mydoom | 9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119.exe
Size 40KB
Sample261002-glbe2szy8r
SHA256 9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119
MD5 5452e432ab059400c4a4ae349f3203e8
SHA1 0a1d73b4505de14e5edcd540338fb5d51e664704
SHA512 d9df4f0cff5f9c141162db8b3ad3d8950fc623f19f23d55187c6df1c918ddb62a56c50151bcfbb10278665920009c53d12e8537325bc0c1d323baaedc72f6525
SSDEEP 768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHeT:aqk/Zdic/qjh8w19JDHc
TLSH
T1D4136C73145095F7C58204701A81AA62AEB9EE771749D383F6D0AB5EECB84C76B3CF02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery mydoom persistence upx worm

Malware Config

Signatures

Family: MyDoom
MyDoom is a Worm that is written in C++.
worm mydoom

Detects MyDoom family 3 IoCs

resource	yara_rule
behavioral2/memory/3780-0-0x0000000000500000-0x000000000050D000-memory.dmp	family_mydoom
behavioral2/files/0x000d00000001c5b9-17.dat	family_mydoom
behavioral2/files/0x000f00000001c5ba-45.dat	family_mydoom

Executes a file named after a Windows system binary 1 TTPs 2 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\services.exe	java.exe
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\services.exe	services.exe

Executes dropped EXE 5 IoCs

pid	Process
5040	services.exe
2764	services.exe
404	java.exe
3460	services.exe
3760	services.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	java.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Local\\Temp\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Local\\Temp\\services.exe"	services.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\JavaVM = "C:\\Windows\\java.exe"	jaffacakes118_9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Windows\\services.exe"	services.exe

UPX packed file 20 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c5b5-5.dat	upx
behavioral2/memory/5040-6-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-31-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/2764-32-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-33-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3460-34-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/3760-37-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-79-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-92-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-102-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-108-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-115-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-131-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-145-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-164-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-168-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-177-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-184-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-222-0x0000000000400000-0x0000000000408000-memory.dmp	upx
behavioral2/memory/5040-235-0x0000000000400000-0x0000000000408000-memory.dmp	upx

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\java.exe	java.exe
File created	C:\Windows\services.exe	jaffacakes118_9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119.exe
File opened for modification	C:\Windows\java.exe	jaffacakes118_9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119.exe
File created	C:\Windows\java.exe	jaffacakes118_9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119.exe
File created	C:\Windows\services.exe	java.exe
File opened for modification	C:\Windows\java.exe	java.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	services.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	java.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	services.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	java.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	services.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 5040	3780	jaffacakes118_9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119.exe	89
PID 404 wrote to memory of 3460	404	java.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Windows\services.exe
  "C:\Windows\services.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:5040

C:\Windows\services.exe
C:\Windows\services.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:2764

C:\Windows\java.exe
C:\Windows\java.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:404
- C:\Users\Admin\AppData\Local\Temp\services.exe
  "C:\Users\Admin\AppData\Local\Temp\services.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:3460

C:\Users\Admin\AppData\Local\Temp\services.exe
C:\Users\Admin\AppData\Local\Temp\services.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

search[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V6IN4COU\search[1].htm
Size 25B
SHA256 6aa63394c1f5e705b1e89c55ff19eed71957e735c3831a845ff62f74824e13f1
MD5 8ba61a16b71609a08bfa35bc213fce49
SHA1 8374dddcc6b2ede14b0ea00a5870a11b57ced33f
SHA512 5855f5b2a78877f7a27ff92eaaa900d81d02486e6e2ea81d80b6f6cf1fe254350444980017e00cdeecdd3c67b86e7acc90cd2d77f06210bdd1d7b1a71d262df1
MD5 SHA1 SHA512

Submit Download

fzpbbeip.log

Path C:\Users\Admin\AppData\Local\Temp\fzpbbeip.log
Size 1KB
SHA256 3cda106f8ee707c6519a87e9695ceaa47db32991305f299cae319764f2ce211f
MD5 7123d48d26fc016f697753a4fd2e6ee8
SHA1 41ef2c4994aa720dbfda8215e5b8649078fda6c4
SHA512 9c295e4dde704e6196e1a0156d3e962da6aa99716be557bb6a11a7063c21abcbd684d4285c821c5a9e82e394f6c252b47e42c4c5fda598409a583158c4d0a29a
TLSH
T1CB21C68329B20AAC5D5216F5A7176ED387556743003A2FABE1F3C72269E481787C0B31
MD5 SHA1 SHA512 TLSH

Submit Download

tmp934E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp934E.tmp
Size 40KB
SHA256 a555e2bc1d0bfd90e267b6abb7257635f01d8cff8277fb5c0aa86354a0611f68
MD5 eadf59819c6d9bde784ae3ff826c4ff5
SHA1 f8add09d8f1052338a7f4d478e33d0dc5e0f9e3b
SHA512 ae68c8e5ad61e09df15f2f2c76d33b7883d513bcb74050b2cb6ef2b91b8ab8268b1e79fe55b09760e5802ba372021911f92f361f57bd653bf10f6ead0fb79b0a
SSDEEP 768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtH0L:aqk/Zdic/qjh8w19JDHS
TLSH
T12D136B73154095F7C58204706A81EA62AEB9AE771749D343F6D0AB5EECB84C76B3CF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 e5c5ac1529b2f490edc1c888e5185ddfc5a5e332e843c53a43582dfe80dd77d7
MD5 daa5c2ad136d54597ae6a381f4a5dc17
SHA1 282de48ba31740abc607568188f5418ab29d2342
SHA512 3c35e5b71ef1ff24ce853574175faafc157533db82abfb5e7cc4bfb6c0ee3b275c7efc10f3ad78275dc9fc44686e140d4f1dd151fb9c94b6bacbef123b36bbe5
TLSH
T1ED210DC328B205DC1D1615F4D2165EE34711A70340395F6AE5E3C71075E5817D7C0B31
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 56c13868489fd904c645b485feb8c966c55b39206adb155c8c4d61b050727e49
MD5 cc6b7f84d5458558cf5ece7d2b72b2ce
SHA1 a0f9ca4844bcbf8f4e6d2e5e17af707d5a2fd979
SHA512 2a562e2985f54bb84fe04a90390f66f6caa943b158862f84ddde2d07c39f369bee5dd29f4b3c81b040646b7e76226cb213ebe80de4c7dd7d5352bae22db86999
TLSH
T1AB21C68728F20A989E0616F8A6166ED38655B74340292E9AA0E3C6216AA481B97D0632
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 3157e805dd9b06b74c769a3756a3df78a2ca16b2e80591d3ad7a1957fab361be
MD5 2f1ed798c8bfeee809576842defb51a3
SHA1 322bc108854f2d9d08fcc7fb98777a77c1f5ce6b
SHA512 57e8382ea0d1bda3b56c1f805599d138986af75f3eab742eed9e37124f611dfb8cb47a080ce2389263cd76fc2c4da7b973776bf3960f361ffc99759e266b29f1
TLSH
T17121D78729B20A9C0E5655F4A7076ED38341A34300292F9EE0F3C72179E485797C1B32
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 c8487f99eb19849c2a65f944b9854bb718224804e37f058205247a50fc487d25
MD5 29a97e5f2d7e1a4d32f5e3258f51474d
SHA1 f044a49b0dd4d446c697e61a6e9b33e891f00f58
SHA512 bde3aa7daae912afe21d623cf5315b3e6aa36b612aeb9333205108f350ac8aad8d2dec07de76ea59af4c616ae439341a468eba0a3da5ee851bb454b9fe61c1b1
TLSH
T1C221DAC328B246AC6D5525F497075FD38711670340291B5AD1F3C71465E48474B80B31
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 e6b9039435ee703a7583acc3fc6e11699de63fa9713407df85438bbd7825f5c6
MD5 1987fdedc6ac0a240d98736af8521b5a
SHA1 6fa5485af7c10a7af4ddc6a4627b39b6259a84d4
SHA512 26793f1ffb21b960ca98ec59737543473790b8eb8ee09758a694fd23ee433c15a750509329859ae18b2bd1364b4eefee83bb8942e30557243cdf6f1fbc19d4d8
TLSH
T1C821DA811CF205DC4D5626F495132E9243D9E74380255FFAA5F39B1172F041787E1B35
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 32B
SHA256 4640910288b5321d2f1f05f62b258f412402ea9d0b93ba8c9102c1798d7d8cd1
MD5 7c4b171d339a15da6a521236d3099cdf
SHA1 a6e023436b95f5b929d4f96edb5c5bad81903cf8
SHA512 e58a76acf803609525895f591496c596284fa27701dd5fa07c635badd9287dc7b24d4b8291d71ea1c57b7770917293f81c304bddf0add1e2bccac61c5723bb7d
MD5 SHA1 SHA512

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 58a9ec9a75fdfeb360107866a641e70f81e4b70a9202a8121650b86ae0bc2577
MD5 2cae36b0da9c75b0addff8c0a0023407
SHA1 f7f4d96c0bf36b620b765585e867b68b1fd0cb2b
SHA512 852cbd8f7f89bf90cf15928f98a8bb3c96211a41e17237ee6bf94cb57118c259dfc3239dfc85a838801bb713c8b0e3cd6e54044c926cb440579bdbab27de1606
TLSH
T10D21FD8329B20BDC5E0215F0F617BFD382456743403A1E9AE0E3D72069E5C1B97C1631
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 4212eefc8e6c6f309affd631967d3a1d5586e0c90fc2cb895a1b50b7b8c77780
MD5 14a8ce61996312a7e2a975d32bd4625e
SHA1 1a1e51fb7c2297de6d857bdf97caab79b2fd1492
SHA512 a7f6c15b3115679a44feb02d0c4bbe1f3835ff4fd939bee8a1a7b51dc105b34f8373baa6b49203c31ba21084aeb21c3c02b64e3575fa1ba9c3b9ceff4dff45f2
TLSH
T1B121D78329B206AC1D5265F4E712AAD38255A30300392FABE5E3C710AAE089B87C1B31
MD5 SHA1 SHA512 TLSH

Submit Download

zincite.log

Path C:\Users\Admin\AppData\Local\Temp\zincite.log
Size 1KB
SHA256 14bb7d212cbcab208357d59a2f8b93c842b70d786998976b149318446d4c1c1e
MD5 1232378d7fb3ae732a22b7a9f5e0dd5c
SHA1 224efc9715604c618748dc6e1d6721b3d847d7a3
SHA512 bb750e91e66fa8d66203ae9daa13aee8ce4b99225bac5f1664a5d7447b46d5edfe1828d478a9dcc72fb2b212589a3b89d56df266462ed3fd8697caae72f6862c
TLSH
T1F521C68728B60BAC5E0615F5A6136ED38255A74340292E9AA1F3D220B9E485B9780731
MD5 SHA1 SHA512 TLSH

Submit Download

java.exe

Path C:\Windows\java.exe
Size 40KB
SHA256 9aca55bb6729452ec0313e3a0f72c4f2b2e5651bf07caf74589eb225cb31a119
MD5 5452e432ab059400c4a4ae349f3203e8
SHA1 0a1d73b4505de14e5edcd540338fb5d51e664704
SHA512 d9df4f0cff5f9c141162db8b3ad3d8950fc623f19f23d55187c6df1c918ddb62a56c50151bcfbb10278665920009c53d12e8537325bc0c1d323baaedc72f6525
SSDEEP 768:aq9m/ZsybSg2ts4L3RLc/qjhsKmHbk1+qJ0UtHeT:aqk/Zdic/qjh8w19JDHc
TLSH
T1D4136C73145095F7C58204701A81AA62AEB9EE771749D383F6D0AB5EECB84C76B3CF02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

services.exe

Path C:\Windows\services.exe
Size 8KB
SHA256 bf316f51d0c345d61eaee3940791b64e81f676e3bca42bad61073227bee6653c
MD5 b0fe74719b1b647e2056641931907f4a
SHA1 e858c206d2d1542a79936cb00d85da853bfc95e2
SHA512 9c82e88264696d0dadef9c0442ad8d1183e48f0fb355a4fc9bf4fa5db4e27745039f98b1fd1febff620a5ded6dd493227f00d7d2e74b19757685aa8655f921c2
SSDEEP 192:tZWNqWKIzebvOZnzCj6juhEJS3/Uf/tpfmG62X9f3:tZ6qWTYvczfahX/UHtF6e9f3
TLSH
T1BCF18DF4352C375AD079333FD313D005A26CB82005EF8B26FD890BBBFA66168551AE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2764-32-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3460-34-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3760-37-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/3780-0-0x0000000000500000-0x000000000050D000-memory.dmp

Download

memory/5040-92-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-79-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-102-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-108-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-115-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-6-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-131-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-33-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-145-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-164-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-168-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-177-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-184-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-31-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-222-0x0000000000400000-0x0000000000408000-memory.dmp

Download

memory/5040-235-0x0000000000400000-0x0000000000408000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads