5 13af16a9bb03578b8e7c4b7388d15859
SHA1 d39f36b70a29d61dfadd05d672fd5c99fa485125
SHA512 216321225446b47ce4afd94fc20e762fb6c42a1b68e8df7e312bd9145b873ac234c84708564284d5a9bd8b62001b85c876a250d89fc5461f8840b7d6bd29c398
TLSH
T1B4D0EBC02236EA300AC6640224FAFEBAFAB093248038C030B0C69C0DD02C230BBB0C26
MD5 SHA1 SHA512 TLSH

Submit Download

tzyokzfo.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\tzyokzfo\tzyokzfo.cmdline
Size 914B
SHA256 b0a675d2758a5755e7c618d5ba278c8c56ad6ae7f8718f5aab16c133df051820
MD5 de0178434e1740ba5b1f1d9f517f492f
SHA1 4d99468d5d8c69606f783645c520ab7cad272206
SHA512 ce73a370a810d8d57d9c34cbd1d482dbda99f0384ec537806dd806a9c30a0f807a24101b8d0749301b461c069f4c4f411060405a6a741e28b61b3c98f8822eb2
TLSH
T141112325033B86F7C6FA3943089E5E5C9267535F3082EE287A898D5AE9A74114E10B90
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4536-136-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-120-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-42-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4536-24-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4536-52-0x0000019313120000-0x0000019313128000-memory.dmp

Download

memory/4536-23-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4536-19-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4536-54-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4536-18-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

memory/4536-56-0x000001932CB60000-0x000001932CBC6000-memory.dmp

Download

memory/4536-17-0x0000019311260000-0x0000019311268000-memory.dmp

Download

memory/4536-64-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-182-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-180-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-178-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-177-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-174-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-172-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-168-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-166-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-164-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-162-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-158-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-156-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-154-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-152-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-148-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-146-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-144-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-140-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-16-0x00007FF8EA99F000-0x00007FF8EA9A0000-memory.dmp

Download

memory/4536-134-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-132-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-130-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-128-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-126-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-122-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-36-0x00000193130D0000-0x00000193130D8000-memory.dmp

Download

memory/4536-116-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-114-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-112-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-104-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-98-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-96-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-94-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-92-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-90-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-86-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-84-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-80-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-76-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-74-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-72-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-68-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-67-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-62-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-60-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-58-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-57-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-170-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-160-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-150-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-142-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-138-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-124-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-118-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-110-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-108-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-106-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-102-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-100-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-88-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-82-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-78-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-70-0x000001932CB60000-0x000001932CBC1000-memory.dmp

Download

memory/4536-860-0x00007FF8EA810000-0x00007FF8EB1B4000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads