677307f6d86fba2b1719e738fda58dbeb8edfc2fa4ec5ad6d29b835c2ae8dfd8

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 18:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
Size 9.6MB
Sample261107-xadn2azz7r
SHA256 677307f6d86fba2b1719e738fda58dbeb8edfc2fa4ec5ad6d29b835c2ae8dfd8
MD5 f76c1095c4f2dcc10dc09a82b19ffcfc
SHA1 534b8ae7519ac215577aa9339beb5d0c9a56203f
SHA512 385c4124c61b915821b5ccdf31353984cb227908eb06d3708442b7f266f7dc2ea277d4f589491110acccc79237e6d047c24c25e10e53a09f6439bb4c36217558
SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRnhRPhRRhR0hR+hRohRkhREhRq:L/kilMvKRLRhRZRbRIRaR0R4RYRq
TLSH
T1EAA6D02427EC8A6AD2EF977AF072051A0BF5E527721FEB4D9C8494FD2C4375588423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence upx

Malware Config

Signatures

Custom signature

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000200000001b213-6.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Custom signature

UPX dump on OEP (original entry point) 12 IoCs

resource	yara_rule
behavioral2/memory/3048-0-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/3048-1-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/files/0x000200000001b213-6.dat	UPX
behavioral2/memory/3048-440-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/3048-962-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/3048-1519-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/3048-2027-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/3048-2095-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/3048-2147-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/3048-2226-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/3048-2346-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX
behavioral2/memory/3048-2393-0x0000000000400000-0x00000000009C1000-memory.dmp	UPX

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tIkPZUg = "c:\\Windows\\System32\\tIkPZUg.exe"	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NpEkH = "c:\\Windows\\System32\\NpEkH.exe"	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\IRjMjQCE = "c:\\Windows\\System32\\IRjMjQCE.exe"	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	\??\c:\Windows\System32\IRjMjQCE.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	\??\c:\Windows\System32\tIkPZUg.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	\??\c:\Windows\System32\NpEkH.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3048-0-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/3048-1-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/files/0x000200000001b213-6.dat	upx
behavioral2/memory/3048-440-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/3048-962-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/3048-1519-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/3048-2027-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/3048-2095-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/3048-2147-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/3048-2226-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/3048-2346-0x0000000000400000-0x00000000009C1000-memory.dmp	upx
behavioral2/memory/3048-2393-0x0000000000400000-0x00000000009C1000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\unicode.md.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\NOTE.CFG.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\FORMS\1033\RESENDL.ICO.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\loc\AppXManifestLoc.16.en-us.xml.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\Mso98win32client.dll.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\libwaveout_plugin.dll.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Windows Defender\fr-FR\MpEvMsg.dll.mui.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\PREVIEW.GIF	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jfr.dll	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Subscription-ppd.xrm-ms	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ExcelInterProviderRanker.bin	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogoSmall.contrast-black_scale-80.png.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.IT.XML.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-console-l1-1-0.dll.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\SETLANG_COL.HXT.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-140.png.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_pt_BR.properties.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\pkcs11cryptotoken.md	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion.thmx	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteFreeR_Bypass-ul-oob.xrm-ms.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_Trial-ul-oob.xrm-ms.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ppd.xrm-ms	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-pl.xrm-ms.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProCO365R_SubTrial-pl.xrm-ms	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\relaxngdatatype.md	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\CT_ROOTS.XML.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.reportviewer.common.dll	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\ja\PresentationFramework.resources.dll	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\playlist\youtube.luac	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSOHEVI.DLL.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEES.DLL.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\fr\System.ServiceModel.Resources.dll	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\liblive555_plugin.dll.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONBttnPPT.dll	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OutlookAutoDiscover\YAHOO.FR.XML	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Inquire.dll.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.IdentityModel.Resources.dll.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\it\System.IdentityModel.Selectors.Resources.dll.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-pl.xrm-ms	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSO.FRAMEPROTOCOLWIN32.DLL	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\api-ms-win-core-localization-l1-2-0.dll.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\deploy\splash.gif	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-pl.xrm-ms	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-phn.xrm-ms.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_COL.HXC.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\msipc.dll.mui.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ONPPTAddin.dll.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Java\jdk-1.8\include\classfile_constants.h.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\api-ms-win-core-interlocked-l1-1-0.dll	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.AnalysisServices.Common.Wizard.dll.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Unlock.White.png.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_glass_100_f6f6f6_1x400.png	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Common Files\System\ado\fr-FR\msader15.dll.mui.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Internet Explorer\ExtExport.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\WATER.ELM.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinTree.v8.1.dll.exe	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\System.ServiceModel.Resources.dll	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
File created	C:\Program Files\Common Files\System\Ole DB\msxactps.dll	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe

C:\Users\Admin\AppData\Local\Temp\2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-06_f76c1095c4f2dcc10dc09a82b19ffcfc_glassworm_snatch.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
PID:3048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7-zip.dll

Path C:\Program Files\7-Zip\7-zip.dll
Size 10.2MB
SHA256 467ccb36d1b104a5f74908234bfae78dde74ba2a44c66a8ba54adeb0a51c013c
MD5 e2c1470dd07158cd9ccaebf132206dec
SHA1 38d061ebfec7ff5f7c49a8a7c35b09d5ae73afcd
SHA512 83507cd2b6df21755a8c34e84db5dbe92a015be01041f0ff219cb58e32acca26c0496a58234f3b5b6da2dd6aa99d49fcc95773b503dd064d7c737fbe82ad8cf0
SSDEEP 196608:k4JE6Tki//Nk/vnuhRBhRnhRPhRRhR0hR+hRohRkhREhRnhRj:L/kilMvKRLRhRZRbRIRaR0R4RYRhRj
TLSH
T1DAB6D02427EC8A6AD2EF977AF072051A0BF5E527721FEB4D9C8494FD2C4375588423A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3048-0-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3048-1-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3048-440-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3048-962-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3048-1519-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3048-2027-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3048-2095-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3048-2147-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3048-2226-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3048-2346-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

memory/3048-2393-0x0000000000400000-0x00000000009C1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads