07e6f76d8cbde4fd0569b436b3e23314359b5ded173a6ba69ca46a4978335529

Analysis

max time kernel
149s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 10:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
Size 12.1MB
Sample261020-mgjhrayvb1
SHA256 07e6f76d8cbde4fd0569b436b3e23314359b5ded173a6ba69ca46a4978335529
MD5 b84b8d58c073c923b4620392c9e8f3fe
SHA1 722f63db4126cef7347d935e3afae60f9267439d
SHA512 2cb0573001cfa8e294160f593d30e650cc1e80eb170e8aa731f95d7051aa27765f7ab158f77719db619e2625a6950ae59bd79ac06e89ac6823c7d42a4cc2fcee
SSDEEP 393216:O3V10H2BgDy98POpILqlkXmxwTitsOBloK56apkt3vaG5:+V10H2BgDy98POpILqlkXmxwTitsFU
TLSH
T1F1D69C00B7E04626E47E53B884B3821D87B5FC26AB66E3CF579025AD2E72381DD3175B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\LTService\ImagePath = "\"C:\\Windows\\LTSvc\\LTSVC.exe\" -sLTService"	installutil.exe

Executes dropped EXE 1 IoCs

pid	Process
5920	LTSVC.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6	LTSVC.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8DFDF057024880D7A081AFBF6D26B92F	LTSVC.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\62B5AF9BE9ADC1085C3C56EC07A82BF6	LTSVC.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D266D9E1E69FA1EEFB9699B009B34C8_0A9BFDD75B598C2110CBF610C078E6E6	LTSVC.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8DFDF057024880D7A081AFBF6D26B92F	LTSVC.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7B8944BA8AD0EFDF0E01A43EF62BECD0_96A577BD0C99F3E5EAD306A7437C80A3	LTSVC.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_96A577BD0C99F3E5EAD306A7437C80A3	LTSVC.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\62B5AF9BE9ADC1085C3C56EC07A82BF6	LTSVC.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File created	C:\Windows\LTSvc\LTTray.exe	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\ICSharpCode.SharpZipLib.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\tvnserver.exe	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\LTSVC.exe	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\Interfaces.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\cpuidsdk64.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\nsoftware.IPWorks.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\nsoftware.IPWorksSSH.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\screenhooks.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\LTSVC.InstallState	installutil.exe
File created	C:\Windows\LTSvc\cad.exe	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\Interop.WODVPNCOMLib.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\nsoftware.IPWorksSSNMP.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\SCHook.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\screenhooks32.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\vnchooks.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\wodVPN64.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File opened for modification	C:\Windows\LTSvc\LTSVC.InstallLog	installutil.exe
File created	C:\Windows\LTSvc\labvnc.exe	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\nsoftware.System.dll	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File created	C:\Windows\LTSvc\PS.exe	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
File opened for modification	C:\Windows\LTsvc\LTErrors.txt	LTSVC.exe
File created	C:\Windows\LTsvc\noshadow	LTSVC.exe
File created	C:\Windows\LTSvc\LabTech.ico	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	LTSVC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	LTSVC.exe

Modifies data under HKEY_USERS 42 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	LTSVC.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	LTSVC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5920	LTSVC.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 3388	2424	2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-19_b84b8d58c073c923b4620392c9e8f3fe_amadey_coinminer_darkgate_elex_glassworm_mafia_njrat_rha.exe"
1⤵
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\installutil.exe
  "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\installutil.exe" /name=LTService /account=localsystem C:\Windows\LTSvc\LTSVC.exe
  2⤵
  - Sets service image path in registry
  - Drops file in Windows directory
  PID:3388

C:\Windows\LTSvc\LTSVC.exe
"C:\Windows\LTSvc\LTSVC.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7B8944BA8AD0EFDF0E01A43EF62BECD0_96A577BD0C99F3E5EAD306A7437C80A3

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7B8944BA8AD0EFDF0E01A43EF62BECD0_96A577BD0C99F3E5EAD306A7437C80A3
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

InstallLog.txt

Path C:\Users\Admin\AppData\Local\Temp\InstallLog.txt
Size 1KB
SHA256 ee3da3ea5c4d780050a3a10337747f7f24ae47cd9623b49110c3c3ebc6c93620
MD5 21769173982455b57dae2879e1ba57f1
SHA1 45acc20b8f9e30123581846aaa12aa44594f5220
SHA512 72edf00839d31c6eda485ffb6a4a3ca371a2b121a8cdffc91fb2cce70a94e2b65d00452906d3665e9e2df0da6659062212cff6c36e3350ad97c7028ee3a069f7
TLSH
T13E21B8D861CA86DF0791737D7A1D4E1163724D24122845BCB78D82906F2208E6AEDABB
MD5 SHA1 SHA512 TLSH

Submit Download

Interfaces.dll

Path C:\Windows\LTSvc\Interfaces.dll
Size 50KB
SHA256 b2ada6c042cb18e33beaadf7bb46ed71e44f460549fd2267ef03c29a2fe00ba7
MD5 2a14226de4124ae082378e620f59a56c
SHA1 3ae47099a9af70701257d460d4878f96457198b0
SHA512 8343859316f0f22388b0efde897e40759eb8bfe4c4c0ad7dfe8d5041e734d236e3fb4258f1a72c6b37d2c41f0e55bc5b576372897f5f0d6f68707586a25a62f9
SSDEEP 768:fOAY/QjEEzn8eoZCS1Qa5Rk1rIFBQbumg9K3VLLNAFe:m3/YvToZCiQa53QJ4EVLBf
TLSH
T14433198E9754953AC6DB477C58239A003BB0CB45B103A74B97A8B57FDDE3E8C43132A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LTSVC.InstallLog

Path C:\Windows\LTSvc\LTSVC.InstallLog
Size 622B
SHA256 20939988afe3ead0d605004ced365dd6c467cc9303f8d76185124202cc06e03a
MD5 8188d27e23bbdbee67be2b5126885e75
SHA1 9f22be482135eb0ed55375076026bfa898db2e35
SHA512 929b53c5172ef9659d794e0adf7d6561fd7ec022dcf86327515d91df292667ee237ce8d8618cb05a22f47e65107b35deebd3ddcebe2fc40d39bc79cd233f688b
TLSH
T11AF042060F9D01FA457026A73F479B00A366A14C2904305B73F6496CFDFA64F9764856
MD5 SHA1 SHA512 TLSH

Submit Download

LTSVC.exe

Path C:\Windows\LTSvc\LTSVC.exe
Size 1.3MB
SHA256 9764ed75cced1b39e7822c5ad821c2e4feaf3c43c059376941a2752885994b65
MD5 ab2c34ad4e777c8418e45cdf581573bc
SHA1 1fe45b51cf9b36f16c7f4c4d71221ae1ad547ce8
SHA512 f5344e36ac5c3ad3ba6fda71410cc47aa7b93235299645c216dfc3558dc5561b0eb40a904f6b1e319d805cb81721d7b2a3c1ae1a1931e0198f39a9508edd3768
SSDEEP 24576:IrPk2S+AVRMkrd7Eb+jIca9+66oNcVFEdDr7zyaV+weLFVBdHsk:IrP7S+zk57Eb+jI+7oNcVFEdD/zyaV+B
TLSH
T1F055D51467E80905E9BEBBF41832E2418672BDA69663D70F198024DD2F76F48CD31B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2424-22-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-19-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-12-0x000000001DBC0000-0x000000001DC5C000-memory.dmp

Download

memory/2424-13-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-14-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-15-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-16-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-17-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-18-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-2-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-21-0x00007FFEABE8A000-0x00007FFEABE8B000-memory.dmp

Download

memory/2424-0-0x00007FFEABE8A000-0x00007FFEABE8B000-memory.dmp

Download

memory/2424-5-0x000000001D460000-0x000000001D506000-memory.dmp

Download

memory/2424-151-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-4-0x000000001CEE0000-0x000000001D3AE000-memory.dmp

Download

memory/2424-6-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-1-0x000000001C2E0000-0x000000001C5F0000-memory.dmp

Download

memory/2424-72-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/2424-3-0x000000001C9F0000-0x000000001CA10000-memory.dmp

Download

memory/3388-65-0x000000001C510000-0x000000001C66A000-memory.dmp

Download

memory/3388-86-0x000000001E970000-0x000000001E994000-memory.dmp

Download

memory/3388-97-0x000000001C4F0000-0x000000001C504000-memory.dmp

Download

memory/3388-135-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/3388-66-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/3388-63-0x0000000000F30000-0x0000000000F48000-memory.dmp

Download

memory/5920-102-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

memory/5920-119-0x000000001B8C0000-0x000000001B90C000-memory.dmp

Download

memory/5920-138-0x000000001D920000-0x000000001DE30000-memory.dmp

Download

memory/5920-150-0x00007FFEABB90000-0x00007FFEAC5C8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads