95e1f5ce0db239bd421f4fa9f887ac75446d232340b5dcfbefea74d63553e6ed

General

Target

416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
Size

2.5MB
MD5

416e6ac71d6a6c2b1684857e749bea10
SHA1

c5c56bb1f686127e6a868db4502a2dc5aace1f5a
SHA256

95e1f5ce0db239bd421f4fa9f887ac75446d232340b5dcfbefea74d63553e6ed
SHA512

6b48218048b697a7449cac072393d4a67af0a4744b3376284d5633b7a65f29f32a447b9bba8b8cc090e5fd1d8a37de101799b5e92f18f38c0efd973a7e1d6bd1
SSDEEP

49152:PxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxy:Pxx9NUFkQx753uWuCyyxy

Score

10^/10

evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

spoolsv.exe416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2728 explorer.exe
2980 spoolsv.exe
2648 svchost.exe
2580 spoolsv.exe
Loads dropped DLL 4 IoCs

Processes:

416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

pid process

1688 416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
2728 explorer.exe
2980 spoolsv.exe
2648 svchost.exe

pid	process
2728	explorer.exe
2980	spoolsv.exe
2648	svchost.exe
2580	spoolsv.exe

Themida packer 17 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/1688-0-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
\Windows\Resources\Themes\explorer.exe	themida
behavioral1/memory/2728-11-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
C:\Windows\Resources\spoolsv.exe	themida
behavioral1/memory/2980-23-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
C:\Windows\Resources\svchost.exe	themida
behavioral1/memory/2648-35-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2580-43-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2580-48-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2980-50-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/1688-52-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2728-53-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2648-54-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2728-55-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2728-61-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2728-67-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2648-74-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe

Drops file in System32 directory 2 IoCs

Processes:

explorer.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

1688 416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
2728 explorer.exe
2980 spoolsv.exe
2648 svchost.exe
2580 spoolsv.exe

Drops file in Windows directory 4 IoCs

Processes:

explorer.exespoolsv.exe416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe

description	ioc	process
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

1468 schtasks.exe
2088 schtasks.exe
2492 schtasks.exe

pid	process
1468	schtasks.exe
2088	schtasks.exe
2492	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exeexplorer.exesvchost.exe

pid	process
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2648	svchost.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2728	explorer.exe
2648	svchost.exe
2648	svchost.exe
2728	explorer.exe
2728	explorer.exe
2648	svchost.exe
2648	svchost.exe
2728	explorer.exe
2648	svchost.exe
2728	explorer.exe
2728	explorer.exe
2648	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2728 explorer.exe
2648 svchost.exe

pid	process
2728	explorer.exe
2648	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
2728	explorer.exe
2728	explorer.exe
2980	spoolsv.exe
2980	spoolsv.exe
2648	svchost.exe
2648	svchost.exe
2580	spoolsv.exe
2580	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 1688 wrote to memory of 2728	1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe	explorer.exe
PID 1688 wrote to memory of 2728	1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe	explorer.exe
PID 1688 wrote to memory of 2728	1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe	explorer.exe
PID 1688 wrote to memory of 2728	1688	416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe	explorer.exe
PID 2728 wrote to memory of 2980	2728	explorer.exe	spoolsv.exe
PID 2728 wrote to memory of 2980	2728	explorer.exe	spoolsv.exe
PID 2728 wrote to memory of 2980	2728	explorer.exe	spoolsv.exe
PID 2728 wrote to memory of 2980	2728	explorer.exe	spoolsv.exe
PID 2980 wrote to memory of 2648	2980	spoolsv.exe	svchost.exe
PID 2980 wrote to memory of 2648	2980	spoolsv.exe	svchost.exe
PID 2980 wrote to memory of 2648	2980	spoolsv.exe	svchost.exe
PID 2980 wrote to memory of 2648	2980	spoolsv.exe	svchost.exe
PID 2648 wrote to memory of 2580	2648	svchost.exe	spoolsv.exe
PID 2648 wrote to memory of 2580	2648	svchost.exe	spoolsv.exe
PID 2648 wrote to memory of 2580	2648	svchost.exe	spoolsv.exe
PID 2648 wrote to memory of 2580	2648	svchost.exe	spoolsv.exe
PID 2728 wrote to memory of 2676	2728	explorer.exe	Explorer.exe
PID 2728 wrote to memory of 2676	2728	explorer.exe	Explorer.exe
PID 2728 wrote to memory of 2676	2728	explorer.exe	Explorer.exe
PID 2728 wrote to memory of 2676	2728	explorer.exe	Explorer.exe
PID 2648 wrote to memory of 2492	2648	svchost.exe	schtasks.exe
PID 2648 wrote to memory of 2492	2648	svchost.exe	schtasks.exe
PID 2648 wrote to memory of 2492	2648	svchost.exe	schtasks.exe
PID 2648 wrote to memory of 2492	2648	svchost.exe	schtasks.exe
PID 2648 wrote to memory of 1468	2648	svchost.exe	schtasks.exe
PID 2648 wrote to memory of 1468	2648	svchost.exe	schtasks.exe
PID 2648 wrote to memory of 1468	2648	svchost.exe	schtasks.exe
PID 2648 wrote to memory of 1468	2648	svchost.exe	schtasks.exe
PID 2648 wrote to memory of 2088	2648	svchost.exe	schtasks.exe
PID 2648 wrote to memory of 2088	2648	svchost.exe	schtasks.exe
PID 2648 wrote to memory of 2088	2648	svchost.exe	schtasks.exe
PID 2648 wrote to memory of 2088	2648	svchost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\416e6ac71d6a6c2b1684857e749bea10_NeikiAnalytics.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688

\??\c:\windows\resources\themes\explorer.exe
c:\windows\resources\themes\explorer.exe
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2728

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe SE
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2980

\??\c:\windows\resources\svchost.exe
c:\windows\resources\svchost.exe
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2648

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe PR
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2580

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:37 /f
5⤵
- Creates scheduled task(s)
PID:2492

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:38 /f
5⤵
- Creates scheduled task(s)
PID:1468

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 21:39 /f
5⤵
- Creates scheduled task(s)
PID:2088

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
3⤵
PID:2676

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Modify Registry

2

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Resources\spoolsv.exe
Filesize
2.5MB

MD5
87c95ab8ec9adeb4284f19689fc71513

SHA1
4f22ec8f8db463205b80bc9d7c2e7ce05691962a

SHA256
bf8f6fd8e92ab2081aa54bd50de2d4a832d071de4280e53dcf30a58c5bfb8a01

SHA512
cea26e1766be81b060a8bedface537a08f2440026448778cbdbd2d9e2a85dc0fde49be3c9df8203d3dc63500c71af500a188d9a7732c4713c738458c42766f20

Download Submit
C:\Windows\Resources\svchost.exe
Filesize
2.5MB

MD5
c0816699e5fee93ba734b6e24d0f74e9

SHA1
25425acba1270c7185ace4bb056a1334b9d66168

SHA256
b5c4331f03a2f29d396ae4f6d6d4948f648a087b042dfff6d018e9ccaf00dfe8

SHA512
ece5a852a876640b3a3d1ac44faaa931a5f468736c71981e6f3566964d2b6ccd14e179dee8edca54e76ee10e08b5d593ef52438ba15b77755d954d1c2d11cbac

Download Submit
\Windows\Resources\Themes\explorer.exe
Filesize
2.5MB

MD5
23642af50057c346ff8e9f1913f94d83

SHA1
3d6d702f3bc22a1c72618f160edafb93bf01ec68

SHA256
1e1d8906f177d88b509ffbdb73d686abab8f50c167d37d45c5f9bf56d0b39560

SHA512
ba186acecbf55c5eac193ee0064161f6131e3a60a8ecd0362e887b52f1843c59016d08f4fb7aa9ccfb82fc70f063afd99018ea8d5eb386465bdf598e6567b747

Download Submit
memory/1688-1-0x0000000076FD0000-0x0000000076FD2000-memory.dmp

Filesize
8KB

Download
memory/1688-0-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/1688-52-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2580-48-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2580-43-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2648-74-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2648-54-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2648-35-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2648-42-0x0000000003250000-0x000000000385E000-memory.dmp

Filesize
6.1MB

Download
memory/2728-53-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2728-22-0x0000000003800000-0x0000000003E0E000-memory.dmp

Filesize
6.1MB

Download
memory/2728-55-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2728-56-0x0000000003800000-0x0000000003E0E000-memory.dmp

Filesize
6.1MB

Download
memory/2728-61-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2728-67-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2728-11-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2980-50-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2980-34-0x0000000003580000-0x0000000003B8E000-memory.dmp

Filesize
6.1MB

Download
memory/2980-23-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads