1c661c2a242d779c6efa39818ea1b4563629069858cd9d4ee366251c47d1c521

General

Target

586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
Size

2.5MB
MD5

586ea3ffbc4520655a6766e81a43db00
SHA1

53f179721a753049ca76111a5e5d451067e2cb0c
SHA256

1c661c2a242d779c6efa39818ea1b4563629069858cd9d4ee366251c47d1c521
SHA512

61aa659c00bb157a33d1441708a623a72f5d7ce0d3677625e5c42bcc2c63051fffb663e19413fc49d6688467940f4ed9078a926bf8428d86c173f344b62e9fc8
SSDEEP

49152:dxmvumkQ9lY9sgUXdTPSxdQ8KX75IyuWuCjcCqWOyxU:dxx9NUFkQx753uWuCyyxU

Score

10^/10

evasion persistence themida trojan

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

spoolsv.exesvchost.exe586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exeexplorer.exespoolsv.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe

Executes dropped EXE 4 IoCs

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2688 explorer.exe
2552 spoolsv.exe
2572 svchost.exe
2384 spoolsv.exe
Loads dropped DLL 4 IoCs

Processes:

586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

pid process

2200 586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2688 explorer.exe
2552 spoolsv.exe
2572 svchost.exe

pid	process
2688	explorer.exe
2552	spoolsv.exe
2572	svchost.exe
2384	spoolsv.exe

Themida packer 17 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2200-0-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
\Windows\Resources\Themes\explorer.exe	themida
behavioral1/memory/2688-12-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
\Windows\Resources\spoolsv.exe	themida
behavioral1/memory/2552-24-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
\Windows\Resources\svchost.exe	themida
behavioral1/memory/2572-36-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2200-43-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2384-44-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2384-49-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2552-50-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2200-52-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2688-53-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2572-56-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2572-59-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2688-62-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida
behavioral1/memory/2688-68-0x0000000000400000-0x0000000000A0E000-memory.dmp	themida

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exe586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe

Drops file in System32 directory 2 IoCs

Processes:

svchost.exeexplorer.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\explorer.exe	svchost.exe
File opened for modification	C:\Windows\SysWOW64\explorer.exe	explorer.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

2200 586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2688 explorer.exe
2552 spoolsv.exe
2572 svchost.exe
2384 spoolsv.exe

Drops file in Windows directory 4 IoCs

Processes:

586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exeexplorer.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\resources\themes\explorer.exe	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
File opened for modification	\??\c:\windows\resources\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\resources\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\Resources\tjud.exe	explorer.exe

Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2776 schtasks.exe
1776 schtasks.exe
2208 schtasks.exe

pid	process
2776	schtasks.exe
1776	schtasks.exe
2208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exeexplorer.exesvchost.exe

pid	process
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2572	svchost.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2688	explorer.exe
2572	svchost.exe
2572	svchost.exe
2688	explorer.exe
2572	svchost.exe
2688	explorer.exe
2688	explorer.exe
2572	svchost.exe
2688	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

explorer.exesvchost.exe

pid process

2688 explorer.exe
2572 svchost.exe

pid	process
2688	explorer.exe
2572	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid	process
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
2688	explorer.exe
2688	explorer.exe
2552	spoolsv.exe
2552	spoolsv.exe
2572	svchost.exe
2572	svchost.exe
2384	spoolsv.exe
2384	spoolsv.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exeexplorer.exespoolsv.exesvchost.exe

description	pid	process	target process
PID 2200 wrote to memory of 2688	2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe	explorer.exe
PID 2200 wrote to memory of 2688	2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe	explorer.exe
PID 2200 wrote to memory of 2688	2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe	explorer.exe
PID 2200 wrote to memory of 2688	2200	586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe	explorer.exe
PID 2688 wrote to memory of 2552	2688	explorer.exe	spoolsv.exe
PID 2688 wrote to memory of 2552	2688	explorer.exe	spoolsv.exe
PID 2688 wrote to memory of 2552	2688	explorer.exe	spoolsv.exe
PID 2688 wrote to memory of 2552	2688	explorer.exe	spoolsv.exe
PID 2552 wrote to memory of 2572	2552	spoolsv.exe	svchost.exe
PID 2552 wrote to memory of 2572	2552	spoolsv.exe	svchost.exe
PID 2552 wrote to memory of 2572	2552	spoolsv.exe	svchost.exe
PID 2552 wrote to memory of 2572	2552	spoolsv.exe	svchost.exe
PID 2572 wrote to memory of 2384	2572	svchost.exe	spoolsv.exe
PID 2572 wrote to memory of 2384	2572	svchost.exe	spoolsv.exe
PID 2572 wrote to memory of 2384	2572	svchost.exe	spoolsv.exe
PID 2572 wrote to memory of 2384	2572	svchost.exe	spoolsv.exe
PID 2688 wrote to memory of 2616	2688	explorer.exe	Explorer.exe
PID 2688 wrote to memory of 2616	2688	explorer.exe	Explorer.exe
PID 2688 wrote to memory of 2616	2688	explorer.exe	Explorer.exe
PID 2688 wrote to memory of 2616	2688	explorer.exe	Explorer.exe
PID 2572 wrote to memory of 2776	2572	svchost.exe	schtasks.exe
PID 2572 wrote to memory of 2776	2572	svchost.exe	schtasks.exe
PID 2572 wrote to memory of 2776	2572	svchost.exe	schtasks.exe
PID 2572 wrote to memory of 2776	2572	svchost.exe	schtasks.exe
PID 2572 wrote to memory of 1776	2572	svchost.exe	schtasks.exe
PID 2572 wrote to memory of 1776	2572	svchost.exe	schtasks.exe
PID 2572 wrote to memory of 1776	2572	svchost.exe	schtasks.exe
PID 2572 wrote to memory of 1776	2572	svchost.exe	schtasks.exe
PID 2572 wrote to memory of 2208	2572	svchost.exe	schtasks.exe
PID 2572 wrote to memory of 2208	2572	svchost.exe	schtasks.exe
PID 2572 wrote to memory of 2208	2572	svchost.exe	schtasks.exe
PID 2572 wrote to memory of 2208	2572	svchost.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\586ea3ffbc4520655a6766e81a43db00_NeikiAnalytics.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2200

\??\c:\windows\resources\themes\explorer.exe
c:\windows\resources\themes\explorer.exe
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2688

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe SE
3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2552

\??\c:\windows\resources\svchost.exe
c:\windows\resources\svchost.exe
4⤵
- Modifies visiblity of hidden/system files in Explorer
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2572

\??\c:\windows\resources\spoolsv.exe
c:\windows\resources\spoolsv.exe PR
5⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:2384

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 23:33 /f
5⤵
- Creates scheduled task(s)
PID:2776

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 23:34 /f
5⤵
- Creates scheduled task(s)
PID:1776

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn "svchost" /tr "c:\windows\resources\svchost.exe" /sc daily /st 23:35 /f
5⤵
- Creates scheduled task(s)
PID:2208

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe
3⤵
PID:2616

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Modify Registry

2

T1112

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\Resources\Themes\explorer.exe
Filesize
2.5MB

MD5
c28035388ad9949008982a128c190b85

SHA1
5b7c2e9e8b425224f0161a23f0746f237c99b481

SHA256
cb54d493dfaa219df08832950fc864679656f5a112840c1696afb95afeaccc5e

SHA512
233c48fd5c62b815a6094840bc4cd52c3a044ab3c98c1dc04788a31ccfdc349691293e0395e78b22e3edc63de0789426af92ab0ab775a5fc8639fdef9062e7e2

Download Submit
\Windows\Resources\spoolsv.exe
Filesize
2.5MB

MD5
3dfad950af2a6a268db96a733809353f

SHA1
e3b8094189cbd4cec24dfbbb43e1dafd94a49459

SHA256
c2f0f7470f421b46fb2e0932c7ba76bf3c73551efb8cc754dd132a7429991a91

SHA512
c809eb9283e2796626cc677808d34993e486f55516df3c042f5ab8e4fea03f5904318f2a6cbeb461b1e33be3592e052edc080e4797f9b05263beac31b1ad8f41

Download Submit
\Windows\Resources\svchost.exe
Filesize
2.5MB

MD5
5f8ebd4326901fdb48aa79aa3b17ffdd

SHA1
9db56e47b05676ed2b135425ab842026b9d821d6

SHA256
da7952aa983eb6941983e1c18c562461af17def22c8ce5a4c5f43b67c805b0d5

SHA512
b1096c9762d811ebaaef943475b93fab54bcf64e957cd0e487c6b2a8b034fe8305d5db4400091383bec540920ed55cd879d0752743780bb6df405dfdc4f7c1b2

Download Submit
memory/2200-43-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2200-1-0x0000000077AA0000-0x0000000077AA2000-memory.dmp

Filesize
8KB

Download
memory/2200-11-0x0000000003290000-0x000000000389E000-memory.dmp

Filesize
6.1MB

Download
memory/2200-52-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2200-0-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2200-45-0x0000000003290000-0x000000000389E000-memory.dmp

Filesize
6.1MB

Download
memory/2384-49-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2384-44-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2552-50-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2552-35-0x00000000032E0000-0x00000000038EE000-memory.dmp

Filesize
6.1MB

Download
memory/2552-24-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2572-36-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2572-56-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2572-59-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2688-23-0x0000000003210000-0x000000000381E000-memory.dmp

Filesize
6.1MB

Download
memory/2688-12-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2688-53-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2688-55-0x0000000003210000-0x000000000381E000-memory.dmp

Filesize
6.1MB

Download
memory/2688-62-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download
memory/2688-68-0x0000000000400000-0x0000000000A0E000-memory.dmp

Filesize
6.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads