5ed75058a425a6d1fc3b5a818aa0b26454eeda7eda1a76b1ad5a37bd010ef333

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 00:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
update.msi
Size 10KB
Sample261102-akebzsf19l
SHA256 5ed75058a425a6d1fc3b5a818aa0b26454eeda7eda1a76b1ad5a37bd010ef333
MD5 f3f7b3ea9955776edd0a9ddd604dc4f6
SHA1 8febc5a8b5676f87d7bcacc78642a8a7012a5d44
SHA512 eee74d3405c7d428f78e522d2054ade4cd4fdc44e36dd860e88d6bef9c6ffbab4580a537f8ad9f88a869447f58338bec968ab71058ae2b0ef46b92f92351838a
SSDEEP 192:xSAz4wvQCvL5bxyzEVS2MBBhEQiMsSwW0E8SA:xSAMQj5xyYMVBbJiJSwS8SA
TLSH
T18122D8867502C532D1406F304A660B9957367C809F8B161B3BFDB35C6FBA1E03A9E3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
12	5076	MsiExec.exe

Executes dropped EXE 1 IoCs

pid	Process
2288	TeamsUpdater.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
12	5076	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\knights\tseaullizill.txt	TeamsUpdater.exe
File opened for modification	C:\Program Files (x86)\SystemInformer\mueghoiamp.txt	TeamsUpdater.exe
File opened for modification	C:\Program Files (x86)\glittered\schneaduagh.txt	explorer.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5a5257.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9FBA55FF8A5DADC5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFDC1A2D28C91773CF.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC5C61A33B05BB4F4.TMP	msiexec.exe
File created	C:\Windows\Installer\e5a5257.msi	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4788	msiexec.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4472	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4472	cmd.exe
2096	PING.EXE

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027445be3350784180000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380127445be30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410127445be3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e327445be300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e627445be300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2096	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5712	schtasks.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6040	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4788	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4788	msiexec.exe
Token: SeSecurityPrivilege	5116	msiexec.exe
Token: SeCreateTokenPrivilege	4788	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4788	msiexec.exe
Token: SeLockMemoryPrivilege	4788	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4788	msiexec.exe
Token: SeMachineAccountPrivilege	4788	msiexec.exe
Token: SeTcbPrivilege	4788	msiexec.exe
Token: SeSecurityPrivilege	4788	msiexec.exe
Token: SeTakeOwnershipPrivilege	4788	msiexec.exe
Token: SeLoadDriverPrivilege	4788	msiexec.exe
Token: SeSystemProfilePrivilege	4788	msiexec.exe
Token: SeSystemtimePrivilege	4788	msiexec.exe
Token: SeProfSingleProcessPrivilege	4788	msiexec.exe
Token: SeIncBasePriorityPrivilege	4788	msiexec.exe
Token: SeCreatePagefilePrivilege	4788	msiexec.exe
Token: SeCreatePermanentPrivilege	4788	msiexec.exe
Token: SeBackupPrivilege	4788	msiexec.exe
Token: SeRestorePrivilege	4788	msiexec.exe
Token: SeShutdownPrivilege	4788	msiexec.exe
Token: SeDebugPrivilege	4788	msiexec.exe
Token: SeAuditPrivilege	4788	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4788	msiexec.exe
Token: SeChangeNotifyPrivilege	4788	msiexec.exe
Token: SeRemoteShutdownPrivilege	4788	msiexec.exe
Token: SeUndockPrivilege	4788	msiexec.exe
Token: SeSyncAgentPrivilege	4788	msiexec.exe
Token: SeEnableDelegationPrivilege	4788	msiexec.exe
Token: SeManageVolumePrivilege	4788	msiexec.exe
Token: SeImpersonatePrivilege	4788	msiexec.exe
Token: SeCreateGlobalPrivilege	4788	msiexec.exe
Token: SeBackupPrivilege	3500	vssvc.exe
Token: SeRestorePrivilege	3500	vssvc.exe
Token: SeAuditPrivilege	3500	vssvc.exe
Token: SeBackupPrivilege	5116	msiexec.exe
Token: SeRestorePrivilege	5116	msiexec.exe
Token: SeRestorePrivilege	5116	msiexec.exe
Token: SeTakeOwnershipPrivilege	5116	msiexec.exe
Token: SeBackupPrivilege	5484	srtasks.exe
Token: SeRestorePrivilege	5484	srtasks.exe
Token: SeSecurityPrivilege	5484	srtasks.exe
Token: SeTakeOwnershipPrivilege	5484	srtasks.exe
Token: SeShutdownPrivilege	6040	explorer.exe
Token: SeCreatePagefilePrivilege	6040	explorer.exe
Token: SeBackupPrivilege	5484	srtasks.exe
Token: SeRestorePrivilege	5484	srtasks.exe
Token: SeSecurityPrivilege	5484	srtasks.exe
Token: SeTakeOwnershipPrivilege	5484	srtasks.exe
Token: SeShutdownPrivilege	6040	explorer.exe
Token: SeCreatePagefilePrivilege	6040	explorer.exe
Token: SeShutdownPrivilege	6040	explorer.exe
Token: SeCreatePagefilePrivilege	6040	explorer.exe
Token: SeShutdownPrivilege	6040	explorer.exe
Token: SeCreatePagefilePrivilege	6040	explorer.exe
Token: SeShutdownPrivilege	6040	explorer.exe
Token: SeCreatePagefilePrivilege	6040	explorer.exe
Token: SeShutdownPrivilege	6040	explorer.exe
Token: SeCreatePagefilePrivilege	6040	explorer.exe
Token: SeShutdownPrivilege	6040	explorer.exe
Token: SeCreatePagefilePrivilege	6040	explorer.exe
Token: SeShutdownPrivilege	6040	explorer.exe
Token: SeCreatePagefilePrivilege	6040	explorer.exe
Token: SeShutdownPrivilege	6040	explorer.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4788	msiexec.exe
2288	TeamsUpdater.exe
4788	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4788	msiexec.exe
5116	msiexec.exe
5076	MsiExec.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 5484	5116	msiexec.exe	93
PID 5116 wrote to memory of 5076	5116	msiexec.exe	96
PID 5076 wrote to memory of 4472	5076	MsiExec.exe	98
PID 4472 wrote to memory of 2096	4472	cmd.exe	100
PID 5076 wrote to memory of 5712	5076	MsiExec.exe	101
PID 5076 wrote to memory of 4984	5076	MsiExec.exe	103
PID 5076 wrote to memory of 1112	5076	MsiExec.exe	106
PID 2288 wrote to memory of 6040	2288	TeamsUpdater.exe	81
PID 2288 wrote to memory of 6040	2288	TeamsUpdater.exe	81
PID 2288 wrote to memory of 6040	2288	TeamsUpdater.exe	81
PID 2288 wrote to memory of 6040	2288	TeamsUpdater.exe	81
PID 2288 wrote to memory of 6040	2288	TeamsUpdater.exe	81
PID 2288 wrote to memory of 6040	2288	TeamsUpdater.exe	81

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Drops file in Program Files directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:6040
- C:\Windows\system32\msiexec.exe
  msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\update.msi
  2⤵
  - Enumerates connected drives
  - Event Triggered Execution: Installer Packages
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4788

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5484
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 211DB1B272302F523969A2C5D23F494B
  2⤵
  - Downloads MZ/PE file
  - Badlisted process makes network request
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C PiNg -N 13 127.0.0.1
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:4472
  - - C:\Windows\SysWOW64\PING.EXE
      PiNg -N 13 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2096
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /CReate /tn eZjmAmcP /tr "\"C:\Users\Public\UPdATerad610D4\TeamsUpdater.exe\"" /sc once /st 00:01 /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5712
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /ruN /Tn eZjmAmcP
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4984
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /dELete /tN eZjmAmcP /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Users\Public\UPdATerad610D4\TeamsUpdater.exe
"C:\Users\Public\UPdATerad610D4\TeamsUpdater.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TeamsUpdater.exe

Path C:\Users\Public\UPdATerad610D4\TeamsUpdater.exe
Size 1.0MB
SHA256 fa923cefd550105b74fa277e70c7fa8b89c09704ff2c5b613cb67994da997e2a
MD5 ac5da157d4f8d1c8e8caac9741d54163
SHA1 86729ef662e534453fc864c88901dc7b2b732ad0
SHA512 f6f319a68be389dca61f6cb20e3cb8c4fcbda6081b64aea14d781a84a7d6555dddcc01ddf5d55c1c60a42a7821aa52769def8cc78d53f78587c37f5fc047653e
SSDEEP 12288:m0NL4/O9CfTzqkuYE62mFUWwxy1m2TVw2Z4e5Jed1SoIkilNcv8uHsgs1Ype3CpD:m0NLuOLBRWgcC2r092I7e1E8Cd
TLSH
T13335BDC1A3954EBBF0F680FC45715203A7E5781D0BE175EB438C7A291E2259E8AF9E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 593d29ef24e0d55785485c5d493904721b1742829e5387d6cd026fc3158edfb3
MD5 91c351dfc32d3b6d3c184f28675d8b37
SHA1 e064d2b512345fa7742398ced92663ad4a4128ac
SHA512 bda01b272f217902193aa4d60402de9c936108bd5b0a6e6ba1a92f7acbf47c2281575be9e120d3d8a3d3fca50da08c8e2214b35156ca30f30347abaad4d8228d
SSDEEP 24576:JFo3DMPddoO/vvTL/SAuOilQvru0VbJ90z48dDgm47AKJpvOMoR2uXUPKeE:BHk
TLSH
T1C557042532F92211E7F39F3CA8F46A2349397D5B9C15DE8D45411B8E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5b3380b0-7722-47b7-9402-0e673084b852}_OnDiskSnapshotProp

Path \??\Volume{e35b4427-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{5b3380b0-7722-47b7-9402-0e673084b852}_OnDiskSnapshotProp
Size 6KB
SHA256 c1fc6f3158fb7a45bae286e4fdb77be439049b56efc2a37ca5601ed8b830dbf0
MD5 14e59ca5abfc86e7cda94bb1c4f10b28
SHA1 8e17d58ba48bb27363d4b45665c75ab2b77f5211
SHA512 22dfbd2dca0faad4f09090f4243e50ae3e2fb4cfdbc01ad10952796ae283a056312c7a76c168394e6a98200ba3d76b6aa4223ba16b739acc26871d52ba2640fd
SSDEEP 96:FAhFkWvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:yhb++uVm
TLSH
T17BD188185AF54711E2B3AB3129F58557A477B811EF33CB8E0198238E2660A10F876F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/6040-33-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-29-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-11-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-10-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-14-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-31-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-35-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-40-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-39-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-38-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-37-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-36-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-34-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-43-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-44-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-15-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-13-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-28-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-30-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-27-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-45-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-23-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-46-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-18-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-19-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-16-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-26-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-24-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-22-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-20-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-17-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-12-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

memory/6040-9-0x0000000005550000-0x00000000055FD000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads