ctblocker | b0577ed39fe9f9047c390a259e0c18c55396fd88a82531fc2bbe8f6b0fb078a2

General

Target

b0577ed39fe9f9047c390a259e0c18c55396fd88a82531fc2bbe8f6b0fb078a2.exe
Size

323KB
MD5

9b9bf35eedda09aa86f25333114dd1d4
SHA1

f64f3f72db97b3c9119284f7ca4d641c41805aa0
SHA256

b0577ed39fe9f9047c390a259e0c18c55396fd88a82531fc2bbe8f6b0fb078a2
SHA512

038c21a487128b61e419f9210adabe3ddca60c8c3d2474a8c0508076f452a2aa2a0a6aff1965c8633fe8befeafe0d140fc20f05d799854e4596367fe3c2667bb
SSDEEP

6144:D5tAt50415jKxZEu4ulgR/nkKmaDRZ/P/e:DnAt5PjKDLinDne

Score

10^/10

ctblocker ransomware

Malware Config

Extracted

Path

C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-stzhzxi.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://pf5dahldauhrjxfd.onion.cab or http://pf5dahldauhrjxfd.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://pf5dahldauhrjxfd.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. NFPK5L5-C6GM3W6-ZXURFAG-BNORYZZ-U2VGNBW-YLPEBMV-DMQRTYN-QTO2MG5 PL2ZXB2-FBESVVK-YUBQIBJ-H3M4M4H-SNRQ7DU-7USB7DH-2274MII-5TQH3L7 QDXRU36-3N6QTZQ-5PASAFV-OKRD4MZ-UOUF3VK-BI2XTNY-P2SKJAZ-I6IAWI6 Follow the instructions on the server.

URLs

http://pf5dahldauhrjxfd.onion.cab

http://pf5dahldauhrjxfd.tor2web.org

http://pf5dahldauhrjxfd.onion/

Extracted

Path

C:\Users\Admin\Documents\!Decrypt-All-Files-stzhzxi.txt

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://pf5dahldauhrjxfd.onion.cab or http://pf5dahldauhrjxfd.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org 2. In the Tor Browser open the http://pf5dahldauhrjxfd.onion/ Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. NFPK5L5-C6GM3W6-ZXURFAG-BNORYZZ-U2VGNBW-YLPEBMV-DMQRTYN-QTO2MG5 PL2ZXB2-FBESVVK-YUBQIBJ-H3M4M4H-SNRQ7DU-7USB7DH-2274MII-5TQH3L7 QDXRU36-3N6QTZQ-5PASAFV-OKRD4MZ-UOUF2GK-LR2XTNY-P2SKJAZ-I6IQV7D Follow the instructions on the server.

URLs

http://pf5dahldauhrjxfd.onion.cab

http://pf5dahldauhrjxfd.tor2web.org

http://pf5dahldauhrjxfd.onion/

Extracted

Path

C:\ProgramData\zlwdkgg.html

Ransom Note

Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. Private decryption key is stored on a secret Internet server and nobody can decrypt your files until you pay and obtain the private key. If you see the main locker window, follow the instructions on the locker. Overwise, it's seems that you or your antivirus deleted the locker program. Now you have the last chance to decrypt your files. Open http://pf5dahldauhrjxfd.onion.cab or http://pf5dahldauhrjxfd.tor2web.org in your browser. They are public gates to the secret server. If you have problems with gates, use direct connection: 1. Download Tor Browser from http://torproject.org. 2. In the Tor Browser open the http://pf5dahldauhrjxfd.onion Note that this server is available via Tor Browser only. Retry in 1 hour if site is not reachable. Copy and paste the following public key in the input form on server. Avoid missprints. Follow the instructions on the server. The list of your encrypted files: Path File

URLs

http://pf5dahldauhrjxfd.onion.cab

http://pf5dahldauhrjxfd.tor2web.org

http://pf5dahldauhrjxfd.onion

Signatures

CTB-Locker
Ransomware family which uses Tor to hide its C2 communications.
ransomware ctblocker
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 2 IoCs

pid	Process
1528	pdfisga.exe
640	pdfisga.exe

Modifies extensions of user files 3 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\ConvertFromRepair.RAW.stzhzxi	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\PingRestore.CRW.stzhzxi	svchost.exe
File renamed	C:\Windows\Temp\laaaaaaa.tmp => C:\Users\Admin\Pictures\SendMove.RAW.stzhzxi	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	pdfisga.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	svchost.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	pdfisga.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\!Decrypt-All-Files-stzhzxi.bmp"	Explorer.EXE

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-stzhzxi.txt	svchost.exe
File created	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\!Decrypt-All-Files-stzhzxi.bmp	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
932	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main	pdfisga.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	pdfisga.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	pdfisga.exe

Modifies data under HKEY_USERS 20 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Empty = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-55"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\DefaultIcon\Full = "%SystemRoot%\\System32\\imageres.dll,-54"	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{dae07ae4-2a34-11ed-86c6-806e6f6e6963}\NukeOnDelete = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\TileWallpaper = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{dae07ae4-2a34-11ed-86c6-806e6f6e6963}	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{dae07ae4-2a34-11ed-86c6-806e6f6e6963}\MaxCapacity = "15140"	svchost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\LastEnum = 30002c007b00640061006500300037006100650034002d0032006100330034002d0031003100650064002d0038003600630036002d003800300036006500360066003600650036003900360033007d0000000000	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\WallpaperStyle = "0"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	svchost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1340	b0577ed39fe9f9047c390a259e0c18c55396fd88a82531fc2bbe8f6b0fb078a2.exe
1528	pdfisga.exe
1528	pdfisga.exe
1528	pdfisga.exe
1528	pdfisga.exe
1528	pdfisga.exe
1528	pdfisga.exe
1528	pdfisga.exe
1528	pdfisga.exe
1528	pdfisga.exe
1528	pdfisga.exe
1528	pdfisga.exe
1528	pdfisga.exe
1528	pdfisga.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	pdfisga.exe
Token: SeDebugPrivilege	1528	pdfisga.exe
Token: SeShutdownPrivilege	1288	Explorer.EXE
Token: SeShutdownPrivilege	1288	Explorer.EXE

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
640	pdfisga.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
640	pdfisga.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
640	pdfisga.exe
640	pdfisga.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
1288	Explorer.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 1528	1680	taskeng.exe	28
PID 1680 wrote to memory of 1528	1680	taskeng.exe	28
PID 1680 wrote to memory of 1528	1680	taskeng.exe	28
PID 1680 wrote to memory of 1528	1680	taskeng.exe	28
PID 1528 wrote to memory of 600	1528	pdfisga.exe	25
PID 600 wrote to memory of 1784	600	svchost.exe	29
PID 600 wrote to memory of 1784	600	svchost.exe	29
PID 600 wrote to memory of 1784	600	svchost.exe	29
PID 1528 wrote to memory of 1288	1528	pdfisga.exe	17
PID 1528 wrote to memory of 932	1528	pdfisga.exe	30
PID 1528 wrote to memory of 932	1528	pdfisga.exe	30
PID 1528 wrote to memory of 932	1528	pdfisga.exe	30
PID 1528 wrote to memory of 932	1528	pdfisga.exe	30
PID 1528 wrote to memory of 640	1528	pdfisga.exe	32
PID 1528 wrote to memory of 640	1528	pdfisga.exe	32
PID 1528 wrote to memory of 640	1528	pdfisga.exe	32
PID 1528 wrote to memory of 640	1528	pdfisga.exe	32
PID 600 wrote to memory of 904	600	svchost.exe	33
PID 600 wrote to memory of 904	600	svchost.exe	33
PID 600 wrote to memory of 904	600	svchost.exe	33

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Sets desktop wallpaper using registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:1288
- C:\Users\Admin\AppData\Local\Temp\b0577ed39fe9f9047c390a259e0c18c55396fd88a82531fc2bbe8f6b0fb078a2.exe
  "C:\Users\Admin\AppData\Local\Temp\b0577ed39fe9f9047c390a259e0c18c55396fd88a82531fc2bbe8f6b0fb078a2.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
1⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:600
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
  2⤵
  PID:1784
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:904

C:\Windows\system32\taskeng.exe
taskeng.exe {9B542B09-DC55-4B33-90E2-F1FDE73DAABD} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
  C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows all
    3⤵
    - Interacts with shadow copies
    PID:932
- - C:\Users\Admin\AppData\Local\Temp\pdfisga.exe
    "C:\Users\Admin\AppData\Local\Temp\pdfisga.exe" -u
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Drops file in System32 directory
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File Deletion

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

1

T1491

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Package Cache\xptppml

Filesize
654B

MD5
155f66085319542afa3a93b4e18e3add

SHA1
5910fd5aca17ed70fd96f40072c402c71f932050

SHA256
27c293207458f47d76111483d4d030716325e75a19b91137c2e6f2b7a2520efa

SHA512
745291e02f33d7ebd0ae4a018de91d878d53428f077cc705916fb1af92f23de7918b42af48fc322314b34d4f88833407d2780c42fec789c0fda52276f2c6c1c6

Download Submit
C:\ProgramData\Package Cache\xptppml

Filesize
654B

MD5
58c52e8663992c1e3e520b86f1b914d3

SHA1
8e1afc86ec5c0081fb7fd7b830bade7101d219fc

SHA256
2dd86f5d9b71d4fc5ea5c691fe50b64a63fd2a6d41fcdaa243cebfc7b8267ff5

SHA512
17f1921bbab2966a9199e4fadf592e43b422ce6bb53c7afcd164e5d71aae606a6f042523708ebc29d05698cb833ea00167ac312dfa3e3c40ea1dcb9c85b2ced8

Download Submit
C:\ProgramData\Package Cache\xptppml

Filesize
654B

MD5
60feffcc2f7423582daec690439e2135

SHA1
59c59d2010d93515af822c6c381bf34b04cc963f

SHA256
f41f2103f0a0af7d3c79e40e7be0c138785b50aefccd7265b7ec91a1dbaa02ba

SHA512
ee1aee9be61137a2fc52ea5645f3576a349cb64dc413baddc2f2090bf9a8fbbdb8b825b897a67681bac9fc1a49608239261123241ca9e23a31d978c056b9cd91

Download Submit
C:\ProgramData\Package Cache\xptppml

Filesize
654B

MD5
60feffcc2f7423582daec690439e2135

SHA1
59c59d2010d93515af822c6c381bf34b04cc963f

SHA256
f41f2103f0a0af7d3c79e40e7be0c138785b50aefccd7265b7ec91a1dbaa02ba

SHA512
ee1aee9be61137a2fc52ea5645f3576a349cb64dc413baddc2f2090bf9a8fbbdb8b825b897a67681bac9fc1a49608239261123241ca9e23a31d978c056b9cd91

Download Submit
C:\ProgramData\zlwdkgg.html

Filesize
63KB

MD5
5e77006af65f981fb4025cc9a509805a

SHA1
a480f9f87bf5994b7c9549d04c755e8b32c7d5bf

SHA256
b864567073542f66ac46e5cc4c063a6c39ee7ed72d19628f3422a8e0ca8b993e

SHA512
019e6637d6860f9408ed491343d349b32807c5be38ecf5d71f48c1fbc4b4554b6c19de9a72c89c648a0b78a8c80d732331242ce91ca7607cde6d2d6d63e73b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
323KB

MD5
9b9bf35eedda09aa86f25333114dd1d4

SHA1
f64f3f72db97b3c9119284f7ca4d641c41805aa0

SHA256
b0577ed39fe9f9047c390a259e0c18c55396fd88a82531fc2bbe8f6b0fb078a2

SHA512
038c21a487128b61e419f9210adabe3ddca60c8c3d2474a8c0508076f452a2aa2a0a6aff1965c8633fe8befeafe0d140fc20f05d799854e4596367fe3c2667bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
323KB

MD5
9b9bf35eedda09aa86f25333114dd1d4

SHA1
f64f3f72db97b3c9119284f7ca4d641c41805aa0

SHA256
b0577ed39fe9f9047c390a259e0c18c55396fd88a82531fc2bbe8f6b0fb078a2

SHA512
038c21a487128b61e419f9210adabe3ddca60c8c3d2474a8c0508076f452a2aa2a0a6aff1965c8633fe8befeafe0d140fc20f05d799854e4596367fe3c2667bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\pdfisga.exe

Filesize
323KB

MD5
9b9bf35eedda09aa86f25333114dd1d4

SHA1
f64f3f72db97b3c9119284f7ca4d641c41805aa0

SHA256
b0577ed39fe9f9047c390a259e0c18c55396fd88a82531fc2bbe8f6b0fb078a2

SHA512
038c21a487128b61e419f9210adabe3ddca60c8c3d2474a8c0508076f452a2aa2a0a6aff1965c8633fe8befeafe0d140fc20f05d799854e4596367fe3c2667bb

Download Submit
memory/600-66-0x00000000000E0000-0x0000000000157000-memory.dmp

Filesize
476KB

Download
memory/600-72-0x000007FEFB741000-0x000007FEFB743000-memory.dmp

Filesize
8KB

Download
memory/600-68-0x00000000000E0000-0x0000000000157000-memory.dmp

Filesize
476KB

Download
memory/640-84-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/640-83-0x0000000001EE0000-0x0000000002013000-memory.dmp

Filesize
1.2MB

Download
memory/1340-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmp

Filesize
8KB

Download
memory/1340-58-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1340-57-0x0000000001EC0000-0x0000000001FF3000-memory.dmp

Filesize
1.2MB

Download
memory/1340-56-0x0000000000640000-0x0000000000742000-memory.dmp

Filesize
1.0MB

Download
memory/1340-55-0x0000000000230000-0x0000000000235000-memory.dmp

Filesize
20KB

Download
memory/1528-65-0x0000000000400000-0x000000000046D000-memory.dmp

Filesize
436KB

Download
memory/1528-64-0x0000000000A20000-0x0000000000B53000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads