f9df01186468aef2d2a0d689b5a923f87763fabdd2804378dae767349f30bca0

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
Size 384KB
Sample240519-2na8aaeg88
SHA256 f9df01186468aef2d2a0d689b5a923f87763fabdd2804378dae767349f30bca0
MD5 4f83596c16f5ef366256db0d030ea380
SHA1 5ef8d8a6a8f49caf91c40f54f12a16eae94828ef
SHA512 045786fd32fff49928ce3c0528179e05cbd3083ec48a102a27f3539b0515a8fbeee80dd733ba8adaefe7e131af057f01f3a8bd940f2556bc6987b9220bf4f48b
SSDEEP 6144:Ui2/F3C8EfZL2mqpui6yYPaIGckjh/xaSfBJKFbhD7sYQpui6yYPaIGck7/Diuot:B2/F39EupV6yYPMLnfBJKFbhDwBpV6y+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

backdoor dropper persistence trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 12 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ngedij32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Nbkhfc32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\Web Event Logger = "{79ECA078-17FF-726B-E811-213280E5C831}"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	Nqiogp32.exe

Malware Dropper & Backdoor - Berbew 6 IoCs

Berbew is a backdoor Trojan malware with capabilities to download and install a range of additional malicious software, such as other Trojans, ransomware, and cryptominers.

backdoor trojan dropper

resource	yara_rule
behavioral2/files/0x000a0000000233a9-6.dat	family_berbew
behavioral2/files/0x00070000000233f6-14.dat	family_berbew
behavioral2/files/0x00070000000233f8-22.dat	family_berbew
behavioral2/files/0x00070000000233fa-31.dat	family_berbew
behavioral2/files/0x00070000000233ff-47.dat	family_berbew
behavioral2/files/0x00070000000233fd-39.dat	family_berbew

Executes dropped EXE 6 IoCs

pid	Process
4080	Nqiogp32.exe
1316	Nnmopdep.exe
404	Ngedij32.exe
3332	Nbkhfc32.exe
1968	Ndidbn32.exe
620	Nkcmohbg.exe

Drops file in System32 directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Nqiogp32.exe	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Pponmema.dll	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Cgfgaq32.dll	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Nbkhfc32.exe	Ngedij32.exe
File created	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Nkcmohbg.exe	Ndidbn32.exe
File created	C:\Windows\SysWOW64\Hnibdpde.dll	Ndidbn32.exe
File opened for modification	C:\Windows\SysWOW64\Ngedij32.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Paadnmaq.dll	Nnmopdep.exe
File opened for modification	C:\Windows\SysWOW64\Nbkhfc32.exe	Ngedij32.exe
File opened for modification	C:\Windows\SysWOW64\Ndidbn32.exe	Nbkhfc32.exe
File created	C:\Windows\SysWOW64\Opbnic32.dll	Nbkhfc32.exe
File opened for modification	C:\Windows\SysWOW64\Nqiogp32.exe	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
File created	C:\Windows\SysWOW64\Nnmopdep.exe	Nqiogp32.exe
File opened for modification	C:\Windows\SysWOW64\Nnmopdep.exe	Nqiogp32.exe
File created	C:\Windows\SysWOW64\Ngedij32.exe	Nnmopdep.exe
File created	C:\Windows\SysWOW64\Lkfbjdpq.dll	Ngedij32.exe
File created	C:\Windows\SysWOW64\Ndidbn32.exe	Nbkhfc32.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4672	620	WerFault.exe	91

Modifies registry class 21 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Pponmema.dll"	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Cgfgaq32.dll"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Lkfbjdpq.dll"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nqiogp32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Paadnmaq.dll"	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nnmopdep.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ndidbn32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Opbnic32.dll"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Nbkhfc32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ = "C:\\Windows\\SysWow64\\Hnibdpde.dll"	Ndidbn32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nqiogp32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nnmopdep.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32\ThreadingModel = "Apartment"	Ngedij32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{79ECA078-17FF-726B-E811-213280E5C831}\InProcServer32	Nbkhfc32.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4080	4304	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe	86
PID 4304 wrote to memory of 4080	4304	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe	86
PID 4304 wrote to memory of 4080	4304	4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe	86
PID 4080 wrote to memory of 1316	4080	Nqiogp32.exe	87
PID 4080 wrote to memory of 1316	4080	Nqiogp32.exe	87
PID 4080 wrote to memory of 1316	4080	Nqiogp32.exe	87
PID 1316 wrote to memory of 404	1316	Nnmopdep.exe	88
PID 1316 wrote to memory of 404	1316	Nnmopdep.exe	88
PID 1316 wrote to memory of 404	1316	Nnmopdep.exe	88
PID 404 wrote to memory of 3332	404	Ngedij32.exe	89
PID 404 wrote to memory of 3332	404	Ngedij32.exe	89
PID 404 wrote to memory of 3332	404	Ngedij32.exe	89
PID 3332 wrote to memory of 1968	3332	Nbkhfc32.exe	90
PID 3332 wrote to memory of 1968	3332	Nbkhfc32.exe	90
PID 3332 wrote to memory of 1968	3332	Nbkhfc32.exe	90
PID 1968 wrote to memory of 620	1968	Ndidbn32.exe	91
PID 1968 wrote to memory of 620	1968	Ndidbn32.exe	91
PID 1968 wrote to memory of 620	1968	Ndidbn32.exe	91

C:\Users\Admin\AppData\Local\Temp\4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\4f83596c16f5ef366256db0d030ea380_NeikiAnalytics.exe"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Windows\SysWOW64\Nqiogp32.exe
  C:\Windows\system32\Nqiogp32.exe
  2⤵
  - Adds autorun key to be loaded by Explorer.exe on startup
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\SysWOW64\Nnmopdep.exe
    C:\Windows\system32\Nnmopdep.exe
    3⤵
    - Adds autorun key to be loaded by Explorer.exe on startup
    - Executes dropped EXE
    - Drops file in System32 directory
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\SysWOW64\Ngedij32.exe
      C:\Windows\system32\Ngedij32.exe
      4⤵
      Adds autorun key to be loaded by Explorer.exe on startup
      Executes dropped EXE
      Drops file in System32 directory
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:404
    - - C:\Windows\SysWOW64\Nbkhfc32.exe
        
        C:\Windows\system32\Nbkhfc32.exe
        5⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:3332
      - C:\Windows\SysWOW64\Ndidbn32.exe
        
        C:\Windows\system32\Ndidbn32.exe
        6⤵
        Adds autorun key to be loaded by Explorer.exe on startup
        Executes dropped EXE
        Drops file in System32 directory
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:1968
        
        C:\Windows\SysWOW64\Nkcmohbg.exe
        
        C:\Windows\system32\Nkcmohbg.exe
        7⤵
        Executes dropped EXE
        
        PID:620
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 412
        8⤵
        Program crash
        
        PID:4672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 620 -ip 620
1⤵
PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nbkhfc32.exe

Path C:\Windows\SysWOW64\Nbkhfc32.exe
Size 384KB
SHA256 51e1af13cb0afce4f22097be4e8c31b35d9116034dc646ca548bfec624fede8d
MD5 9255dfd1c214971aead9cfa02fa3fa2c
SHA1 5fc497a759d196236e3500fe466648591903ace1
SHA512 b3573e9c3966c0ee0c3dc2c329fb4297f7fdae90f0a38c806e9da040d48a65f72637485a9b40309ca213189059549a82706fa29196278b87d9e7abed04a6fd03
SSDEEP 6144:ICJ/w6PUfpui6yYPaIGckjh/xaSfBJKFbhD7sYQpui6yYPaIGck7/DiuoH3ygNb/:ICZw6PepV6yYPMLnfBJKFbhDwBpV6yY9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ndidbn32.exe

Path C:\Windows\SysWOW64\Ndidbn32.exe
Size 384KB
SHA256 359f904ed72180c43aa63175245097d02bbab3452464666ecc9084117ad51cb6
MD5 a6a9ae1a11f7d91853b39ed0adab4e47
SHA1 4bd6c6839aecacfdf29adc7bc7fd950cd9eb9ffb
SHA512 3c168caa1405429233cfbd618b16b382fc1459a9f2e2cd3e84dac8ceb9a27b52108a8f467da12c60e2aa943e9e527ec27189c1477c7b9f29db0d69081ee1d4b3
SSDEEP 6144:ulZNIVMrpui6yYPaIGckjh/xaSfBJKFbhD7sYQpui6yYPaIGck7/DiuoH3ygNbbL:qwapV6yYPMLnfBJKFbhDwBpV6yYP0riN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ngedij32.exe

Path C:\Windows\SysWOW64\Ngedij32.exe
Size 384KB
SHA256 54c40a4a04a9a5ee965d3f0dc870c87ad51c65c307e2219ab005ba62f0efaf99
MD5 832eb06f99cebb2f3edcfbbbb940cef5
SHA1 d091b4639644e450cd4c7457fcd924696e28b549
SHA512 ba92b3f1842638fecee1677246d439f048da3c38bde9b3f7cec2b19f3063151f10f30794d84ce45fc5d321a32272a22ea10253cda6046169b7151a386a312b1f
SSDEEP 6144:tRBPWcMWkZpui6yYPaIGckjh/xaSfBJKFbhD7sYQpui6yYPaIGck7/DiuoH3ygND:tzWPW4pV6yYPMLnfBJKFbhDwBpV6yYPV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nkcmohbg.exe

Path C:\Windows\SysWOW64\Nkcmohbg.exe
Size 384KB
SHA256 f3e534e2f263462a5f97289cf694fca7b2cd913267e1794c0f178dc67a273852
MD5 be925467a122a54f81ca903e32e703c5
SHA1 6aa969d285ec5c53ab8c160f6c2acc798160bef9
SHA512 a3f4939194b96436f386a552b8ba52348fea39401e213380c9e3fe97f686d162fcd121ec882fe5d85c7faa33eb8e7629626b73cbbc1f0952bc34ff5fd00ee255
SSDEEP 6144:T+VoUOGpui6yYPaIGckjh/xaSfBJKFbhD7sYQpui6yYPaIGck7/DiuoH3ygNbbks:gtpV6yYPMLnfBJKFbhDwBpV6yYP0riuw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nnmopdep.exe

Path C:\Windows\SysWOW64\Nnmopdep.exe
Size 384KB
SHA256 315b45f563d67c7788245f6ebbcc43bf2dab7261ac377d21f7428597e8c8948c
MD5 c7d1addda791906b4270c04fa5d69aa1
SHA1 b75f087b55ff0474cf10b02928d9f0520fd9ad98
SHA512 4b9259bb176323a4eeae1446af6800ea4ff063a70dd7fa87c8fd1bb4e3989cb022362ca0634ce6800cb25005305b5c8909ebd57a7e24776bd49fb6857ee791e4
SSDEEP 6144:B9OGv2B2DOb4fc+6Dpui6yYPaIGckjh/xaSfBJKFbhD7sYQpui6yYPaIGck7/DiN:Bl5zMpV6yYPMLnfBJKFbhDwBpV6yYP0u
MD5 SHA1 SHA512 SSDEEP

Submit Download

Nqiogp32.exe

Path C:\Windows\SysWOW64\Nqiogp32.exe
Size 384KB
SHA256 8f780382bcb77c6e98d6499908c12bc1ee60fcd44eea06803da165d3353104e0
MD5 ac285ab20ec79aa82c14cb201d2c656c
SHA1 e895b615991ccb29da4ddb0e4f45957b54f5e274
SHA512 6e911f8f2573d34db592f5a47426f3be2cc5eda37ec1a986916c5623e7e8fe83a2e0bb0a1ace60fb416b328ea5b4c1403ccdae4de1075b454e229129fe862720
SSDEEP 6144:Ncfr1T2IPBpQFXpui6yYPaIGckjh/xaSfBJKFbhD7sYQpui6yYPaIGck7/DiuoHN:NEh2oyBpV6yYPMLnfBJKFbhDwBpV6yY9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Opbnic32.dll

Path C:\Windows\SysWOW64\Opbnic32.dll
Size 7KB
SHA256 1b6983792b18df694f59a6417af3dd1f1c9f961d16a8d9da3a7ba4d0a7c4f3a4
MD5 5beed14e29b71623c48f80b77e19be57
SHA1 97274b2c2ba46c3cbdecfa48f00652e40125bbf3
SHA512 e3167f20809d201d3b76f688f3d3f328c752d2c76d391b12560c2a1fad6a82abbb8490aff6cf7621ef402cfc42b5fa56742e063217c364a7a14d4981ff1dff52
SSDEEP 96:wb4VHccYJUC/aFbz/j0OvaP6d3cX5aXW:wUaJf/aFbP0O52JaX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-24-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/404-53-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/620-50-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/620-48-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1316-52-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1316-16-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1968-44-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/1968-49-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3332-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/3332-51-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4080-8-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4080-55-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4304-0-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4304-54-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads