6af17514d3013cd6db47754d47ea15be722985ddc6ed57fc007bdbbc4c4aa23e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe
Size 46KB
Sample261012-ym7nbaee66
SHA256 6af17514d3013cd6db47754d47ea15be722985ddc6ed57fc007bdbbc4c4aa23e
MD5 e4a893e73fd7db888e3400970cafd345
SHA1 59841beafcb144c8f1c2888c5e625b584144089e
SHA512 9378d25e2dbafb96cc892ad33fc636259a68398e5bd01109d38a76912a2afadf9f115319db740ea6612d5036944f6dbf5865221ef96dfd5e2aba292535f2cf24
SSDEEP 768:BimZU2FwE247UC/yKzVJiXF9Xw09lPHmYRQHFTzYdPIBFByofgbb3IoB:BimZtIC/n3sA0bPGIQHxYdP8FBNfgn3L
TLSH
T1EA23D09867C219CFF4B3653CA4BB7F35EF985D6227520E09D911212B496E2F08E69B30
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

Executes dropped EXE 7 IoCs

pid	Process
4472	exp1orer.exe
1784	exp1orer.exe
5868	exp1orer.exe
6096	exp1orer.exe
3516	exp1orer.exe
5168	exp1orer.exe
716	exp1orer.exe

Drops file in System32 directory 45 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\exp1orer.exe	jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe
File created	C:\Windows\SysWOW64\$$336699.bat	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File created	C:\Windows\SysWOW64\inetapi32.dll	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exe	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe
File opened for modification	C:\Windows\SysWOW64\$$336699.bat	exp1orer.exe
File created	C:\Windows\SysWOW64\exp1orer.exeabc	exp1orer.exe

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4016-0-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/files/0x0008000000024618-4.dat	upx
behavioral1/memory/4016-10-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/4016-27-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/4472-29-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/4472-44-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/1784-47-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/1784-62-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/5868-64-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/5868-79-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/6096-81-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/6096-96-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/3516-97-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/3516-112-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/5168-114-0x0000000000400000-0x0000000000424000-memory.dmp	upx
behavioral1/memory/5168-129-0x0000000000400000-0x0000000000424000-memory.dmp	upx

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File opened for modification	C:\Windows\MFCD3O.DLL	exp1orer.exe
File created	C:\Windows\MFCD3O.DLL	exp1orer.exe

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5176	cmd.exe
948	cmd.exe
2240	cmd.exe
5652	cmd.exe
6000	cmd.exe
3476	cmd.exe
1272	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 16 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	exp1orer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	exp1orer.exe

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	exp1orer.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 4472	4016	jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe	101
PID 4016 wrote to memory of 5176	4016	jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe	102
PID 4472 wrote to memory of 1784	4472	exp1orer.exe	109
PID 4472 wrote to memory of 948	4472	exp1orer.exe	110
PID 1784 wrote to memory of 5868	1784	exp1orer.exe	113
PID 1784 wrote to memory of 2240	1784	exp1orer.exe	114
PID 5868 wrote to memory of 6096	5868	exp1orer.exe	118
PID 5868 wrote to memory of 5652	5868	exp1orer.exe	119
PID 6096 wrote to memory of 3516	6096	exp1orer.exe	121
PID 6096 wrote to memory of 6000	6096	exp1orer.exe	122
PID 3516 wrote to memory of 5168	3516	exp1orer.exe	126
PID 3516 wrote to memory of 3476	3516	exp1orer.exe	127
PID 5168 wrote to memory of 716	5168	exp1orer.exe	129
PID 5168 wrote to memory of 1272	5168	exp1orer.exe	130

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-GameThief.Win32.Lmir.gen.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\exp1orer.exe
  C:\Windows\system32\exp1orer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\exp1orer.exe
    C:\Windows\system32\exp1orer.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Windows directory
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\SysWOW64\exp1orer.exe
      C:\Windows\system32\exp1orer.exe
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Windows directory
      Reads the TCP/IP host and domain name from the registry
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5868
    - - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        5⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:6096
      - C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        6⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3516
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        7⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5168
        
        C:\Windows\SysWOW64\exp1orer.exe
        
        C:\Windows\system32\exp1orer.exe
        8⤵
        Executes dropped EXE
        Drops file in System32 directory
        Drops file in Windows directory
        Reads the TCP/IP host and domain name from the registry
        System Location Discovery: System Language Discovery
        
        PID:716
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        8⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:1272
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        7⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3476
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:6000
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:5652
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2240
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\SysWOW64\$$336699.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:948
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$336699.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

$$336699.bat

Path C:\Users\Admin\AppData\Local\Temp\$$336699.bat
Size 257B
SHA256 4d0fcf39a142702691fa0bea953fb97be429bdd31db61cbbb0c7e04f8ae545c1
MD5 d7503fc561aaf229d6cde7b2a38cc915
SHA1 f34e19df3670cfccc8d87f3491c0996c7cbd422f
SHA512 cf4e387a940808fb41b3e5688ce6a3eb4e1d8583d7b2ef5a7d9c93fd242e0cad381f16b0aaf69dcf5258d4cf3e36828d7237c29fa26ff46420b01599f1483158
TLSH
T1F1D05E8052978A6F4841D92B0AB85A8E8461195C3BCC3B334332C1DD16B165FFEC232A
MD5 SHA1 SHA512 TLSH

Submit Download

$$336699.bat

Path C:\Windows\SysWOW64\$$336699.bat
Size 141B
SHA256 78bc6789011bd5919846d8e73b8ed38f98db725ad4c2dc9c17b69b4b42002e9d
MD5 987ba00b6747c361e2b30b5e1f6d7299
SHA1 8fa61801da6fdeb3ed5823de3374fd642c395865
SHA512 0c5cb2251f3a3dd72b0314b35ecb7e6ecbc357bdb1283bf21595565526c3b4fac091becedc79387de2c438d05cb57dbafe14b32949015547832316ce53579f6e
TLSH
T1CAC092D0A07640C1F0A0B9094B0E1685D30BF2F3B048393320A902ADF86241A8FDAF8B
MD5 SHA1 SHA512 TLSH

Submit Download

exp1orer.exe

Path C:\Windows\SysWOW64\exp1orer.exe
Size 46KB
SHA256 6af17514d3013cd6db47754d47ea15be722985ddc6ed57fc007bdbbc4c4aa23e
MD5 e4a893e73fd7db888e3400970cafd345
SHA1 59841beafcb144c8f1c2888c5e625b584144089e
SHA512 9378d25e2dbafb96cc892ad33fc636259a68398e5bd01109d38a76912a2afadf9f115319db740ea6612d5036944f6dbf5865221ef96dfd5e2aba292535f2cf24
SSDEEP 768:BimZU2FwE247UC/yKzVJiXF9Xw09lPHmYRQHFTzYdPIBFByofgbb3IoB:BimZtIC/n3sA0bPGIQHxYdP8FBNfgn3L
TLSH
T1EA23D09867C219CFF4B3653CA4BB7F35EF985D6227520E09D911212B496E2F08E69B30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

inetapi32.dll

Path C:\Windows\SysWOW64\inetapi32.dll
Size 46KB
SHA256 b5b0bd9481049497d03bf61ebbd5978dca5a9df8486b295c487cfc3fded09c28
MD5 bb7c1068f8e8cbcae2877bd3e9559e6b
SHA1 bc694b25ee15d5250bc7bf461cfcbfd237022b0d
SHA512 73184996d1022b7e87911215156c24bb249c4d323fb131a35cd51a2ba1982d2c9cd13b128c6670b0fbc502305821b4f3ca00cc5193a99b05906c79f243500076
SSDEEP 768:+u1qWcSJvszmNj1w0SOAVcH3xu0fEVw5MLO1hykFZx6qjrRt4HHwTXz:V1qWcSJvsErJH3C2tgkx6+in6Xz
TLSH
T11F237C03A7E18431D4219AFC4D25E2B8EE3B3FB52CA81419AB610FDF58353A15C6972F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1784-62-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/1784-47-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3516-112-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/3516-97-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4016-27-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4016-0-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4016-10-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4472-44-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/4472-29-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5168-114-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5168-129-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5868-64-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/5868-79-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/6096-81-0x0000000000400000-0x0000000000424000-memory.dmp

Download

memory/6096-96-0x0000000000400000-0x0000000000424000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads