netwire | 2fd95788fccab969edc87fb7d11ea02168288bc82ffeaba8bee93c1dbd4c170a

Analysis

max time kernel
103s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/09/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
Size 1.4MB
Sample260925-rmybbazy3r
SHA256 2fd95788fccab969edc87fb7d11ea02168288bc82ffeaba8bee93c1dbd4c170a
MD5 17bccb9213b467716b64a62068a426df
SHA1 905670463a4154c050e222c3d5437885bffb8e8c
SHA512 b1f5bd5267a4762209afa34cbbdbac6c37cbcd89cb5ab16771502d1b91510bf47cdcd154ceae50627864264e2b66204e5de65b75147e390cd0ac8239d952c027
SSDEEP 24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWY5:ho0c++OCokGs7Adgrd1f26RNY5
TLSH
T15165BF52E38EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5ED3AAD21021112DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

botnet discovery execution netwire warzonerat infostealer persistence rat stealer

Malware Config

Extracted

Family

netwire

Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190

Attributes

activex_autorun
false
copy_executable
true
delete_original
false
host_id
sunshineslisa
install_path
%AppData%\Imgburn\Host.exe
keylogger_dir
%AppData%\Logs\Imgburn\
lock_executable
false
offline_keylogger
true
password
sucess
registry_autorun
false
use_mutex
false

Extracted

Family

warzonerat

wealth.warzonedns.com:5202

Signatures

Family: Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire
Family: WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

NetWire RAT payload 19 IoCs

rat

resource	yara_rule
behavioral2/memory/1264-0-0x0000000000EC0000-0x000000000102B000-memory.dmp	netwire
behavioral2/memory/1264-1-0x0000000000EC0000-0x000000000102B000-memory.dmp	netwire
behavioral2/files/0x000e00000001c506-6.dat	netwire
behavioral2/memory/1124-16-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3728-18-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/1264-30-0x0000000000EC0000-0x000000000102B000-memory.dmp	netwire
behavioral2/files/0x000d00000001c50c-31.dat	netwire
behavioral2/memory/5884-32-0x0000000000490000-0x00000000005FB000-memory.dmp	netwire
behavioral2/memory/5884-33-0x0000000000490000-0x00000000005FB000-memory.dmp	netwire
behavioral2/memory/2888-54-0x0000000000490000-0x00000000005FB000-memory.dmp	netwire
behavioral2/memory/5884-55-0x0000000000490000-0x00000000005FB000-memory.dmp	netwire
behavioral2/memory/3728-58-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3728-60-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/5712-61-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3460-69-0x0000000000490000-0x00000000005FB000-memory.dmp	netwire
behavioral2/memory/3460-80-0x0000000000490000-0x00000000005FB000-memory.dmp	netwire
behavioral2/memory/4292-85-0x0000000000400000-0x000000000042C000-memory.dmp	netwire
behavioral2/memory/3692-102-0x0000000000490000-0x00000000005FB000-memory.dmp	netwire
behavioral2/memory/1272-120-0x0000000000400000-0x000000000042C000-memory.dmp	netwire

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4616-20-0x00000000003D0000-0x00000000003ED000-memory.dmp	warzonerat
behavioral2/memory/4616-28-0x00000000003D0000-0x00000000003ED000-memory.dmp	warzonerat
behavioral2/memory/2888-45-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/2888-53-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Executes dropped EXE 9 IoCs

pid	Process
1124	Blasthost.exe
3728	Host.exe
5884	RtDCpl64.exe
5712	Blasthost.exe
2888	RtDCpl64.exe
3460	RtDCpl64.exe
4292	Blasthost.exe
3128	RtDCpl64.exe
3692	RtDCpl64.exe

AutoIT Executable 15 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/1264-0-0x0000000000EC0000-0x000000000102B000-memory.dmp	autoit_exe
behavioral2/memory/1264-1-0x0000000000EC0000-0x000000000102B000-memory.dmp	autoit_exe
behavioral2/memory/1264-30-0x0000000000EC0000-0x000000000102B000-memory.dmp	autoit_exe
behavioral2/files/0x000d00000001c50c-31.dat	autoit_exe
behavioral2/memory/5884-32-0x0000000000490000-0x00000000005FB000-memory.dmp	autoit_exe
behavioral2/memory/5884-33-0x0000000000490000-0x00000000005FB000-memory.dmp	autoit_exe
behavioral2/memory/2888-54-0x0000000000490000-0x00000000005FB000-memory.dmp	autoit_exe
behavioral2/memory/5884-55-0x0000000000490000-0x00000000005FB000-memory.dmp	autoit_exe
behavioral2/memory/3460-69-0x0000000000490000-0x00000000005FB000-memory.dmp	autoit_exe
behavioral2/memory/3460-80-0x0000000000490000-0x00000000005FB000-memory.dmp	autoit_exe
behavioral2/memory/3692-102-0x0000000000490000-0x00000000005FB000-memory.dmp	autoit_exe
behavioral2/memory/3692-101-0x0000000000490000-0x00000000005FB000-memory.dmp	autoit_exe
behavioral2/files/0x000d00000001c50c-99.dat	autoit_exe
behavioral2/files/0x000d00000001c50c-111.dat	autoit_exe
behavioral2/memory/3692-114-0x0000000000490000-0x00000000005FB000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1264 set thread context of 4616	1264	2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	90
PID 5884 set thread context of 2888	5884	RtDCpl64.exe	98
PID 3460 set thread context of 3128	3460	RtDCpl64.exe	106

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Blasthost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Host.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RtDCpl64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5696	schtasks.exe
6108	schtasks.exe
4696	schtasks.exe
420	schtasks.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1264 wrote to memory of 1124	1264	2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	88
PID 1124 wrote to memory of 3728	1124	Blasthost.exe	89
PID 1264 wrote to memory of 4616	1264	2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	90
PID 1264 wrote to memory of 4616	1264	2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	90
PID 4616 wrote to memory of 2640	4616	2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	91
PID 1264 wrote to memory of 6108	1264	2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	93
PID 4616 wrote to memory of 2640	4616	2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	91
PID 4616 wrote to memory of 2640	4616	2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe	91
PID 5884 wrote to memory of 5712	5884	RtDCpl64.exe	97
PID 5884 wrote to memory of 2888	5884	RtDCpl64.exe	98
PID 5884 wrote to memory of 2888	5884	RtDCpl64.exe	98
PID 2888 wrote to memory of 5216	2888	RtDCpl64.exe	99
PID 5884 wrote to memory of 4696	5884	RtDCpl64.exe	101
PID 2888 wrote to memory of 5216	2888	RtDCpl64.exe	99
PID 2888 wrote to memory of 5216	2888	RtDCpl64.exe	99
PID 3460 wrote to memory of 4292	3460	RtDCpl64.exe	105
PID 3460 wrote to memory of 3128	3460	RtDCpl64.exe	106
PID 3460 wrote to memory of 3128	3460	RtDCpl64.exe	106
PID 3128 wrote to memory of 2964	3128	RtDCpl64.exe	107
PID 3460 wrote to memory of 420	3460	RtDCpl64.exe	109
PID 3128 wrote to memory of 2964	3128	RtDCpl64.exe	107
PID 3128 wrote to memory of 2964	3128	RtDCpl64.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1264
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1124
- - C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
    "C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3728
- C:\Users\Admin\AppData\Local\Temp\2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_17bccb9213b467716b64a62068a426df_agent-tesla_darkgate_elex_hawkeye_maze_netwire_remcos_xloader.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2640
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:6108

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5884
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:5712
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2888
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5216
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4696

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  - Executes dropped EXE
  PID:4292
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2964
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:420

C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3692
- C:\Users\Admin\AppData\Roaming\Blasthost.exe
  "C:\Users\Admin\AppData\Roaming\Blasthost.exe"
  2⤵
  PID:1272
- C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
  "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
  2⤵
  PID:1476
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:5672
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Blasthost.exe

Path C:\Users\Admin\AppData\Roaming\Blasthost.exe
Size 132KB
SHA256 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
MD5 6087bf6af59b9c531f2c9bb421d5e902
SHA1 8bc0f1596c986179b82585c703bacae6d2a00316
SHA512 c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
SSDEEP 1536:dtTSUSKzF0Lh9a7WraTWFbmDHVXWRVAzZ8MfUSl7Q3rwc5ggZG:dt5SKzF0Lh9a7IGW9GHeOFVvc3rvZG
TLSH
T1E9D3A419E66BD0F9FD472C7480DFF26F46386D00C534CF62DF953E02DA27921A129AA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RtDCpl64.exe

Path C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Size 918KB
SHA256 29bab6adb267e0dba3a72537c5c6db6a14487bbdc1472d2e0e8d90f8546ad655
MD5 b6ea880ecfc28c743dae90aef8bb1d7c
SHA1 5193f3e8c504e800bc91f999373e3b28f97c683d
SHA512 cf27047b652fd0242a1d5d0195ec3e9503bb653fb97759ccbb5406d056f51045b4abfcff8042eedc094d5b4b388a2b8e60f26f324f4f3eedea65665ae56f233d
SSDEEP 24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4nk:ho0c++OCokGs7Adm
TLSH
T1BD158E92B39DC3A0CE265173BE39EB126F7B7C250534B8572EC52D3A7D50162223DA93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RtDCpl64.exe

Path C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Size 1.4MB
SHA256 e40bb13a91c8d42abcd09d77a22da4e12c7aded807fc0b5d0483b79e22766f21
MD5 af4b733355f225b3766fa87f516c7f01
SHA1 0b371ff0c27b3aed25bd9b963c0a864afcd75240
SHA512 a13d1d6f6e509cccaccdf6a7090185444082adc0fbb2b8ff2abb187d7da03a2abae1b061b929b80113953e872c97286d2ab14637b75f84bb7822dd4e7925825a
SSDEEP 24576:nu6J3xO0c+JY5UZ+XCHkGsoEAdx20W4njUprvVcC1f2o5RRfgdWYc:ho0c++OCokGs7Adgrd1f26RNYc
TLSH
T14065BF52E38EC2F0DE165172BA7DF73A1E3B3C254530B9566FC5ED3AAD21021112DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RtDCpl64.exe

Path C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
Size 875KB
SHA256 720c87592f9746ef6f243626e42ee7f65232f2b947be6c172e592a23094ddf65
MD5 e4d7a418c871b6d02715ccc6e3087bbf
SHA1 85a352fcd02b15d5ade752a5d19eabc879780e5a
SHA512 b06c24b3ded602cd1fa650b5287c92b78811b96aca1056f39bb571331bdf2aa55215d11c128aee297387aa05e004ab76d3c353395d8a8b710163f48c9764428d
SSDEEP 12288:nu6JWgX17rKfXNeKgOIc0nAWY/ySWHDVz/Vovh7V1CHNnCGsoLfgBDSd5rcoN2f:nu6J3xO0c+JY5UZ+XCHkGsoEAdx2f
TLSH
T12F158E92B38DC3A0CF269173BE79EB126F7B7C250524B8572EC51D3A7D60162223D693
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1124-12-0x0000000000429000-0x000000000042A000-memory.dmp

Download

memory/1124-16-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/1264-19-0x00000000025F0000-0x00000000025F1000-memory.dmp

Download

memory/1264-30-0x0000000000EC0000-0x000000000102B000-memory.dmp

Download

memory/1264-1-0x0000000000EC0000-0x000000000102B000-memory.dmp

Download

memory/1264-0-0x0000000000EC0000-0x000000000102B000-memory.dmp

Download

memory/1272-120-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/2640-36-0x00000000011B0000-0x00000000011B1000-memory.dmp

Download

memory/2888-53-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2888-54-0x0000000000490000-0x00000000005FB000-memory.dmp

Download

memory/2888-45-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2964-81-0x0000000001090000-0x0000000001091000-memory.dmp

Download

memory/3460-69-0x0000000000490000-0x00000000005FB000-memory.dmp

Download

memory/3460-80-0x0000000000490000-0x00000000005FB000-memory.dmp

Download

memory/3692-114-0x0000000000490000-0x00000000005FB000-memory.dmp

Download

memory/3692-101-0x0000000000490000-0x00000000005FB000-memory.dmp

Download

memory/3692-102-0x0000000000490000-0x00000000005FB000-memory.dmp

Download

memory/3728-18-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3728-58-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/3728-60-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4292-85-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/4616-28-0x00000000003D0000-0x00000000003ED000-memory.dmp

Download

memory/4616-20-0x00000000003D0000-0x00000000003ED000-memory.dmp

Download

memory/5216-56-0x00000000013A0000-0x00000000013A1000-memory.dmp

Download

memory/5672-115-0x0000000001480000-0x0000000001481000-memory.dmp

Download

memory/5712-61-0x0000000000400000-0x000000000042C000-memory.dmp

Download

memory/5884-32-0x0000000000490000-0x00000000005FB000-memory.dmp

Download

memory/5884-33-0x0000000000490000-0x00000000005FB000-memory.dmp

Download

memory/5884-55-0x0000000000490000-0x00000000005FB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads