9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b

Analysis

max time kernel
150s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
01-07-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
Size

2.6MB
MD5

c7c411d41a330167ac7abaa2137b4c53
SHA1

3e62689f23ae159b6cf3547fbaaffd425444a653
SHA256

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b
SHA512

61a3cf287a61526ca8381cf693b0b3ba6dc8478b0c77f24776eab07244e1b13976688efb3f744cfa64020fcda9e7ea0165679eb97015330cc31e8804346a03a1
SSDEEP

49152:+XzhpDtKSK1cb8PGK+Tfuqmpc3elWo8GnQAsYZEVX:+XzhW148Pd+Tf1mpcOldJQ3/VX

Score

10^/10

evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Detects executables packed with Themida 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1784-0-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
\??\c:\windows\resources\themes\explorer.exe	INDICATOR_EXE_Packed_Themida
behavioral2/memory/920-10-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
C:\Windows\Resources\spoolsv.exe	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1732-19-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
\??\c:\windows\resources\svchost.exe	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1388-28-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2268-33-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/2268-41-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1784-40-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1732-39-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/920-42-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1388-43-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/920-52-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/920-60-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida
behavioral2/memory/1388-65-0x0000000000400000-0x0000000000A16000-memory.dmp	INDICATOR_EXE_Packed_Themida

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exespoolsv.exesvchost.exespoolsv.exeexplorer.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

920 explorer.exe
1732 spoolsv.exe
1388 svchost.exe
2268 spoolsv.exe

pid	process
920	explorer.exe
1732	spoolsv.exe
1388	svchost.exe
2268	spoolsv.exe

Themida packer 16 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral2/memory/1784-0-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
\??\c:\windows\resources\themes\explorer.exe	themida
behavioral2/memory/920-10-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
C:\Windows\Resources\spoolsv.exe	themida
behavioral2/memory/1732-19-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
\??\c:\windows\resources\svchost.exe	themida
behavioral2/memory/1388-28-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/2268-33-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/2268-41-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/1784-40-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/1732-39-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/920-42-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/1388-43-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/920-52-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/920-60-0x0000000000400000-0x0000000000A16000-memory.dmp	themida
behavioral2/memory/1388-65-0x0000000000400000-0x0000000000A16000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description ioc process

File opened for modification C:\Windows\SysWOW64\explorer.exe explorer.exe
File opened for modification C:\Windows\SysWOW64\explorer.exe svchost.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

1784 9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
920 explorer.exe
1732 spoolsv.exe
1388 svchost.exe
2268 spoolsv.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Drops file in Windows directory 4 IoCs

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exe

pid	process
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe
920	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

920 explorer.exe
1388 svchost.exe

pid	process
920	explorer.exe
1388	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
920	explorer.exe
920	explorer.exe
1732	spoolsv.exe
1732	spoolsv.exe
1388	svchost.exe
1388	svchost.exe
2268	spoolsv.exe
2268	spoolsv.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 1784 wrote to memory of 920	1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe	explorer.exe
PID 1784 wrote to memory of 920	1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe	explorer.exe
PID 1784 wrote to memory of 920	1784	9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe	explorer.exe
PID 920 wrote to memory of 1732	920	explorer.exe	spoolsv.exe
PID 920 wrote to memory of 1732	920	explorer.exe	spoolsv.exe
PID 920 wrote to memory of 1732	920	explorer.exe	spoolsv.exe
PID 1732 wrote to memory of 1388	1732	spoolsv.exe	svchost.exe
PID 1732 wrote to memory of 1388	1732	spoolsv.exe	svchost.exe
PID 1732 wrote to memory of 1388	1732	spoolsv.exe	svchost.exe
PID 1388 wrote to memory of 2268	1388	svchost.exe	spoolsv.exe
PID 1388 wrote to memory of 2268	1388	svchost.exe	spoolsv.exe
PID 1388 wrote to memory of 2268	1388	svchost.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe
"C:\Users\Admin\AppData\Local\Temp\9c15135aa3b66b89f5070a049524fd93111390cc470a667a7d0de6bcca33762b.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1784

\??\c:\windows\resources\themes\explorer.exe
c:\windows\resources\themes\explorer.exe
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:920

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe SE
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1732

\??\c:\windows\resources\svchost.exe
c:\windows\resources\svchost.exe
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe PR
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2268

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe
Filesize
2.6MB

MD5
907ce76d094e58bccbd2fd40762ea7f9

SHA1
9213557bccd03f0973dc97ec5faf0096f588cb69

SHA256
84c57d544548a3adba7b4d71ce9568e353c283ae6e0332ff4aa1159447b4f0af

SHA512
631515d1e04947672d058cd86da8238d3545d27b96e2d4e5725b128ad65d6e8d73c1c90dec27f06672ccce0d4c52037b47219061ac4ad29b68ea85c563a6f8f4

Download Submit
\??\c:\windows\resources\svchost.exe
Filesize
2.6MB

MD5
69c3103e7a94a1407219ba3570dad8eb

SHA1
7a052681a13aed66f4a5e26cd2a7e993068d38a0

SHA256
af5e23ce3a848d7e677e71c1b1bf74caa7684c68120ebb9141c40d344ce9bae7

SHA512
1b37b2de150b477e51500b91fd0499962e9512b1c60ecfbd656ef88efde4aab96f80f42783fd53ff51a02e7163b9429c00f5a3bb831aedf43e344d766b1bd25d

Download Submit
\??\c:\windows\resources\themes\explorer.exe
Filesize
2.6MB

MD5
0e3a8a4a1876ec1998f7deb69f026496

SHA1
4222526611ef4aac16fcabd059adcaa5b8129dcb

SHA256
ac7dd0465f9e8fb7f5500d4a8b940793a6004c12cc18911178dc3a6b6e49a20a

SHA512
eb3efb67e8c77cc2a51101163979893177bddd17f4ba533f767f3b71c787d3f6c42dea48a860fa0dc3b46ba11bf152a184ea1d1f06ea560cf416b8112d2fdf0f

Download Submit
memory/920-42-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/920-10-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/920-60-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/920-52-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1388-43-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1388-28-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1388-65-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1732-39-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1732-19-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1784-40-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1784-0-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/1784-1-0x00000000777E4000-0x00000000777E6000-memory.dmp

Filesize
8KB

Download
memory/2268-33-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download
memory/2268-41-0x0000000000400000-0x0000000000A16000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads