2cdb46b353e4be0feb1819c27012a6ba92d28785856f201fed073f92fdd74696

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cyberpunk - S02E01.mkv
Size 383.7MB
Sample261030-e2xbcadc32
SHA256 2cdb46b353e4be0feb1819c27012a6ba92d28785856f201fed073f92fdd74696
MD5 2971bbecee0ad3d3f71d7638ba26ee29
SHA1 eaa549c629edaed9829dcc6366020b4e1b65c59e
SHA512 ced45bf872d463bf01d2a417d73fc680c1185d324e88bfbe4434e63f90f6696c2a6b7a60796a27984a1f18e95a89e52592b5e9f0012a7d574ec43e740f7f2d72
SSDEEP 6291456:183v1mpUVz3VrKBwczlH9QNvqPR5lkHgTrQ2qbzp4RuLm3+6MfDkJerA+M11IKhX:e1PVzlWBwczldflIwU2qbzp4R6mNJcKF
TLSH
T18B19332AC7E34485EC2617F0D1A06177932BCCD973061BEB9885F82F5DA173CAE99E50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\Y:	wmplayer.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmplayer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unregmp2.exe

Modifies registry class 44 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	vlc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{3255F4FF-493D-4211-B1DC-21CCF46B9E9B}	wmplayer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e8005398e082303024b98265d99428e115f0000	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	vlc.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1884	vlc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1884	vlc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2224	wmplayer.exe
Token: SeCreatePagefilePrivilege	2224	wmplayer.exe
Token: SeShutdownPrivilege	1720	unregmp2.exe
Token: SeCreatePagefilePrivilege	1720	unregmp2.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2224	wmplayer.exe
1884	vlc.exe
1884	vlc.exe
1884	vlc.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1884	vlc.exe
1884	vlc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1884	vlc.exe
1884	vlc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 2944	2224	wmplayer.exe	86
PID 2944 wrote to memory of 1720	2944	unregmp2.exe	87

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:6 /Open "C:\Users\Admin\AppData\Local\Temp\Cyberpunk - S02E01.mkv"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\SysWOW64\unregmp2.exe
  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\unregmp2.exe
    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
    3⤵
    - Enumerates connected drives
    - Suspicious use of AdjustPrivilegeToken
    PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:1092

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 896KB
SHA256 a1e9c52174c1fcaa1c19c7ff4824d1d55d779c7b2394a0e9bd4506b7fe2b9cba
MD5 d03791d5149fa3955f1db0a9c0edeadc
SHA1 8164422f8ced4b9b20ab8fe35c3e2536847b772a
SHA512 b8da6fa8a00de8c79737b05354eae9397452fa9696b19cab4b15074ef5efb85667a1c50912caf70a6766d12c286a803466e9a88628797d6d38220f94c734727a
SSDEEP 1536:5NpZZ9tbYlHtMPe2ra/p1Y4LL+GqEMioTaBacg:5NpL9t8zCa/5+60Tal
TLSH
T1AC1540379164A088CF3C35B1E5ED1F0DBE22A50A12E002465F74667FBA633CD9D1B5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CurrentDatabase_400.wmdb

Path C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb
Size 1024KB
SHA256 f09b524244e8f7710b7ab8711c1575b271a3af17cbd98d4a01d46deb801949e1
MD5 3049ad51bef14209b4bdfbfb10290899
SHA1 3aadca78d024bd0645245859cbd24967e9416e72
SHA512 784b08078c7f56cc44853314b69d989c2b73767368e9571b3f1fdfc978b0f1b57321248e752ae969058557d348496f938d25956a1f1568527b39d7fc8fd48fb8
SSDEEP 768:90aleDxcg7KGVp3zT13VuI61HOdrrA9abhr8fEwPRzitFrzAqUmNKX08oJImdbag:rZP2tFP3vqY8QqEMlTaBacg
TLSH
T10A258437D190B0C5CE2C7171E9ED8F09BA23B10B12A052465FF8957E7A633D99D0B1EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WMSDKNS.XML.bak

Path C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak
Size 9KB
SHA256 cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b
MD5 7050d5ae8acfbe560fa11073fef8185d
SHA1 5bc38e77ff06785fe0aec5a345c4ccd15752560e
SHA512 a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b
SSDEEP 96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRh+:/2FV0bBPCfUdY
TLSH
T10022A2A194818DD206290E275DB95C0DDA8CE9D3832C24997C9EEB7FDFB1C00355FB6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmsetup.log

Path C:\Users\Admin\AppData\Local\Temp\wmsetup.log
Size 1KB
SHA256 ea74d18375bfcdafc275b53334f65028fb2cf29b238496538912cf8061883aac
MD5 6f8c3a0740e87d35f8c8406172c7f0d4
SHA1 26f85d736e57f7bea8519f68fefe7a0000e981b8
SHA512 aad488868052e491f83615c572cb75493cf0a649801c724d045f7c237ac8167f32702d259c294c32a71d55edc8339e7f2529f69e7b64c59c5cf0592a83697706
TLSH
T15A216B571B8DE470C9E01BA71DEC8E257377C7CA83A0D0A5B34D9039480716D5B7E15D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1884-180-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-78-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-58-0x00007FF61A1D0000-0x00007FF61A2C8000-memory.dmp

Download

memory/1884-169-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-158-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-147-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-136-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-125-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-202-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-90-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-213-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-191-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-67-0x00007FFAFD190000-0x00007FFAFE240000-memory.dmp

Download

memory/1884-68-0x00007FFAFD120000-0x00007FFAFD187000-memory.dmp

Download

memory/1884-61-0x00007FFB11470000-0x00007FFB11488000-memory.dmp

Download

memory/1884-62-0x00007FFB0F090000-0x00007FFB0F0A7000-memory.dmp

Download

memory/1884-63-0x00007FFB0C630000-0x00007FFB0C641000-memory.dmp

Download

memory/1884-64-0x00007FFB0BC90000-0x00007FFB0BCA7000-memory.dmp

Download

memory/1884-60-0x00007FFB0A3D0000-0x00007FFB0A686000-memory.dmp

Download

memory/1884-65-0x00007FFB0B700000-0x00007FFB0B71D000-memory.dmp

Download

memory/1884-66-0x00007FFB0AC20000-0x00007FFB0AC31000-memory.dmp

Download

memory/1884-59-0x00007FFB0A940000-0x00007FFB0A974000-memory.dmp

Download

memory/2224-41-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-54-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-53-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-48-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-50-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-49-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-51-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-52-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-47-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-46-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/2224-45-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/2224-44-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-43-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-38-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-39-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-42-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-40-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-37-0x0000000007CF0000-0x0000000007D00000-memory.dmp

Download

memory/2224-35-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/2224-36-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/2224-32-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/2224-33-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/2224-31-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

memory/2224-34-0x0000000004FF0000-0x0000000005000000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads