47530aea0d262967bc5ea92e4faeb18caafd66412cdf98af15267a405825afa4

Analysis

max time kernel
900s
max time network
896s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
arbuz.exe
Size 579KB
Sample261001-sd31watalc
SHA256 47530aea0d262967bc5ea92e4faeb18caafd66412cdf98af15267a405825afa4
MD5 cd96558fe42ce93e53d3cf0c5b0f644a
SHA1 d416d6947919af1ced055c99545c203e628d598a
SHA512 98848303feffb03b8a7eca864919d48bbb7038e8daf9024b143a9ebf16a18fdf428e7c237f3bfac538af769542284b083c88f829fa0fff3e374f5aa916bd907d
SSDEEP 6144:mJ64jCVZLUyHH30SSoFEx8d0GHucTMXXD4SDB2ohu/RJXw/hLlhd01nEIbdR25wr:m1CVGyHXPFEqbQ3B2o0xILd0VEllZvs
TLSH
T1EAC42A183FA58A08E540197E455E1618DBAEE1F226327343370AEF224D45DDEDF2D3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\xdwdSystem32\\Defender.exe"	arbuz.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\Control Panel\International\Geo\Nation	arbuz.exe

Executes dropped EXE 18 IoCs

pid	Process
4628	Defender.exe
2880	MalwareDef.exe
1688	Defender.exe
2144	Defender.exe
4004	Defender.exe
2552	Defender.exe
872	Defender.exe
4960	Defender.exe
4056	Defender.exe
3492	Defender.exe
3532	Defender.exe
4120	Defender.exe
2848	Defender.exe
2996	Defender.exe
1260	Defender.exe
3972	Defender.exe
1184	Defender.exe
1208	Defender.exe

Loads dropped DLL 27 IoCs

pid	Process
4628	Defender.exe
3556	Process not Found
1252	Process not Found
4084	Process not Found
2880	MalwareDef.exe
1688	Defender.exe
848	Process not Found
3456	Process not Found
820	Process not Found
2144	Defender.exe
3688	Process not Found
2364	Process not Found
4004	Defender.exe
2552	Defender.exe
872	Defender.exe
4960	Defender.exe
4056	Defender.exe
3492	Defender.exe
3244	Process not Found
3532	Defender.exe
4120	Defender.exe
2848	Defender.exe
2996	Defender.exe
1260	Defender.exe
3972	Defender.exe
1184	Defender.exe
1208	Defender.exe

Looks up external IP address via web service 1 TTPs 25 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
23	api.ipify.org
24	api.ipify.org
35	api.ipify.org
74	api.ipify.org
85	api.ipify.org
93	api.ipify.org
97	api.ipify.org
27	api.ipify.org
71	api.ipify.org
82	api.ipify.org
90	api.ipify.org
91	api.ipify.org
94	api.ipify.org
26	api.ipify.org
72	api.ipify.org
83	api.ipify.org
88	api.ipify.org
89	api.ipify.org
25	api.ipify.org
70	api.ipify.org
73	api.ipify.org
75	api.ipify.org
92	api.ipify.org
95	api.ipify.org
96	api.ipify.org

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\xdwdSystem32\Defender.exe	arbuz.exe
File created	C:\Windows\xdwdWeb\MalwareDef.exe	arbuz.exe
File created	C:\Windows\xdwd.dll	arbuz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3240	cmd.exe
2320	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 38 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MalwareDef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	arbuz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	arbuz.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Defender.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3852	schtasks.exe
3744	schtasks.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	arbuz.exe
Token: SeDebugPrivilege	4628	Defender.exe
Token: SeDebugPrivilege	1688	Defender.exe
Token: SeDebugPrivilege	2880	MalwareDef.exe
Token: SeIncBasePriorityPrivilege	4628	Defender.exe
Token: SeIncBasePriorityPrivilege	1688	Defender.exe
Token: SeDebugPrivilege	2144	Defender.exe
Token: SeDebugPrivilege	4004	Defender.exe
Token: SeDebugPrivilege	2552	Defender.exe
Token: SeDebugPrivilege	872	Defender.exe
Token: SeDebugPrivilege	4960	Defender.exe
Token: SeDebugPrivilege	4056	Defender.exe
Token: SeDebugPrivilege	3492	Defender.exe
Token: SeDebugPrivilege	3532	Defender.exe
Token: SeDebugPrivilege	4120	Defender.exe
Token: SeDebugPrivilege	2848	Defender.exe
Token: SeDebugPrivilege	2996	Defender.exe
Token: SeDebugPrivilege	1260	Defender.exe
Token: SeDebugPrivilege	3972	Defender.exe
Token: SeDebugPrivilege	1184	Defender.exe
Token: SeDebugPrivilege	1208	Defender.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 1956	4460	arbuz.exe	92
PID 4460 wrote to memory of 3240	4460	arbuz.exe	94
PID 4460 wrote to memory of 2320	4460	arbuz.exe	96
PID 2320 wrote to memory of 3852	2320	cmd.exe	98
PID 3240 wrote to memory of 3744	3240	cmd.exe	99
PID 4460 wrote to memory of 4628	4460	arbuz.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\arbuz.exe
"C:\Users\Admin\AppData\Local\Temp\arbuz.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" netsh advfirewall firewall add rule name="k":E-sn)-:v`-]" dir=in action=allow program="C:\Windows\xdwdSystem32\Defender.exe" enable=yes & exit
  2⤵
  PID:1956
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\xdwdSystem32\Defender.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Windows\xdwdSystem32\Defender.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3744
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\xdwdWeb\MalwareDef.exe" /RL HIGHEST & exit
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Windows\xdwdWeb\MalwareDef.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3852
- C:\Windows\xdwdSystem32\Defender.exe
  "C:\Windows\xdwdSystem32\Defender.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  PID:4628

C:\Windows\xdwdWeb\MalwareDef.exe
C:\Windows\xdwdWeb\MalwareDef.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2880

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1688

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2144

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4004

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2552

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:872

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4960

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3492

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:4120

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2848

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:2996

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1260

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:3972

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1184

C:\Windows\xdwdSystem32\Defender.exe
C:\Windows\xdwdSystem32\Defender.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Defender.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Defender.exe.log
Size 1KB
SHA256 d049789c187b2f58c900eab10205bc037740dca8640ab40c314790fefaab66ff
MD5 f26118d675c61402c218ac6794d90a63
SHA1 ffc8d592f3ca8255ca5119eff5b576eb16ac7fac
SHA512 6f14b71dae095131053a1b590e60ccec4e14c47c745bf9d52de48988d7b93b1f50bbb6bac0222dc49e3e45def052b20be2d34e116991027718da2e0fb8eb45d0
TLSH
T17411CE723371F1D889163F072C68268417BF4724BA90EE0CB5A8626ED9364275F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

xdwd.dll

Path C:\Windows\xdwd.dll
Size 136KB
SHA256 35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66
MD5 16e5a492c9c6ae34c59683be9c51fa31
SHA1 97031b41f5c56f371c28ae0d62a2df7d585adaba
SHA512 20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6
SSDEEP 3072:t0iX+jLyDcqaH9a6DFHo6MjD7VbZaZaZ8Xwlk4MHWZpt:t07yDSvdoRj2up
TLSH
T151D35B0772A500BFE1668638C5630A09E777B8211770DBAF33A4429D9F277E19D3AF61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Defender.exe

Path C:\Windows\xdwdSystem32\Defender.exe
Size 579KB
SHA256 47530aea0d262967bc5ea92e4faeb18caafd66412cdf98af15267a405825afa4
MD5 cd96558fe42ce93e53d3cf0c5b0f644a
SHA1 d416d6947919af1ced055c99545c203e628d598a
SHA512 98848303feffb03b8a7eca864919d48bbb7038e8daf9024b143a9ebf16a18fdf428e7c237f3bfac538af769542284b083c88f829fa0fff3e374f5aa916bd907d
SSDEEP 6144:mJ64jCVZLUyHH30SSoFEx8d0GHucTMXXD4SDB2ohu/RJXw/hLlhd01nEIbdR25wr:m1CVGyHXPFEqbQ3B2o0xILd0VEllZvs
TLSH
T1EAC42A183FA58A08E540197E455E1618DBAEE1F226327343370AEF224D45DDEDF2D3EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1688-33-0x00000226D88D0000-0x00000226D8A79000-memory.dmp

Download

memory/1688-38-0x00000226D88D0000-0x00000226D8A79000-memory.dmp

Download

memory/4460-0-0x000002AAE8310000-0x000002AAE83A2000-memory.dmp

Download

memory/4460-1-0x000002AAEB4E0000-0x000002AAEB4F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads