ctblocker | 128a0f0cd5d10f864d5a0741ba25996b2bf74f580ac7918dec6516215801e39a

Analysis

max time kernel
152s
max time network
135s
platform
windows10_x64
resource
win10v20210410
submitted
26-07-2021 12:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

128a0f0cd5d10f864d5a0741ba25996b2bf74f580ac7918dec6516215801e39a.sample.exe
Size

1.1MB
MD5

446e594e266f5e52064fd69a333867f6
SHA1

5c94d21af50f54472cee2cbdb09ec5c7d3361916
SHA256

128a0f0cd5d10f864d5a0741ba25996b2bf74f580ac7918dec6516215801e39a
SHA512

8f389d7f2b7fbf508a23b29ee4d282fbeedaf94cb3de182df8886680bdc752c35fdd0e94b0034ea3dbc440b1a5e87387bea3994241e3e4eb77af091000a57f05

Score

10^/10

ctblocker ransomware

Malware Config

Extracted

Path

C:\Users\Admin\Documents\!Decrypt-All-Files-jbeixtg.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://6ubux6ppafr24izl.onion.cab or http://6ubux6ppafr24izl.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://6ubux6ppafr24izl.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. TMRAFZ6-EQEUENO-6JPHJ4U-AO2E5DS-OLNZCWJ-BMU7O3N-K5WBEWP-V7MDDHI AXPA7RK-UUNJ3D6-VVUMUOX-HY2F7WL-TLPA33Q-JOP4NFN-VGQ3ZAG-6LDCTCI GP7EBOC-LF56GU7-LGAMXPL-D7S2E6X-AXEQDSH-EUFWYGL-2S6PSXW-ZNOVD4V Follow the instructions on the server.

URLs

http://6ubux6ppafr24izl.onion.cab

http://6ubux6ppafr24izl.tor2web.org

http://6ubux6ppafr24izl.onion/

Extracted

Path

C:\ProgramData\kwivvrl.html

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://6ubux6ppafr24izl.onion.cab or http://6ubux6ppafr24izl.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org. 2. In the Tor Browser open the http://6ubux6ppafr24izl.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. Follow the instructions on the server. The list of your encrypted files: Path File

URLs

http://6ubux6ppafr24izl.onion.cab

http://6ubux6ppafr24izl.tor2web.org

http://6ubux6ppafr24izl.onion

Signatures

CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
ransomware ctblocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

pwqidta.exepwqidta.exe

pid process

2616 pwqidta.exe
2388 pwqidta.exe

pid	process
2616	pwqidta.exe
2388	pwqidta.exe

Modifies extensions of user files 2 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

svchost.exe

description	ioc	process
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\ImportDismount.CRW.jbeixtg	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\ReceiveUnregister.CRW.jbeixtg	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

pwqidta.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation pwqidta.exe
Drops desktop.ini file(s) 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini svchost.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	pwqidta.exe

description	ioc	process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Drops file in System32 directory 6 IoCs

Processes:

pwqidta.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	pwqidta.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	pwqidta.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	pwqidta.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	pwqidta.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	pwqidta.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\desktop.ini	pwqidta.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\!Decrypt-All-Files-jbeixtg.bmp"	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

2536 vssadmin.exe

pid	process
2536	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

Processes:

pwqidta.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	pwqidta.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\GPU	pwqidta.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"6.2.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	pwqidta.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	pwqidta.exe

Modifies data under HKEY_USERS 21 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00320036003600640031006300610034002d0030003000300030002d0030003000300030002d0030003000300030002d003500300030003600300030003000300030003000300030007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{266d1ca4-0000-0000-0000-500600000000}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{266d1ca4-0000-0000-0000-500600000000}\MaxCapacity = "15150"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{266d1ca4-0000-0000-0000-500600000000}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

128a0f0cd5d10f864d5a0741ba25996b2bf74f580ac7918dec6516215801e39a.sample.exepwqidta.exe

pid	process
1796	128a0f0cd5d10f864d5a0741ba25996b2bf74f580ac7918dec6516215801e39a.sample.exe
1796	128a0f0cd5d10f864d5a0741ba25996b2bf74f580ac7918dec6516215801e39a.sample.exe
2616	pwqidta.exe
2616	pwqidta.exe
2616	pwqidta.exe
2616	pwqidta.exe
2616	pwqidta.exe
2616	pwqidta.exe
2616	pwqidta.exe
2616	pwqidta.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

2492 Explorer.EXE

pid	process
2492	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

pwqidta.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	2616	pwqidta.exe
Token: SeDebugPrivilege	2616	pwqidta.exe
Token: SeShutdownPrivilege	2492	Explorer.EXE
Token: SeCreatePagefilePrivilege	2492	Explorer.EXE
Token: SeShutdownPrivilege	2492	Explorer.EXE
Token: SeCreatePagefilePrivilege	2492	Explorer.EXE
Token: SeShutdownPrivilege	2492	Explorer.EXE
Token: SeCreatePagefilePrivilege	2492	Explorer.EXE
Token: SeShutdownPrivilege	2492	Explorer.EXE
Token: SeCreatePagefilePrivilege	2492	Explorer.EXE
Token: SeShutdownPrivilege	2492	Explorer.EXE
Token: SeCreatePagefilePrivilege	2492	Explorer.EXE
Token: SeShutdownPrivilege	2492	Explorer.EXE
Token: SeCreatePagefilePrivilege	2492	Explorer.EXE
Token: SeShutdownPrivilege	2492	Explorer.EXE
Token: SeCreatePagefilePrivilege	2492	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

pwqidta.exe

pid process

2388 pwqidta.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

pwqidta.exe

pid process

2388 pwqidta.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

pwqidta.exe

pid process

2388 pwqidta.exe
2388 pwqidta.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

Explorer.EXE

pid process

2492 Explorer.EXE

pid	process
2388	pwqidta.exe

pid	process
2388	pwqidta.exe

pid	process
2388	pwqidta.exe
2388	pwqidta.exe

pid	process
2492	Explorer.EXE

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

pwqidta.exe

description	pid	process	target process
PID 2616 wrote to memory of 716	2616	pwqidta.exe	svchost.exe
PID 2616 wrote to memory of 2492	2616	pwqidta.exe	Explorer.EXE
PID 2616 wrote to memory of 2536	2616	pwqidta.exe	vssadmin.exe
PID 2616 wrote to memory of 2536	2616	pwqidta.exe	vssadmin.exe
PID 2616 wrote to memory of 2536	2616	pwqidta.exe	vssadmin.exe
PID 2616 wrote to memory of 2388	2616	pwqidta.exe	pwqidta.exe
PID 2616 wrote to memory of 2388	2616	pwqidta.exe	pwqidta.exe
PID 2616 wrote to memory of 2388	2616	pwqidta.exe	pwqidta.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:2492

C:\Users\Admin\AppData\Local\Temp\128a0f0cd5d10f864d5a0741ba25996b2bf74f580ac7918dec6516215801e39a.sample.exe
"C:\Users\Admin\AppData\Local\Temp\128a0f0cd5d10f864d5a0741ba25996b2bf74f580ac7918dec6516215801e39a.sample.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1796

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k dcomlaunch -s PlugPlay
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
PID:716

C:\Users\Admin\AppData\Local\Temp\pwqidta.exe
C:\Users\Admin\AppData\Local\Temp\pwqidta.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows all
2⤵
- Interacts with shadow copies
PID:2536

C:\Users\Admin\AppData\Local\Temp\pwqidta.exe
"C:\Users\Admin\AppData\Local\Temp\pwqidta.exe" -u
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2388

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Adobe\hmvkwmb
MD5
00ee61acd4352b9206097fc01145e2dd

SHA1
1465e79e14a06aa310ecd7449fdf78cc4e5c38c0

SHA256
2a5c52170f9f72c68afc66a26acb09a86ea0f137d424c21e5432cbf33fed141a

SHA512
7b474599f9669020805e49d0ca25ef45eb903b477cfaf5e86f4993693a4e1edae674725d0308b565bc468bd80619da97f5ca4bc5c1d47dcf1102aab26ec53129

Download Submit
C:\ProgramData\Adobe\hmvkwmb
MD5
00ee61acd4352b9206097fc01145e2dd

SHA1
1465e79e14a06aa310ecd7449fdf78cc4e5c38c0

SHA256
2a5c52170f9f72c68afc66a26acb09a86ea0f137d424c21e5432cbf33fed141a

SHA512
7b474599f9669020805e49d0ca25ef45eb903b477cfaf5e86f4993693a4e1edae674725d0308b565bc468bd80619da97f5ca4bc5c1d47dcf1102aab26ec53129

Download Submit
C:\ProgramData\Adobe\hmvkwmb
MD5
483c007153dcc33ec89e85918e5eaeae

SHA1
d3a5312241c8ea49a4bd4d36b45581f9c0822b86

SHA256
ac45bbdb362d1fe63654238a89a7a2a671ba8c835e791b739ff2037ae49f66cb

SHA512
75b6ce7a1d30cf706bd53809bc92bdc55844c2af419aee69628d91c9f1f23cd2fabc82914389752843684d7eb006adacc53eb35af0821f62dec99a48fe04b1a1

Download Submit
C:\ProgramData\Adobe\hmvkwmb
MD5
4ce12e7fa00474ab3d5d862cddf34d3c

SHA1
ebca79dbb4de56bb5dc7e072ce8ca5ef4d3be2e0

SHA256
571aaaf88c98753b9072716947c37690a7900a682d7c410e0dc5eca9632808fa

SHA512
62adc11e66a836f19b09d876adb90a00b9bc2dc65fda7226b23a3e33100b21c4dc009f09809f65a3a121912b3219727f240fc6b919d730a30c231238d2028dd4

Download Submit
C:\ProgramData\Adobe\hmvkwmb
MD5
4ce12e7fa00474ab3d5d862cddf34d3c

SHA1
ebca79dbb4de56bb5dc7e072ce8ca5ef4d3be2e0

SHA256
571aaaf88c98753b9072716947c37690a7900a682d7c410e0dc5eca9632808fa

SHA512
62adc11e66a836f19b09d876adb90a00b9bc2dc65fda7226b23a3e33100b21c4dc009f09809f65a3a121912b3219727f240fc6b919d730a30c231238d2028dd4

Download Submit
C:\ProgramData\kwivvrl.html
MD5
f607a61aec0ce5db95732354807f832b

SHA1
da2a7c4d89a8aaebe411a419c0c63579666f7748

SHA256
f784aa86584efe182dc926d518bc6cf23e2fd58d475c0a655224f86f6bc89d7f

SHA512
13460e7fad678bdc9ad73abb3bd4399ce25f0942e6b48255052fb63516769f27821766afd5776650f16d3003c70837d2d7be26a13629948d0c9d77c54d1c7712

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwqidta.exe
MD5
446e594e266f5e52064fd69a333867f6

SHA1
5c94d21af50f54472cee2cbdb09ec5c7d3361916

SHA256
128a0f0cd5d10f864d5a0741ba25996b2bf74f580ac7918dec6516215801e39a

SHA512
8f389d7f2b7fbf508a23b29ee4d282fbeedaf94cb3de182df8886680bdc752c35fdd0e94b0034ea3dbc440b1a5e87387bea3994241e3e4eb77af091000a57f05

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwqidta.exe
MD5
446e594e266f5e52064fd69a333867f6

SHA1
5c94d21af50f54472cee2cbdb09ec5c7d3361916

SHA256
128a0f0cd5d10f864d5a0741ba25996b2bf74f580ac7918dec6516215801e39a

SHA512
8f389d7f2b7fbf508a23b29ee4d282fbeedaf94cb3de182df8886680bdc752c35fdd0e94b0034ea3dbc440b1a5e87387bea3994241e3e4eb77af091000a57f05

Download Submit
C:\Users\Admin\AppData\Local\Temp\pwqidta.exe
MD5
446e594e266f5e52064fd69a333867f6

SHA1
5c94d21af50f54472cee2cbdb09ec5c7d3361916

SHA256
128a0f0cd5d10f864d5a0741ba25996b2bf74f580ac7918dec6516215801e39a

SHA512
8f389d7f2b7fbf508a23b29ee4d282fbeedaf94cb3de182df8886680bdc752c35fdd0e94b0034ea3dbc440b1a5e87387bea3994241e3e4eb77af091000a57f05

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1280_720_POS4.JPG.jbeixtg
MD5
457f1a6b774c316ae84040ce0bd8f14a

SHA1
f30c1f034c4e11aa6ad6a12a7059375bf471acc1

SHA256
93d5e077461f7657608f8845103b67bdb385e0d88f2b2f75e8808df0d6551c09

SHA512
437a79e68adbe6ad7691b58022f205fab62f8764072843e2ed370535379790f18ebabe399652136a9abe6d3c689c51555470a193f74a6bd21890f8fcaed6acd4

Download Submit
memory/716-122-0x0000000010E10000-0x0000000010E87000-memory.dmp

Filesize
476KB

Download
memory/1796-118-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1796-114-0x00000000024D0000-0x00000000026EA000-memory.dmp

Filesize
2.1MB

Download
memory/1796-115-0x00000000026F0000-0x000000000293B000-memory.dmp

Filesize
2.3MB

Download
memory/1796-119-0x0000000000400000-0x000000000058C000-memory.dmp

Filesize
1.5MB

Download
memory/2388-131-0x0000000000000000-mapping.dmp

Download
memory/2388-134-0x00000000026A0000-0x00000000028EB000-memory.dmp

Filesize
2.3MB

Download
memory/2536-129-0x0000000000000000-mapping.dmp

Download
memory/2616-121-0x0000000001390000-0x00000000015DB000-memory.dmp

Filesize
2.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads