564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd

General

Target

6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe
Size

98KB
MD5

6ac062d21f08f139d9f3d1e335e72e22
SHA1

9e967a759e894a83c4b693e81c031d7214a8e699
SHA256

564154a2e3647318ca40a5ffa68d06b1bd40b606cae1d15985e3d15097b512cd
SHA512

0a02068f6e22a41f4037d01882e32fc7bacf515818cf4f721960b987393da6b1d32ff4aa1b5fa73d546908cb85ded211061b37f4731ed643b8182909008a6892
SSDEEP

1536:0bPX/gJxDFgu02gM+LXbtQ5IxWwbglROAnbFmYVKCKclF:0cxz1gxXSNwbYcYVKhYF

Score

10^/10

persistence ransomware

Malware Config

Extracted

Path

C:\PerfLogs\# How to Decrypt Files-S9HRF.html

Ransom Note

<!DOCTYPE html> <html lang="en"> <head> <meta charset="utf-8"> <title>Decryption Instructions</title> <style> a { color: #04a; text-decoration: none; } a:hover { text-decoration: underline; } body { background-color: #e7e7e7; color: #222; font-family: "Lucida Sans Unicode", "Lucida Grande", sans-serif; font-size: 12pt; line-height: 16pt; } body, h1 { margin: 0; padding: 0; } h1 { color: #555; text-align: center; padding-bottom: 1.5em; line-height: 1.2; } h2 { color: #555; text-align: center; line-height: 1.2; } ol li { padding-bottom: 13pt; } .container { background-color: white; border: 2pt solid #C7C7C7; margin: 3%; min-width: 600px; padding: 5% 10%; color: #444; } .header { border-bottom: 2pt solid #c7c7c7; padding-bottom: 5%; } .hr { display: block; height: 2pt; margin-top: 1.5%; margin-bottom: 1.5%; overflow: hidden; width: 100%; } .info { border: 1px solid #888; background-color: #E4E4E4; padding: 0.5em 3em; margin: 1em 0; } .text { text-align: justify; } .lsb{ display: none; margin: 3%; text-align: center; } .ls { cursor: pointer; border: 1px solid #888; border-radius: 3px; padding: 0 0.5em; margin: 0.2em 0.1em; line-height: 2em; display: inline-block; } .ls:hover { background-color: #D0D0D0; } .l { display: none; } .lu { display: none; } #change_language { float: right; display: none; } </style> </head> <body onload='javascript:onPageLoaded()'> <div class='lsb'> </div> <div class='container'> <div class="text l l-en" style='display:block'> <div> <img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAL8AAAEICAMAAAA5jNVNAAAAeFBMVEX///8AAAD8/PxQUFCJiYk0NDSenp5TU1M9PT329vb6+vrv7+/z8/Pl5eXKyspfX18oKCjCwsKPj4/o6Oivr699fX1xcXGioqLa2tq7u7uTk5PS0tI6OjogICCCgoJoaGh1dXUXFxeqqqpHR0cODg4cHBxaWlotLS1/4KDGAAAHlUlEQVR4nO2daVciPRCFaRpkRzYXXNCGUf7/P3zldUZn6O6bSmrDc3I/a/IASaVSqVQ6HQWt55v97rpcLIo/el4cXnr77eNYoztBjZZ3L78KpPJqO/WmbNZks8PoX6p226437ZnuV0ca+9fvsB95M39ptqri4D91vfUGP6m7GabAf+rBey5MVunw/+t17Ug/e2XSu36CyY0A/Uk7j6ncvRKiP2lvjj9fhKkiVN6b0k9vRelPujLEX1bi+EUxMJvHPQX6k+Ym9OtSCd9mDD2+qeEXxa26X7dVpP9QqexQ3OniF8Vhpon/oI1fFH3FD2CAr/kBTPD1PoCkwwM1nGjgb6zwP6yQghmd2+EXxYs4/qyy5C9Wwvjjgyl+UQjv7eX95ZBENwSGc/ePDoKxxvv47qvypne1Xc5n6/lye9W7KavYFnZi+N1Ij7nsbdfTMxPYna43u7hI0VKKP2rhetlMWq33eH03oLe0EFrGIkZPuQn6v7OHitraqwz/O7k/ms3obqixC5ENJXXH8hrhdm1om7gnARs0pX1Zgzh73aXFTR/4/LSO4pfLGckYsV3pGaWX9yRLsSO0fMvlp8RoU3/lJaHtRx4+xXamrzOE1q95/AS/jeNoEUYny4YS2ufNsEmw/QGn+fDo5xqI8DfE+AEmwQNd/gr5GOqCMQOCtl8i4BrcWyRPsGnoTPpdAL/TCR0CJq8BQc9HKMwR8lBS/eiQ48lcW74UmsOJwYhQszdC+MHA5DHtfDU0ewU32IERlLTCj59wo5IRmkBwL8mEBgzzQRC/07nGnaUcTQbWXqnJ+6nAXEtYZ0bY+DP9wpqwo3iIt9SB4SP79Qdd6Xg3Cw+fUhg/NAOit0gjbH3EYmNfwiYoegDh3/NZHD+0BsQOILwkahz04yhlbI/Y99E4YMNbsUh7J9oYUXgGx31leDZtVPjxRibOXcEpPjr5dlPYZ5y3C8P0OsMnMICiYrl4+GtlC+LklhgfDg9/rUQ17MTFTDq4dekr4Xe6cAmLmQAvqKGeFj/2uYb0CYDPLPTS3rEFpa8Aa6F2YoX7pcf6YOBnoZcjOH5GHdPDKHD6so9EgOAujJ5UA5vRTDKFPuiCuuyP+qgZzSxffKJEnXh49dW8bIBdIOo3B/deleYdOjyBqSMXmmGZmHmb4MJJXYGh86y3+ga7HhAtNzxQ0M1xhy5oRZt6OF1J99IcjprRktNHcBKp5ocHDBAt6OdnPj++O9g3beMEtxFvuleQuzArheYBwUUwIRIcJWhAaSmJ0AZoem8nQQNKCxxA71PX/Afiln3S4IV5RQIZXVB4C0YyHnAIat+0xJEPygKAly/5wP+/wgsAZfHBB1/S50Zx/JTecQvaV41HMDOUEsPy5R/DX/+O0IKn+9AJHJxQrB90HxbqFUyg805ZfaAF66tfEIWrD4Ufuj9aof9vsWNPe19+GAKqb76758L8vfo/yAp3/177835NcPf19lT/B1nB7ou3s7/uwL++fGV+X2V+X2V+X2V+X2V+X2V+X2V+X2V+XzXyHwflBWrQlNXQxP80Ut7jpqlxZ9/Erx9jSBOVn3XjU1GZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31eZ31fW/N35ditZBdOW//F3Gt2NWMKxJf/krys0K6GcFUP++T+Fm4YyFybt+GtJnCLTwIy/oSOJS0tW/I0ZMAK/gBF/y+VDvhmy4W+7AXJkv0xgwr9uLRl3zTWjFvyoTje3JrgFP7xBzcz9NuDHFeN+8W4+6/Pj+9PckxF9/kAVLmbhEXX+cD1Y1ghS5w8UjDuJc/1Hm5/0wgRjFdPmJz2GR7mB4MM/puBzyvYp81OqORec6hfK/MRXAtJNqDI/8S3IdC9ImZ/4wkr6BVBlflj04lvp9QuU+Qmr10npN4Au4/tPN6DK/EHn7VPpPqgyP/El3XQPSJmf+LRfev0LZX7SSxOcQJC2/1aR+NMvUGrzU97jKF6T8dX5Se8MMe5vq++/CB4E5/7qBex/WRt4/fhD8Adg1Y7T5w++ZcE6BjCIvwWei7n0+FVnhB8sufT4YSCGcvnxW7gL5pausTl/aa3+wi4cZ3T+1VK6mP8WnBF/c+X6J/7D3Fbnp9OGGlwC+Ibn77UaJkOJZ9EN8x/O1rGDSNUXQ/6zBAiZt2QN+c9jiSI5QHb8NRPEiPp/y46/dg4p8h63Y/4P8+TXmr9+Cv+T8n+aKrBJPAZtxt8QyYooHu/P39SRgAU142+KRAuU/TXz3xralLjUasXfnETzc/zn5hwmfuFKI/5x8+MT/NcWjfhbwrg/Zv/YVsGWbUFt+FvLt7ItqA1/a/lNtgW14W8vIMy1oDb87WkcXAtqwj+uWvm5PqgJPzgE41pQ7/gt14Ka8KMsCOYu3oIfvj/A3MVb8OMTMF4YzoIfJ/HxdvEW/DiJj3eDwYAfv/9TlKwrJAb8uPY404Uw4A9lELAevzHg3x+HSH3W6xP5/rKvMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vMr+vfjp/0wXRJv7jqneJWjVdLGji/0nK/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L7K/L76DxuakMqfwNR4AAAAAElFTkSuQmCC" alt="LockLogo" /> </div> <samp># All your files has been encrypted by "KRAKEN CRYPTOR".</samp> <samp># Read the following instructions carefully to decrypt your files.</samp> <div class="info"> -----BEGIN KRAKEN ENCRYPTED UNIQUE KEY----- i+btTwvM3RJn0gPGBAyd/RK01cEMn9yP2Xi8Qnb1X9kqTlVd2RqW9X7buqpcWKOm O+cdUhJ3Id4SNEBWHuyHedqhZrNfIYNIBtUPAmv2ej2bFM8o12a0M15aUyDd9qqi t7ialpmlpf9HjjoinDc2wVgPQZ6JbatVEQtPQtdm1g/qD1yKsQcjFj2xH8rNNpjc nK9H9RXEoGmdmMPppL49/k3kzCvHU+j/x3C8jDiElKImhB0aG7JZkC+sjGvacFDr f2oBJULl4oZM4dbCySQ3ULWSdTGc9etjl9pl7W3WLX9ipHK826OpLMtoDmSVq0wi Ldx35wgjPuE5ayzTVTn8bEyqDC+pfbd1VLRLi6kTDAtAQEnkykzKx3nWPATAxiDp qUZZgMwmGk1ozMYxGEueKFmRirBSPZ/rI8EXYW5mWigUbXgo8i2iTLuU8F3qO9ag w2NbmUjFbPCYEzgY8DBq1bcLTVQ3GmrQnli6LImCcRsfDHTgCN9hs1980xYqOTF0 4iOSxSNbgiMXDG3JeIpMQ218MCVnIszxO+9NiQdwF9pdf+HhvoHeY+r9fsgxB2DY eOFzg3VG2h8CnuQfYT5SbaGgZtEtdHtzNPnn5YzOhbTO/Z7tYeP6FxDUhG3c5lk1 PcKsRXTo7GprJ5uvpqUA/6c7aGGaAv0pmO1/bhAC1hqiBp5WDGfX03Dhe2w9qKfZ i6FREbMfscqpqmyNbizsPVvH4vJ2JQ== -----END KRAKEN ENCRYPTED UNIQUE KEY----- </div> Extension <div class="info"> .S9HRF </div> What happened to my computer? <hr> All of your files such as documents, images, videos and other files with the different names and extensions are encrypted by "KRAKEN CRYPTOR"! Don't delete .S9HRF files! there are not virus and are your files, but encrypted! The speed, power and complexity of this encryption have been high and if you are now viewing this guide. It means that "KRAKEN CRYPTOR" immediately removed form your system! No way to recovery your files without "KRAKEN DECRYPTOR" software and your computer "UNIQUE KEY"! You need to buy it from us because only we can help you! How can recovery my files? <hr> We guarantee that you can recover all your files soon safely. You can decrypt one of your encrypted smaller file for free in the first contact with us. For the decryption service, we also need your "KRAKEN ENCRYPTED UNIQUE KEY" you can see this in the top! Are you want to decrypt all of your encrypted files? If yes! You need to pay for decryption service to us! After your payment made, all of your encrypted files has been decrypted. How much is need to pay? <hr> You need to pay (0.256 BTC), payment only can made as Bitcoins. This links help you to understand whats is a Bitcoins and how it work. <a href="https://wikipedia.org/wiki/Bitcoin">https://en.wikipedia.org/wiki/Bitcoin</a> This price is for the contact with us in first week otherwise it will increase. Where can buy Bitcoins? <hr> The easiest way to buy Bitcoins is LocalBitcoins website. You must register on this site and click "BUY Bitcoins" then choose your country to find sellers and their prices. <a href="https://localBitcoins.com">https://localBitcoins.com</a> Other places to buy Bitcoins in exchange for other currencies worldwide: <a href="https://www.bestbitcoinexchange.io/">https://www.bestbitcoinexchange.io</a> How to contact you? <hr> We use best and easy way to communications. It's email support, you can see our emails below. Please send your message with same subject to both address. E-Mail <div class="info"> [email protected] </div> Alternative <div class="info"> [email protected] </div> Attention <hr> <ul type="disc"> <li>DON'T MODIFY OR RENAME ENCRYPTED FILES.</li> <li>DON'T MODIFY "KRAKEN ENCRYPT UNIQUE KEY".</li> <li>DON'T USE THIRD PARTY, PUBLIC TOOLS/SOFTWARE TO DECRYPT YOUR FILES, THIS CAUSE DAMAGE YOUR FILES PERMANENTLY.</li> <li>DON'T ASK PEOPLE OR DATA RECOVERY CENTERS, THEY ARE MAY ADD EXTRA CHARGE.</li> </ul> Additional <hr> <ul type="square"> <li>Project "KRAKEN CRYPTOR" doesn't damage any of your files, this action is reversible if you follow the instructions above.</li> <li>Also, our policy is obvious: "NO PAYMENT, NO DECRYPT".</li> </ul> </div> </div> </body> </html>

Emails

[email protected]

Signatures

Executes dropped EXE 1 IoCs

Processes:

krakentemp0000.exe

pid process

2648 krakentemp0000.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\Payload = "C:\\Users\\Admin\\AppData\\Local\\Temp\\krakentemp0000.exe"	6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe

Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

9 ipinfo.io
10 ipinfo.io
4 ipinfo.io
5 ipinfo.io
6 ipinfo.io
7 ipinfo.io
8 ipinfo.io
Drops file in Program Files directory 2 IoCs

Processes:

krakentemp0000.exe

description ioc process

File created C:\Program Files\Touch krakentemp0000.exe
File created C:\Program Files (x86)\Touch krakentemp0000.exe
Drops file in Windows directory 1 IoCs

Processes:

krakentemp0000.exe

description ioc process

File created C:\Windows\Touch krakentemp0000.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery
T1057

Processes:

tasklist.exe

pid process

3068 tasklist.exe

flow	ioc
9	ipinfo.io
10	ipinfo.io
4	ipinfo.io
5	ipinfo.io
6	ipinfo.io
7	ipinfo.io
8	ipinfo.io

description	ioc	process
File created	C:\Program Files\Touch	krakentemp0000.exe
File created	C:\Program Files (x86)\Touch	krakentemp0000.exe

description	ioc	process
File created	C:\Windows\Touch	krakentemp0000.exe

pid	process
3068	tasklist.exe

Modifies registry class 5 IoCs

Processes:

6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile	6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell	6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open	6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\krakentemp0000.exe"	6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe
Key created	\REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000_CLASSES\mscfile\shell\open\command	6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1676 PING.EXE

pid	process
1676	PING.EXE

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

krakentemp0000.exetasklist.exe

pid	process
2648	krakentemp0000.exe
2648	krakentemp0000.exe
2648	krakentemp0000.exe
2648	krakentemp0000.exe
2648	krakentemp0000.exe
2648	krakentemp0000.exe
2648	krakentemp0000.exe
2648	krakentemp0000.exe
2648	krakentemp0000.exe
2648	krakentemp0000.exe
2648	krakentemp0000.exe
3068	tasklist.exe
3068	tasklist.exe
2648	krakentemp0000.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

krakentemp0000.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	2648	krakentemp0000.exe
Token: SeIncBasePriorityPrivilege	2648	krakentemp0000.exe
Token: SeDebugPrivilege	3068	tasklist.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exeeventvwr.exekrakentemp0000.execmd.exe

description	pid	process	target process
PID 2836 wrote to memory of 2516	2836	6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe	eventvwr.exe
PID 2836 wrote to memory of 2516	2836	6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe	eventvwr.exe
PID 2836 wrote to memory of 2516	2836	6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe	eventvwr.exe
PID 2516 wrote to memory of 2648	2516	eventvwr.exe	krakentemp0000.exe
PID 2516 wrote to memory of 2648	2516	eventvwr.exe	krakentemp0000.exe
PID 2516 wrote to memory of 2648	2516	eventvwr.exe	krakentemp0000.exe
PID 2516 wrote to memory of 2648	2516	eventvwr.exe	krakentemp0000.exe
PID 2648 wrote to memory of 3068	2648	krakentemp0000.exe	tasklist.exe
PID 2648 wrote to memory of 3068	2648	krakentemp0000.exe	tasklist.exe
PID 2648 wrote to memory of 3068	2648	krakentemp0000.exe	tasklist.exe
PID 2648 wrote to memory of 3068	2648	krakentemp0000.exe	tasklist.exe
PID 2648 wrote to memory of 1876	2648	krakentemp0000.exe	cmd.exe
PID 2648 wrote to memory of 1876	2648	krakentemp0000.exe	cmd.exe
PID 2648 wrote to memory of 1876	2648	krakentemp0000.exe	cmd.exe
PID 2648 wrote to memory of 1876	2648	krakentemp0000.exe	cmd.exe
PID 1876 wrote to memory of 1676	1876	cmd.exe	PING.EXE
PID 1876 wrote to memory of 1676	1876	cmd.exe	PING.EXE
PID 1876 wrote to memory of 1676	1876	cmd.exe	PING.EXE
PID 1876 wrote to memory of 1676	1876	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\6ac062d21f08f139d9f3d1e335e72e22_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2836

C:\Windows\System32\eventvwr.exe
"C:\Windows\System32\eventvwr.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2516

C:\Users\Admin\AppData\Local\Temp\krakentemp0000.exe
"C:\Users\Admin\AppData\Local\Temp\krakentemp0000.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648

C:\Windows\SysWOW64\tasklist.exe
"tasklist" /V /FO CSV
4⤵
- Enumerates processes with tasklist
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3068

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C ping 127.0.0.1 -n 3 > NUL&&del /Q /F /S "C:\Users\Admin\AppData\Local\Temp\krakentemp0000.exe"
4⤵
- Suspicious use of WriteProcessMemory
PID:1876

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 3
5⤵
- Runs ping.exe
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Process Discovery

1

T1057

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PerfLogs\# How to Decrypt Files-S9HRF.html
Filesize
9KB

MD5
83ef98ab324a835586867432b720b477

SHA1
e18847b5508efff9d5d5def52f13633ec6cc37d6

SHA256
bb238a1ba75a264d80ba8eb6162f3ac4654ae370e7604c9111edf10a95c70a03

SHA512
b09878ebdd7474144a20d294e6e41f32884373bff3f2abc6758da0ce22f94d9123540bf906f4e7304b4d1ebfba9b1caa5ad6d64c3a8e720c02b1eacd1e201c19

Download Submit
C:\Users\Admin\AppData\Local\Temp\krakentemp0000.exe
Filesize
91KB

MD5
b8665cf00d32352ee83ceb189595a753

SHA1
669605b2968e3eca80c9366f973dc589057227e5

SHA256
7e0ee0e707db426eaf25bd0924631db969bb03dd9b13addffbcc33311a3b9aa7

SHA512
de6ec58e018a8db2538c0e5ae3942ea3ec370a9724e2f734e5c3898d8867213f25116a7793309e87c04548d1180aeb7d57bda37c0d60c4f3d2fa390e509f1a28

Download Submit
memory/2648-6-0x0000000000190000-0x00000000001D0000-memory.dmp

Filesize
256KB

Download
memory/2648-426-0x0000000000190000-0x00000000001D0000-memory.dmp

Filesize
256KB

Download
memory/2836-0-0x000007FEF5DFE000-0x000007FEF5DFF000-memory.dmp

Filesize
4KB

Download
memory/2836-2-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Filesize
9.6MB

Download
memory/2836-5-0x000007FEF5B40000-0x000007FEF64DD000-memory.dmp

Filesize
9.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads