

<!DOCTYPE html>

<html lang="en-US">
<head>
  <meta charset="UTF-8">
  <meta http-equiv="X-UA-Compatible" content="IE=Edge">

  <link rel="stylesheet" href="/cyberdefender-writeups/assets/css/just-the-docs-default.css">

  <link rel="stylesheet" href="/cyberdefender-writeups/assets/css/just-the-docs-head-nav.css" id="jtd-head-nav-stylesheet">

  <style id="jtd-nav-activation">
  
    .site-nav ul li a {
      background-image: none;
    }

  </style>

  

  
    <script src="/cyberdefender-writeups/assets/js/vendor/lunr.min.js"></script>
  

  <script src="/cyberdefender-writeups/assets/js/just-the-docs.js"></script>

  <meta name="viewport" content="width=device-width, initial-scale=1">

  



  <!-- Begin Jekyll SEO tag v2.8.0 -->
<title>CyberDefender Writeups | Blue team CTF writeups covering malware analysis, endpoint forensics, network forensics, reverse engineering, and threat hunting.</title>
<meta name="generator" content="Jekyll v3.10.0" />
<meta property="og:title" content="CyberDefender Writeups" />
<meta property="og:locale" content="en_US" />
<meta name="description" content="Blue team CTF writeups covering malware analysis, endpoint forensics, network forensics, reverse engineering, and threat hunting." />
<meta property="og:description" content="Blue team CTF writeups covering malware analysis, endpoint forensics, network forensics, reverse engineering, and threat hunting." />
<link rel="canonical" href="https://francisvillalon.github.io/cyberdefender-writeups/assets/css/just-the-docs-head-nav.css" />
<meta property="og:url" content="https://francisvillalon.github.io/cyberdefender-writeups/assets/css/just-the-docs-head-nav.css" />
<meta property="og:site_name" content="CyberDefender Writeups" />
<meta property="og:type" content="website" />
<meta name="twitter:card" content="summary" />
<meta property="twitter:title" content="CyberDefender Writeups" />
<script type="application/ld+json">
{"@context":"https://schema.org","@type":"WebPage","description":"Blue team CTF writeups covering malware analysis, endpoint forensics, network forensics, reverse engineering, and threat hunting.","headline":"CyberDefender Writeups","url":"https://francisvillalon.github.io/cyberdefender-writeups/assets/css/just-the-docs-head-nav.css"}</script>
<!-- End Jekyll SEO tag -->


  <link rel="icon" href="data:image/svg+xml,<svg xmlns=%22http://www.w3.org/2000/svg%22 viewBox=%220 0 100 100%22><text y=%22.9em%22 font-size=%2290%22>%F0%9F%9B%A1%EF%B8%8F</text></svg>">

<style>
  .site-header {
    display: flex !important;
    flex-direction: column;
    align-items: center;
    height: auto !important;
    max-height: none !important;
    min-height: 0 !important;
    padding: 40px 16px 28px 16px !important;
    border-bottom: 1px solid rgba(128, 128, 128, 0.25) !important;
    text-align: center;
  }

  .site-title {
    font-size: 17px !important;
    font-weight: 600;
    letter-spacing: -0.01em;
    padding: 0 !important;
    line-height: 1.3 !important;
    display: flex;
    align-items: center;
    gap: 8px;
  }

  .site-title::before {
    content: "🛡";
    font-size: 18px;
  }

  .site-title.profile-title {
    flex-direction: column;
    gap: 4px;
    width: 100%;
  }

  .site-title.profile-title::before {
    content: none;
  }

  .profile-avatar {
    width: 104px;
    height: 104px;
    border-radius: 50%;
    border: 3px solid rgba(255, 255, 255, 0.12);
    margin-bottom: 14px;
  }

  .profile-name {
    font-size: 19px;
    font-weight: 700;
  }

  .profile-brand {
    font-size: 12px;
    font-weight: 400;
    opacity: 0.55;
    margin-top: 2px;
  }

  .profile-links {
    display: flex;
    align-items: center;
    justify-content: center;
    gap: 8px;
    margin-top: 14px;
    font-size: 13px;
  }

  .profile-links a {
    color: #a996f5;
    text-decoration: none;
  }

  .profile-links a:hover {
    text-decoration: underline;
  }

  .profile-links-sep {
    opacity: 0.4;
  }

  .aux-nav {
    font-size: 14px !important;
  }

  .aux-nav-list-item .site-button,
  .aux-nav-list-item a {
    font-weight: 500;
  }

  .breadcrumb-nav-list-item {
    font-size: 15px !important;
  }

  .breadcrumb-nav-list-item::after {
    font-size: 15px;
  }

  .nav-list .nav-list-item > .nav-list {
    display: block !important;
    max-height: 0;
    overflow: hidden;
    transition: max-height 0.28s ease;
  }

  .nav-list .nav-list-item.active > .nav-list {
    max-height: 1200px;
    transition: max-height 0.4s ease;
  }

  .nav-list-expander svg {
    transition: transform 0.25s ease;
  }

  .nav-list-item > .nav-list-link {
    cursor: pointer;
  }

  .gh-alert {
    border-left-width: 4px !important;
    border-radius: 0 6px 6px 0;
    padding: 12px 16px !important;
  }

  .gh-alert-title {
    margin: 0 0 6px 0 !important;
    font-weight: 600;
    display: flex;
    align-items: center;
    gap: 6px;
  }

  .gh-alert-note { border-left-color: #4493f8 !important; background: rgba(68, 147, 248, 0.1) !important; }
  .gh-alert-tip { border-left-color: #3fb950 !important; background: rgba(63, 185, 80, 0.1) !important; }
  .gh-alert-important { border-left-color: #ab7df8 !important; background: rgba(171, 125, 248, 0.1) !important; }
  .gh-alert-warning { border-left-color: #d29922 !important; background: rgba(210, 153, 34, 0.1) !important; }
  .gh-alert-caution { border-left-color: #f85149 !important; background: rgba(248, 81, 73, 0.1) !important; }

  .gh-alert-note .gh-alert-title { color: #4493f8; }
  .gh-alert-tip .gh-alert-title { color: #3fb950; }
  .gh-alert-important .gh-alert-title { color: #ab7df8; }
  .gh-alert-warning .gh-alert-title { color: #d29922; }
  .gh-alert-caution .gh-alert-title { color: #f85149; }

  .whoami {
    margin: 32px 0;
    border: 1px solid rgba(128, 128, 128, 0.3);
    border-radius: 8px;
    overflow: hidden;
    background: rgba(128, 128, 128, 0.05);
    font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace;
  }

  .whoami-titlebar {
    display: flex;
    align-items: center;
    gap: 6px;
    padding: 10px 14px;
    background: rgba(128, 128, 128, 0.12);
    border-bottom: 1px solid rgba(128, 128, 128, 0.3);
  }

  .whoami-dot {
    width: 10px;
    height: 10px;
    border-radius: 50%;
    display: inline-block;
  }

  .whoami-dot-red { background: #ff5f56; }
  .whoami-dot-yellow { background: #ffbd2e; }
  .whoami-dot-green { background: #27c93f; }

  .whoami-titletext {
    margin-left: 8px;
    font-size: 12px;
    opacity: 0.6;
  }

  .whoami-body {
    padding: 18px 20px;
    font-size: 14px;
    line-height: 1.6;
  }

  .whoami-body p {
    margin: 0 0 6px 0;
  }

  .whoami-prompt {
    color: #27c93f;
  }

  .whoami-name {
    font-size: 17px;
    font-weight: 600;
    margin-top: 10px !important;
  }

  .whoami-focus {
    opacity: 0.6;
    margin-bottom: 14px !important;
  }

  .whoami-bio {
    font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Helvetica, Arial, sans-serif;
    opacity: 0.85;
    margin-bottom: 14px !important;
  }

  .whoami-links a {
    margin-right: 16px;
    color: #7253ed;
  }

  .side-bar .nav-list-link,
  .site-nav .nav-list-link {
    font-size: 15px !important;
    padding-top: 7px !important;
    padding-bottom: 7px !important;
    color: rgba(255, 255, 255, 0.75) !important;
  }

  .side-bar .nav-list-link:hover,
  .site-nav .nav-list-link:hover {
    color: rgba(255, 255, 255, 0.95) !important;
  }

  .side-bar .nav-list-link.active {
    color: #ffffff !important;
    font-weight: 600;
  }

  .writeup-grid {
    display: grid;
    grid-template-columns: repeat(auto-fill, minmax(200px, 1fr));
    gap: 12px;
    margin: 32px 0;
  }

  .writeup-card {
    display: flex;
    flex-direction: column;
    justify-content: space-between;
    gap: 10px;
    min-height: 76px;
    padding: 14px 16px;
    border: 1px solid rgba(128, 128, 128, 0.3);
    border-radius: 8px;
    text-decoration: none;
    color: inherit;
    transition: border-color 0.15s ease, transform 0.15s ease;
  }

  .writeup-card:hover {
    border-color: #7253ed;
    transform: translateY(-2px);
  }

  .writeup-card-title {
    font-size: 14px;
    font-weight: 500;
    white-space: nowrap;
    overflow: hidden;
    text-overflow: ellipsis;
  }

  .difficulty-pill {
    align-self: flex-start;
    font-size: 10px;
    font-weight: 600;
    text-transform: uppercase;
    letter-spacing: 0.04em;
    padding: 2px 8px;
    border-radius: 999px;
  }

  .difficulty-easy {
    color: #27c93f;
    background: rgba(39, 201, 63, 0.15);
  }

  .difficulty-medium {
    color: #ffbd2e;
    background: rgba(255, 189, 46, 0.15);
  }

  .difficulty-hard {
    color: #ff5f56;
    background: rgba(255, 95, 86, 0.15);
  }

  .category-grid {
    display: grid;
    grid-template-columns: repeat(auto-fill, minmax(220px, 1fr));
    gap: 16px;
    margin: 32px 0;
  }

  .category-card {
    display: flex;
    flex-direction: column;
    padding: 20px;
    border: 1px solid rgba(128, 128, 128, 0.3);
    border-radius: 8px;
    text-decoration: none;
    color: inherit;
    transition: border-color 0.15s ease, transform 0.15s ease;
  }

  .category-card:hover {
    border-color: #7253ed;
    transform: translateY(-2px);
  }

  .category-card .category-card-title {
    margin: 0 0 8px 0;
    font-size: 16px;
    font-weight: 600;
  }

  .category-card p {
    margin: 0 0 12px 0;
    font-size: 13px;
    opacity: 0.75;
    line-height: 1.5;
  }

  .category-card .category-count {
    margin-top: auto;
    padding-top: 12px;
    font-size: 11px;
    text-transform: uppercase;
    letter-spacing: 0.05em;
    opacity: 0.55;
  }

  #page-toc {
    position: fixed;
    top: 100px;
    right: 24px;
    width: 220px;
    max-height: calc(100vh - 140px);
    overflow-y: auto;
    font-size: 13px;
    line-height: 1.5;
    z-index: 5;
  }

  #page-toc .page-toc-title {
    font-weight: 600;
    text-transform: uppercase;
    font-size: 11px;
    letter-spacing: 0.05em;
    opacity: 0.6;
    margin-bottom: 8px;
  }

  #page-toc ul {
    list-style: none;
    margin: 0;
    padding: 0;
    border-left: 1px solid rgba(128, 128, 128, 0.3);
  }

  #page-toc li {
    margin: 0;
  }

  #page-toc a {
    display: block;
    padding: 3px 0 3px 12px;
    color: inherit;
    opacity: 0.65;
    text-decoration: none;
    border-left: 2px solid transparent;
    margin-left: -1px;
  }

  #page-toc a:hover {
    opacity: 1;
  }

  #page-toc a.toc-h1 {
    font-weight: 600;
    opacity: 0.85;
  }

  #page-toc a.toc-h2 {
    padding-left: 24px;
  }

  #page-toc a.toc-h3 {
    padding-left: 36px;
  }

  #page-toc a.active {
    opacity: 1;
    border-left: 2px solid #7253ed;
  }

  @media (max-width: 1400px) {
    #page-toc {
      display: none;
    }
  }

  .tag-pills {
    display: flex;
    flex-wrap: wrap;
    gap: 6px;
    margin: 4px 0 32px 0 !important;
  }

  .tag-pill {
    font-family: SFMono-Regular, Consolas, "Liberation Mono", Menlo, monospace;
    font-size: 11px;
    padding: 3px 9px;
    border-radius: 999px;
    background: rgba(114, 83, 237, 0.14);
    color: #a996f5;
    white-space: nowrap;
  }

  .main-content h1 {
    margin-top: 52px !important;
    padding-top: 24px !important;
    border-top: 1px solid rgba(128, 128, 128, 0.2);
  }

  .main-content h1:first-of-type {
    margin-top: 0 !important;
    padding-top: 0 !important;
    border-top: none;
  }

  .main-content h2 {
    margin-top: 36px !important;
    padding-left: 12px;
    border-left: 3px solid rgba(114, 83, 237, 0.45);
  }

  .main-content h3 {
    margin-top: 28px !important;
  }

  .main-content p {
    line-height: 1.7;
  }

  .main-content blockquote {
    border-left: 3px solid #7253ed;
    background: rgba(114, 83, 237, 0.08);
    padding: 10px 16px;
    border-radius: 0 6px 6px 0;
    margin: 16px 0 !important;
  }

  .main-content blockquote p {
    margin: 0 !important;
    opacity: 0.85;
  }

  .main-content p:has(> em:only-child) {
    font-size: 12px;
    opacity: 0.6;
    text-align: center;
    margin-top: 4px !important;
    margin-bottom: 28px !important;
  }

  .main-content p:has(> img:only-child) {
    text-align: center;
    margin-bottom: 4px !important;
  }
</style>

<script>
  document.addEventListener("DOMContentLoaded", function () {
    var siteTitle = document.querySelector(".site-title");
    if (!siteTitle) return;

    siteTitle.innerHTML = "";
    siteTitle.classList.add("profile-title");

    var avatar = document.createElement("img");
    avatar.className = "profile-avatar";
    avatar.src = "https://github.com/FrancisVillalon.png";
    avatar.alt = "";
    siteTitle.appendChild(avatar);

    var name = document.createElement("span");
    name.className = "profile-name";
    name.textContent = "Francis Villalon";
    siteTitle.appendChild(name);

    var brand = document.createElement("span");
    brand.className = "profile-brand";
    brand.textContent = "Cybersecurity";
    siteTitle.appendChild(brand);

    var links = document.createElement("div");
    links.className = "profile-links";
    links.innerHTML =
      '<a href="https://github.com/FrancisVillalon" target="_blank" rel="noopener">GitHub</a>' +
      '<span class="profile-links-sep">&middot;</span>' +
      '<a href="https://linkedin.com/in/francisvillalon" target="_blank" rel="noopener">LinkedIn</a>';
    siteTitle.insertAdjacentElement("afterend", links);
  });

  document.addEventListener("DOMContentLoaded", function () {
    var content = document.querySelector(".main-content");
    if (!content) return;

    var firstP = content.querySelector("p");
    if (firstP) {
      var tagText = firstP.textContent.trim();
      if (/^(#\S+\s*)+$/.test(tagText)) {
        var tags = tagText.split(/\s+/).filter(Boolean);
        firstP.textContent = "";
        firstP.className = "tag-pills";
        tags.forEach(function (tag) {
          var span = document.createElement("span");
          span.className = "tag-pill";
          span.textContent = tag;
          firstP.appendChild(span);
        });
      }
    }
  });

  document.addEventListener("DOMContentLoaded", function () {
    var content = document.querySelector(".main-content");
    if (!content) return;

    var headings = content.querySelectorAll("h1, h2, h3");
    if (headings.length < 2) return;

    var toc = document.createElement("nav");
    toc.id = "page-toc";

    var title = document.createElement("div");
    title.className = "page-toc-title";
    title.textContent = "On this page";
    toc.appendChild(title);

    var list = document.createElement("ul");

    headings.forEach(function (heading, i) {
      if (!heading.id) {
        heading.id = "toc-heading-" + i;
      }
      var li = document.createElement("li");
      var a = document.createElement("a");
      a.href = "#" + heading.id;
      a.textContent = heading.textContent.trim().replace(/\s*#\s*$/, "");
      a.className = "toc-" + heading.tagName.toLowerCase();
      a.dataset.target = heading.id;
      li.appendChild(a);
      list.appendChild(li);
    });

    toc.appendChild(list);
    document.body.appendChild(toc);

    var links = toc.querySelectorAll("a");
    var observer = new IntersectionObserver(
      function (entries) {
        entries.forEach(function (entry) {
          var link = toc.querySelector('a[data-target="' + entry.target.id + '"]');
          if (!link) return;
          if (entry.isIntersecting) {
            links.forEach(function (l) { l.classList.remove("active"); });
            link.classList.add("active");
          }
        });
      },
      { rootMargin: "0px 0px -70% 0px" }
    );

    headings.forEach(function (heading) {
      observer.observe(heading);
    });
  });

  document.addEventListener("DOMContentLoaded", function () {
    var alertLabels = {
      NOTE: "Note",
      TIP: "Tip",
      IMPORTANT: "Important",
      WARNING: "Warning",
      CAUTION: "Caution"
    };
    var alertIcons = {
      NOTE: "ℹ️",
      TIP: "💡",
      IMPORTANT: "❗",
      WARNING: "⚠️",
      CAUTION: "🛑"
    };

    document.querySelectorAll(".main-content blockquote").forEach(function (bq) {
      var p = bq.querySelector("p:first-child");
      if (!p || !p.firstChild || p.firstChild.nodeType !== Node.TEXT_NODE) return;

      var text = p.firstChild.textContent;
      var match = text.match(/^\s*\[!(NOTE|TIP|IMPORTANT|WARNING|CAUTION)\]\s*/i);
      if (!match) return;

      var type = match[1].toUpperCase();
      p.firstChild.textContent = text.slice(match[0].length);

      bq.classList.add("gh-alert", "gh-alert-" + type.toLowerCase());

      var title = document.createElement("p");
      title.className = "gh-alert-title";
      title.textContent = alertIcons[type] + " " + alertLabels[type];
      bq.insertBefore(title, bq.firstChild);
    });
  });
</script>


</head>

<body>
  <a class="skip-to-main" href="#main-content">Skip to main content</a>
  <svg xmlns="http://www.w3.org/2000/svg" class="d-none">
  <symbol id="svg-link" viewBox="0 0 24 24">
  <title>Link</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-link">
    <path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"></path><path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"></path>
  </svg>
</symbol>

  <symbol id="svg-menu" viewBox="0 0 24 24">
  <title>Menu</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-menu">
    <line x1="3" y1="12" x2="21" y2="12"></line><line x1="3" y1="6" x2="21" y2="6"></line><line x1="3" y1="18" x2="21" y2="18"></line>
  </svg>
</symbol>

  <symbol id="svg-arrow-right" viewBox="0 0 24 24">
  <title>Expand</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-chevron-right">
    <polyline points="9 18 15 12 9 6"></polyline>
  </svg>
</symbol>

  <!-- Feather. MIT License: https://github.com/feathericons/feather/blob/master/LICENSE -->
<symbol id="svg-external-link" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-external-link">
  <title id="svg-external-link-title">(external link)</title>
  <path d="M18 13v6a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2V8a2 2 0 0 1 2-2h6"></path><polyline points="15 3 21 3 21 9"></polyline><line x1="10" y1="14" x2="21" y2="3"></line>
</symbol>

  
    <symbol id="svg-doc" viewBox="0 0 24 24">
  <title>Document</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-file">
    <path d="M13 2H6a2 2 0 0 0-2 2v16a2 2 0 0 0 2 2h12a2 2 0 0 0 2-2V9z"></path><polyline points="13 2 13 9 20 9"></polyline>
  </svg>
</symbol>

    <symbol id="svg-search" viewBox="0 0 24 24">
  <title>Search</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-search">
    <circle cx="11" cy="11" r="8"></circle><line x1="21" y1="21" x2="16.65" y2="16.65"></line>
  </svg>
</symbol>

  
  
    <!-- Bootstrap Icons. MIT License: https://github.com/twbs/icons/blob/main/LICENSE.md -->
<symbol id="svg-copy" viewBox="0 0 16 16">
  <title>Copy</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="bi bi-clipboard" viewBox="0 0 16 16">
    <path d="M4 1.5H3a2 2 0 0 0-2 2V14a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3.5a2 2 0 0 0-2-2h-1v1h1a1 1 0 0 1 1 1V14a1 1 0 0 1-1 1H3a1 1 0 0 1-1-1V3.5a1 1 0 0 1 1-1h1v-1z"/>
    <path d="M9.5 1a.5.5 0 0 1 .5.5v1a.5.5 0 0 1-.5.5h-3a.5.5 0 0 1-.5-.5v-1a.5.5 0 0 1 .5-.5h3zm-3-1A1.5 1.5 0 0 0 5 1.5v1A1.5 1.5 0 0 0 6.5 4h3A1.5 1.5 0 0 0 11 2.5v-1A1.5 1.5 0 0 0 9.5 0h-3z"/>
  </svg>
</symbol>
<symbol id="svg-copied" viewBox="0 0 16 16">
  <title>Copied</title>
  <svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" fill="currentColor" class="bi bi-clipboard-check-fill" viewBox="0 0 16 16">
    <path d="M6.5 0A1.5 1.5 0 0 0 5 1.5v1A1.5 1.5 0 0 0 6.5 4h3A1.5 1.5 0 0 0 11 2.5v-1A1.5 1.5 0 0 0 9.5 0h-3Zm3 1a.5.5 0 0 1 .5.5v1a.5.5 0 0 1-.5.5h-3a.5.5 0 0 1-.5-.5v-1a.5.5 0 0 1 .5-.5h3Z"/>
    <path d="M4 1.5H3a2 2 0 0 0-2 2V14a2 2 0 0 0 2 2h10a2 2 0 0 0 2-2V3.5a2 2 0 0 0-2-2h-1v1A2.5 2.5 0 0 1 9.5 5h-3A2.5 2.5 0 0 1 4 2.5v-1Zm6.854 7.354-3 3a.5.5 0 0 1-.708 0l-1.5-1.5a.5.5 0 0 1 .708-.708L7.5 10.793l2.646-2.647a.5.5 0 0 1 .708.708Z"/>
  </svg>
</symbol>

  
</svg>

  
    <header class="side-bar">
  <div class="site-header">
    <a href="/cyberdefender-writeups/" class="site-title lh-tight">
  CyberDefender Writeups

</a>
    <button id="menu-button" class="site-button btn-reset" aria-label="Menu" aria-expanded="false">
      <svg viewBox="0 0 24 24" class="icon" aria-hidden="true"><use xlink:href="#svg-menu"></use></svg>
    </button>
  </div>

  <nav aria-label="Main" id="site-nav" class="site-nav">
  
  
    <ul class="nav-list"><li class="nav-list-item"><a href="/cyberdefender-writeups/" class="nav-list-link">Home</a></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Malware Analysis submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cyberdefender-writeups/malware%20analysis/" class="nav-list-link">Malware Analysis</a><ul class="nav-list"><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/ATMii%20Lab/ATMii%20Lab.html" class="nav-list-link">ATMii Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/AgentTesla/AgentTesla.html" class="nav-list-link">AgentTesla</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/MalDoc101/MalDoc101.html" class="nav-list-link">MalDoc101</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/MalaCrypt/MalaCrypt.html" class="nav-list-link">MalaCrypt</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/Obfuscated/Obfuscated.html" class="nav-list-link">Obfuscated</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/TeleStealer/TeleStealer.html" class="nav-list-link">TeleStealer</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/XLM%20Macros%20Lab/XLM%20Macros%20Lab.html" class="nav-list-link">XLM Macros Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/malware%20analysis/XWorm/XWorm.html" class="nav-list-link">XWorm</a></li></ul></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Endpoint Forensics submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cyberdefender-writeups/endpoint%20forensics/" class="nav-list-link">Endpoint Forensics</a><ul class="nav-list"><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/Amadey%20-%20APT-C-36%20Lab/Amadey%20-%20APT-C-36%20Lab.html" class="nav-list-link">Amadey - APT-C-36 Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/Andromeda%20Bot%20-%20UNC4210%20Lab/Andromeda%20Bot%20-%20UNC4210%20Lab.html" class="nav-list-link">Andromeda Bot - UNC4210 Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/BlackEnergy/BlackEnergy.html" class="nav-list-link">BlackEnergy</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/Brave/Brave.html" class="nav-list-link">Brave</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/DumpMe/DumpMe.html" class="nav-list-link">DumpMe</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/QBot/QBot.html" class="nav-list-link">QBot</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/endpoint%20forensics/Volatility%20Traces%20Lab/Volatility%20Traces%20Lab.html" class="nav-list-link">Volatility Traces Lab</a></li></ul></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Network Forensics submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cyberdefender-writeups/network%20forensics/" class="nav-list-link">Network Forensics</a><ul class="nav-list"><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/HoneyBOT/HoneyBOT.html" class="nav-list-link">HoneyBOT</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/Malware%20Traffic%20Analysis%201/Malware%20Traffic%20Analysis%201.html" class="nav-list-link">Malware Traffic Analysis 1</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/PsExec%20Hunt%20Lab/PsExec%20Hunt%20Lab.html" class="nav-list-link">PsExec Hunt Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/RCEMiner%20Lab/RCEMiner%20Lab.html" class="nav-list-link">RCEMiner Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/RetailBreach/RetailBreach.html" class="nav-list-link">RetailBreach</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/Tomcat%20Takeover%20Lab/Tomcat%20Takeover%20Lab.html" class="nav-list-link">Tomcat Takeover Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/XLMRat%20Lab/XLMRat%20Lab.html" class="nav-list-link">XLMRat Lab</a></li><li class="nav-list-item"><a href="/cyberdefender-writeups/network%20forensics/XXE%20Infiltration%20Lab/XXE%20Infiltration%20Lab.html" class="nav-list-link">XXE Infiltration Lab</a></li></ul></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Reverse Engineering submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cyberdefender-writeups/reverse%20engineering/" class="nav-list-link">Reverse Engineering</a><ul class="nav-list"><li class="nav-list-item"><a href="/cyberdefender-writeups/reverse%20engineering/RE101/RE101.html" class="nav-list-link">RE101</a></li></ul></li><li class="nav-list-item"><button class="nav-list-expander btn-reset" aria-label="Threat Hunting submenu" aria-expanded="false">
        <svg viewBox="0 0 24 24" aria-hidden="true"><use xlink:href="#svg-arrow-right"></use></svg>
      </button><a href="/cyberdefender-writeups/threat%20hunting/" class="nav-list-link">Threat Hunting</a><ul class="nav-list"><li class="nav-list-item"><a href="/cyberdefender-writeups/threat%20hunting/REvil/REvil.html" class="nav-list-link">REvil</a></li></ul></li></ul>
  
</nav>


<div class="d-md-block d-none site-footer">
  
  
    This site uses <a href="https://github.com/just-the-docs/just-the-docs">Just the Docs</a>, a documentation theme for Jekyll.
  
  </div>
</header>

  
  <div class="main" id="top">
    <div id="main-header" class="main-header">
  
    

<div class="search" role="search">
  <div class="search-input-wrap">
    <input type="text" id="search-input" class="search-input" tabindex="0" placeholder="Search CyberDefender Writeups" autocomplete="off">
    <label for="search-input" class="search-label">
      <span class="sr-only">Search CyberDefender Writeups</span>
      <svg viewBox="0 0 24 24" class="search-icon" aria-hidden="true"><use xlink:href="#svg-search"></use></svg>
    </label>
  </div>
  <div id="search-results" class="search-results"></div>
</div>

  
  
  
    <nav aria-label="Auxiliary" class="aux-nav">
  <ul class="aux-nav-list">
    
      <li class="aux-nav-list-item">
        <a href="https://github.com/FrancisVillalon/cyberdefender-writeups" class="site-button"
          
        >
          View on GitHub
        </a>
      </li>
    
  </ul>
</nav>

  
</div>

    <div class="main-content-wrap">
      
      <div id="main-content" class="main-content">
        <main>
          
            

          

          
            
          
        </main>
        
<hr>
<footer>
  

  

  <div class="d-md-none mt-4 fs-2">
    
    
      This site uses <a href="https://github.com/just-the-docs/just-the-docs">Just the Docs</a>, a documentation theme for Jekyll.
    
  </div>
</footer>

      </div>
    </div>
    
      

<div class="search-overlay"></div>

    
  </div>

  
</body>
</html>

