a789f0babf83c806bebc70353be9bd6448768fcdeff2e3f4fda53e5c5593e3ef

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
avira_spotlight_setup.exe
Size 37.1MB
Sample261104-wtke9aev5r
SHA256 a789f0babf83c806bebc70353be9bd6448768fcdeff2e3f4fda53e5c5593e3ef
MD5 aaf6b9b972363703b320facd4c8edfcd
SHA1 1c50c2181ab63a70dbc3b9f0d0a3e6726e827a56
SHA512 96434631a9af58e6624f4bf731147f9b3cdb98bab963587581496ab7cd4f0d50511148dd29fd69cf8ddd18385b711dd407ca4b414f8ab3f3f6f2b3d72c5a459d
SSDEEP 786432:4kIVlt7+I/J6NKpk+M//1ZrA8l3TUEmepd7cU41h2SNBcudvM:4kEll+I/J2axM//AkcepdBw8SNCuK
TLSH
T1C18733D3718B273BE56E4E364E7FDA12493B6E21741E88A646E4301BDE340953E3F246
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery installer

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 3 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe

Executes dropped EXE 1 IoCs

pid	Process
4612	avira_spotlight_setup.tmp

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avira_spotlight_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avira_spotlight_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe

Inno Setup is an open-source installation builder for Windows applications. 2 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2000-0-0x0000000001000000-0x00000000010FA000-memory.dmp	innosetup
behavioral2/memory/2000-34-0x0000000001000000-0x00000000010FA000-memory.dmp	innosetup

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 4612	2000	avira_spotlight_setup.exe	90
PID 4612 wrote to memory of 1512	4612	avira_spotlight_setup.tmp	91
PID 4612 wrote to memory of 2652	4612	avira_spotlight_setup.tmp	93
PID 4612 wrote to memory of 5848	4612	avira_spotlight_setup.tmp	95
PID 4612 wrote to memory of 1412	4612	avira_spotlight_setup.tmp	97
PID 4612 wrote to memory of 5028	4612	avira_spotlight_setup.tmp	99
PID 4612 wrote to memory of 4552	4612	avira_spotlight_setup.tmp	101
PID 4612 wrote to memory of 4176	4612	avira_spotlight_setup.tmp	103
PID 4612 wrote to memory of 2968	4612	avira_spotlight_setup.tmp	105
PID 4612 wrote to memory of 248	4612	avira_spotlight_setup.tmp	107
PID 4612 wrote to memory of 6056	4612	avira_spotlight_setup.tmp	109
PID 4612 wrote to memory of 4788	4612	avira_spotlight_setup.tmp	111
PID 4612 wrote to memory of 4660	4612	avira_spotlight_setup.tmp	113
PID 4612 wrote to memory of 2108	4612	avira_spotlight_setup.tmp	115

C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup.exe
"C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Users\Admin\AppData\Local\Temp\is-GLTAK.tmp\avira_spotlight_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GLTAK.tmp\avira_spotlight_setup.tmp" /SL5="$400A8,37785537,960512,C:\Users\Admin\AppData\Local\Temp\avira_spotlight_setup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "AuthRoot" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\AddTrust_External_CA_Root_2000.cer"
    3⤵
    - Manipulates Digital Signatures
    - System Location Discovery: System Language Discovery
    PID:1512
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\DigiCert_Assured_ID_Root_CA_2006.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\DigiCert_Global_Root_CA_2006.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5848
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\DigiCert_Trusted_Root_G4_2013.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1412
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "AuthRoot" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\Entrust.net_Certification_Authority_(2048)_1999.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5028
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\GlobalSign_2009.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4552
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\GlobalSign_2014.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4176
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\Microsoft_Identity_Verification_Root_Certificate_Authority_2020.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2968
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\Microsoft_Root_Certificate_Authority_2001.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:248
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\Microsoft_Root_Certificate_Authority_2010.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6056
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\Microsoft_Root_Certificate_Authority_2011.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4788
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "AuthRoot" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\USERTrust_RSA_Certification_Authority_2010.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4660
- - C:\Windows\SysWOW64\certutil.exe
    "C:\Windows\system32\certutil.exe" -addstore "Root" "C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\VeriSign_Universal_Root_Certification_Authority_2008.cer"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AddTrust_External_CA_Root_2000.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\AddTrust_External_CA_Root_2000.cer
Size 1KB
SHA256 687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2
MD5 1d3554048578b03f42424dbf20730a3f
SHA1 02faf3e291435468607857694df5e45b68851868
SHA512 49dd7cce6f711ec3adff4608bad3afce9a85f7279e3fe1b5d8a87c6534a79090bd3cc897b57fd310cd7aef902b260d585fea1d3901526c874f935a3b990bf0dc
TLSH
T1201112370E5C28487ED07EC4D6D2FA361D3157DAA295786E531C873613ABB64342804F
MD5 SHA1 SHA512 TLSH

Submit Download

DigiCert_Assured_ID_Root_CA_2006.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\DigiCert_Assured_ID_Root_CA_2006.cer
Size 955B
SHA256 3e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c
MD5 87ce0b7b2a0e4900e158719b37a89372
SHA1 0563b8630d62d75abbc8ab1e4bdfb5a899b24d43
SHA512 552cbdfbe33421b682ab9e42cafe274e9d6f55eb971d18d0ab9e68d1e6fb715b0580efecf84198a61a458d9f7656f4e485f2b2643d575f17269d613b95063407
TLSH
T14D1194B9DA92AC20DFDA885DB014DE2A3DBA3709F7F440B71374C49093833056998449
MD5 SHA1 SHA512 TLSH

Submit Download

DigiCert_Global_Root_CA_2006.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\DigiCert_Global_Root_CA_2006.cer
Size 947B
SHA256 4348a0e9444c78cb265e058d5e8944b4d84f9662bd26db257f8934a443c70161
MD5 79e4a9840d7d3a96d7c04fe2434c892e
SHA1 a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c5436
SHA512 53b444e565183201a61eeb461209b2dc30895eeca487238d15a026735f229a819e5b19cbd7e2fa2768ab2a64f6ebcd9d1e721341c9ed5dd09fc0d5e43d68bca7
TLSH
T1F01188C845351D89DF55CD663640F6593C767301E7DA85FB37E9D05153A135022CC0DD
MD5 SHA1 SHA512 TLSH

Submit Download

DigiCert_Trusted_Root_G4_2013.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\DigiCert_Trusted_Root_G4_2013.cer
Size 1KB
SHA256 552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988
MD5 78f2fcaa601f2fb4ebc937ba532e7549
SHA1 ddfb16cd4931c973a2037d3fc83a4d7d775d05e4
SHA512 bcad73a7a5afb7120549dd54ba1f15c551ae24c7181f008392065d1ed006e6fa4fa5a60538d52461b15a12f5292049e929cffde15cc400dec9cdfca0b36a68dd
TLSH
T14421C64312603C088B17DCFFB915C9BA65BA7D96AC22C870424ED9D017B97CF54AE06C
MD5 SHA1 SHA512 TLSH

Submit Download

Entrust.net_Certification_Authority_(2048)_1999.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\Entrust.net_Certification_Authority_(2048)_1999.cer
Size 1KB
SHA256 6dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb177
MD5 ee2931bc327e9ae6e8b5f751b4347190
SHA1 503006091d97d4f5ae39f7cbe7927d7d652d3431
SHA512 ef7d8771b6c847a73556d612ad23e019c8bbabd5c9887884940b9a6a4532532c32eec9b56c1bbf44cb97a96a9d780b54b54801d1f5690a6fd528caa99dc49f54
TLSH
T17A11796C27605F601EEF54570D37D3857D389471B29384B620164D319B1B7B27450E58
MD5 SHA1 SHA512 TLSH

Submit Download

GlobalSign_2009.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\GlobalSign_2009.cer
Size 867B
SHA256 cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b
MD5 c5dfb849ca051355ee2dba1ac33eb028
SHA1 d69b561148f01c77c54578c10926df5b856976ad
SHA512 88289cdd2c2dd1f5f4c13ab2cf9bc601fc634b5945309bedf9fc5b96bf21697b4cd6da2f383497825e02272816befbac4f44955282ffbbd4dd0ddc52281082da
TLSH
T1D411125B0B7F59539B51FC4F954DA9433F7972C485FF1916A03285A670213C6D61A03C
MD5 SHA1 SHA512 TLSH

Submit Download

GlobalSign_2014.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\GlobalSign_2014.cer
Size 1KB
SHA256 2cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf69
MD5 4fdd07e4d42264391e0c3742ead1c6ae
SHA1 8094640eb5a7a1ca119c1fddd59f810263a7fbd1
SHA512 626261dcc0001d3bf73f9bd041067c78cbd19337c9dfcb2fb0854f24015efa662a7441dc5389de7c1ca4f464b44bf99b6df710661a9a8902ad907ee231dba74a
TLSH
T1C12174AB62FE92469EA9DDD7AA46E0337C7C39D0CCCF480F211396681D063561968D2D
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Identity_Verification_Root_Certificate_Authority_2020.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\Microsoft_Identity_Verification_Root_Certificate_Authority_2020.cer
Size 1KB
SHA256 5367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270
MD5 be954f16012122448ca8bc279602acf5
SHA1 f40042e2e5f7e8ef8189fed15519aece42c3bfa2
SHA512 b617f4c211c33da258561c99812252fc9fa0446294680e3cd39689b1b4ba522b5bd3c03925582cb119fc4dff7cf0ed863832dc325d640bee759fea3da2118e09
TLSH
T10C31C9BA0F7060067FC2EA9591D5D4D2B33D7767D8590356309BD3E22593394436949C
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Root_Certificate_Authority_2001.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\Microsoft_Root_Certificate_Authority_2001.cer
Size 1KB
SHA256 885de64c340e3ea70658f01e1145f957fcda27aabeea1ab9faa9fdb0102d4077
MD5 e1c07ea0aabbd4b77b84c228117808a7
SHA1 cdd4eeae6000ac7f40c3802c171e30148030c072
SHA512 acb2da72502053e097f23bfe3af150018a57dab0ff286c36ed6216d21a4de1f81572c40cc1c2673370bbb102321d37276b033bddc191e607e91fe80df3f5e08e
TLSH
T18B21BB4D9FA8A5716A827E64040FB8E15F70D54BBC62C65BF3BBA489D011B31D474016
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Root_Certificate_Authority_2010.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\Microsoft_Root_Certificate_Authority_2010.cer
Size 1KB
SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
MD5 a266bb7dcc38a562631361bbf61dd11b
SHA1 3b1efd3a66ea28b16697394703a72ca340a05bd5
SHA512 0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
TLSH
T13831DA504B3AF2877F41E5C44798F996D87C369308191E124BF5D0D594E7FA5DB0182C
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft_Root_Certificate_Authority_2011.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\Microsoft_Root_Certificate_Authority_2011.cer
Size 1KB
SHA256 847df6a78497943f27fc72eb93f9a637320a02b561d0a91b09e87a7807ed7c61
MD5 ce0490d5e56c34a5ae0be98be581185d
SHA1 8f43288ad272f3103b6fb1428485ea3014c0bcfe
SHA512 2ebfc4c17e241a665f558bccb038a5fb10a73e05db552a31e3f0eae48a93c9617d2a4968f79da677dcbcdb1d7a140be9848aaba26161948d7db44b4eabbb0763
TLSH
T10531B55441ACB883ED446982474C96CF693ED2E20101062E5867EBE624B1FD0DE3852A
MD5 SHA1 SHA512 TLSH

Submit Download

USERTrust_RSA_Certification_Authority_2010.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\USERTrust_RSA_Certification_Authority_2010.cer
Size 1KB
SHA256 e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd2
MD5 1bfe69d191b71933a372a80fe155e5b5
SHA1 2b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e
SHA512 57e318d9ab26720f02ec18ba09cb640ace23554d2fe146d285bcc43c4d9601127fbe3dd9171cdafec70e075cf9412e8d1ac63ae0f982cf8825528659952a47bd
TLSH
T1DE31B7910D0A3680EFE272104BF5F597BD7132129BE5D1A71F6DEBE02CA13257A1605A
MD5 SHA1 SHA512 TLSH

Submit Download

VeriSign_Universal_Root_Certification_Authority_2008.cer

Path C:\Users\Admin\AppData\Local\Temp\is-EDUQ7.tmp\VeriSign_Universal_Root_Certification_Authority_2008.cer
Size 1KB
SHA256 2399561127a57125de8cefea610ddf2fa078b5c8067f4e828290bfb860e84b3c
MD5 8eadb501aa4d81e48c1dd1e114009519
SHA1 3679ca35668772304d30a5fb873b0fa77bb70d54
SHA512 7d53c0f0c95cb9126592201f67c66c987c3fa3d6e7dca5038f6eeb766aede597af975eb734853ec38ef1052dae1fea06bc3e9d8a03cacc0e46bb70614b475d91
TLSH
T1432102834E242C22FAC45E04B256D1279E38733D69D96781A5B084DBBE43F781B0E11E
MD5 SHA1 SHA512 TLSH

Submit Download

avira_spotlight_setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-GLTAK.tmp\avira_spotlight_setup.tmp
Size 3.5MB
SHA256 bcb9b8ebb4851cd6285f89505cac66dc40a19fd955eed1cb55a5d49337dd8c67
MD5 b3c03ebceecc76bf684f09a432bcda45
SHA1 defe86af1bf849b3ea9f2f77779dac52e215de60
SHA512 1c90256f33203372216130f2aa86bc469bf18dce5a22b203199a629e82965c9769e181ccb02b843a1156f61fdcf2877d53c2be278c1efcacab55cf532017053e
SSDEEP 49152:1WwGHAkqMu7ot6SCiGoghuXs7+KXrmeSVrJuh52gu85333UK:19GdkJuXbeSVQdue333v
TLSH
T188063AD3F24D673AD05E2E395E3F92A0983B6E60391E8C1766EC394F4E355803E26746
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2000-34-0x0000000001000000-0x00000000010FA000-memory.dmp

Download

memory/2000-0-0x0000000001000000-0x00000000010FA000-memory.dmp

Download

memory/4612-46-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-50-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-35-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-38-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-40-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-42-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-36-0x0000000003700000-0x0000000003701000-memory.dmp

Download

memory/4612-44-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-48-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-6-0x0000000003700000-0x0000000003701000-memory.dmp

Download

memory/4612-52-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-54-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-56-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-58-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-60-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

memory/4612-62-0x00000000003A0000-0x0000000000726000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads