hxxps://linkvertise[.]com/1169231/solara-download?o=sharing

Resubmissions

05-08-2024 04:40

240805-favtwa1djh 8

05-08-2024 04:25

05-08-2024 04:22

05-08-2024 04:04

05-08-2024 04:01

Analysis

max time kernel
114s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-08-2024 04:01

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://linkvertise.com/1169231/solara-download?o=sharing

Score

6^/10

discovery

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SystemSettingsAdminFlows.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
84	api.ipify.org
85	api.ipify.org

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	SystemSettingsAdminFlows.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Logs\PBR\BCDCopy.LOG	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\DDACLSys.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\_s_34FC.tmp	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\BCDCopy	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\DDACLSys.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\cbs_unattend.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\_s_3394.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.offline.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\DISM	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\cbs.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\cbs_unattend.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\diagwrn.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\MainQueueOnline1.que	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.dev.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.offline.20191207_091437.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\setup.etl	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\setupact.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\setuperr.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.setup.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\unattend.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\ResetSession.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\actionqueue	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setup.exe	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\Contents0.dir	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\PushButtonReset.etl	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.setup.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\CBS\CBS.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\DISM\dism.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\SessionID.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\SessionID.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\WinRE	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\diagerr.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\_s_3645.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Timestamp.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy.LOG1	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\actionqueue\oobeSystem.uaq	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\ReAgent\ReAgent.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Timestamp.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\MainQueueOnline0.que	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_3394.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\ReAgent\ReAgent.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\actionqueue\oobeSystem.uaq	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\Contents1.dir	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\Contents1.dir	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setupinfo	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy.LOG2	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.app.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.offline.20191207_091437.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\CBS	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\diagerr.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\PushButtonReset.etl	SystemSettingsAdminFlows.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "182"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{79FE8F62-6CB0-4D73-B9EA-71E19F120A86}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4464	msedge.exe
4464	msedge.exe
3908	msedge.exe
3908	msedge.exe
1580	msedge.exe
1580	msedge.exe
2360	identity_helper.exe
2360	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeBackupPrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeSystemEnvironmentPrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeBackupPrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeSecurityPrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeTakeOwnershipPrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeBackupPrivilege	2432	vssvc.exe
Token: SeRestorePrivilege	2432	vssvc.exe
Token: SeAuditPrivilege	2432	vssvc.exe
Token: SeTakeOwnershipPrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeTakeOwnershipPrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeBackupPrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	5740	SystemSettingsAdminFlows.exe
Token: SeShutdownPrivilege	5740	SystemSettingsAdminFlows.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5740	SystemSettingsAdminFlows.exe
5200	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 1472	3908	msedge.exe	83
PID 3908 wrote to memory of 1472	3908	msedge.exe	83
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 2548	3908	msedge.exe	84
PID 3908 wrote to memory of 4464	3908	msedge.exe	85
PID 3908 wrote to memory of 4464	3908	msedge.exe	85
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86
PID 3908 wrote to memory of 4864	3908	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://linkvertise.com/1169231/solara-download?o=sharing
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b30046f8,0x7ff9b3004708,0x7ff9b3004718
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,16460775877027536560,2114983113443131150,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault845a4177h407bh4aa0h97dehc2ea39ccd449
1⤵
PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff9b30046f8,0x7ff9b3004708,0x7ff9b3004718
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,11542978936076019909,124916565049808534,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,11542978936076019909,124916565049808534,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  PID:5416

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5740

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5892

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:5924

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5252

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2432

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5504

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa391c055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$SysReset\Logs\setupact.log

Filesize
110KB

MD5
222681f6a9f1af33f3acd85d8f48aeba

SHA1
5e97af66640e8cd88f38ca099df61f92179f8982

SHA256
2ab69fc6f6bcaee4b8fa81a051ca46bc9aa066b171d6cc289cca8fa09c133166

SHA512
6c7744a373421e0a3c3bf9271c6a8df56a64d9863d23581a26190e1ce455b0ee1de682cfbc837853c7d7875b67e49b808e00a6edd22088b0a3e69362f102e0a3

Download Submit
C:\$SysReset\Logs\setuperr.log

Filesize
749B

MD5
181deebd5fa932951effa88a17527fb8

SHA1
e1099119dcfbb62881c00824cbf32a736cb44eac

SHA256
89c70cd0fbbb12c6c6388e2ce714be102665332600915028b2dd83647b757d3e

SHA512
947d8c5c42632f3bd7810b22bf38e5a9385ae12542a362d1e0a18b92c7daa6296122508dc93e2cff23834e87909c42f845abadbd15b30f53617b08cb11f6e459

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2307f8713d41debccc1e91a3a2118d33

SHA1
666534477433e197052c9f0440ffded74d32edf6

SHA256
0d3af9ba6ec22a2a9f045a9a739af3b31172ce4af1c2e6aa5771a56ef9d2828a

SHA512
9aec2fa60e27bce3b5adfa2cace2572c37e264b56fdae856e6a25fa6560262a6db6aaa175f5d679cf2be99cbc31bd4e1bbc707be2a421e4f0662d4ca42a38783

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
3165d1a64928b42d88942580b52dc6dd

SHA1
19b4e853f558133f01ab313dcca5415a5d1c9404

SHA256
081476682db8afc5f78299a8a027973e3d09142567b97778d92134391c489d10

SHA512
901fba8de6ec0f6dad3c59fa2bb646745391c3bd122011ecbeb556edf3cce0446f55cde38db0b9bc8396af2f6167724be95f41096007edf2ad53de38ba76452a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d4466dc035b908215a65ef50b54e2901

SHA1
51bd711ffb39fb2feb04d186270251e2b62bc4ae

SHA256
2aa06f1f8a3629e69182b8cca30749a1d6d5862739cc52f2e7399643e5c89c3a

SHA512
9209402f70c997cf202314cf86ddfd1c735ae46f0e2071f9bca5fb09ce6957e3d513308976eb7c3ecdad0340eff0f11d0f6f90eafe45f3a61358ed2ed2a18282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
dca35a76e5737f4e35fa8c7c364c146b

SHA1
c07956bf5af1b24b5db9df920dbf781322202b07

SHA256
9b63dc5ad6324248c6d690afeedf11212808b50fa9cc63feda27693f9ca61981

SHA512
efc2e4e8df91ef4447e1f680033e38fd2751ae705596f82cd4a6be89635eb3fff28c07cdcffc8f1c1b5701e960bf0f34799fd5f2fbc9d6f476b676f6305d34c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4c0b9bc642e203aac786d115579711c9

SHA1
f994d25f06a0cb0b1fd3f500c5a2248926ba6503

SHA256
02cdd7edad19ead956bebc9a34cc298706bd50bcaa5bd0f42cca2ca12941cb25

SHA512
03b62e1666abe571753996be51e3a0525c2aeb55516cef1fff7787c103993422d7de700e73aae4d506f2cdd3dffcea4ce303e07510c8cbc1cce2ea0e29cc17a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bfdf83167cc286eb40164890b62732e6

SHA1
0017bd85f002f830104e7d4714f6a71b8f5b8bba

SHA256
e30961384d3fba2c84dd41986286452374fa751d21fb3277356ee9ec5934276c

SHA512
99d231e0d963352eada0acf6ea304b5be4fe61da87c1caeb044c6e44f4b4a1b08047a76b7a041f3e10a58f68fcd8909aa0822cdc6fddd875c2650671c67b888e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
77b3e667c78af14f5b55345130f39144

SHA1
93d6669f0c530e28cfd90e3d7656e7c0e677332e

SHA256
806483578fc5f8a83f025149f65715128d1459c8b33b27e1e7d9a4b913734452

SHA512
5153f4839329b60b8c741ccdb3bd36aedf04f04dd0705e08f134c3c56c6b2c99e6e41fcc7aa34040baad14065aece145c37037b192ebe835004bc569f3e78043

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2cdfbbdb1ec88d4dd1995a5b918ceffb

SHA1
42e408d0511b232d332dc8562f6f73962166a2a0

SHA256
9fe6de9101a08665608c0b333d25ae486bb7403dde74b3376d00fc5e3286f481

SHA512
b7985fa22da5ffeff9b55a202f3551be255af55a22af0bf10b35a946749c2429b4dc67f78c504eee6c636b293f7480bb859c4cdee2822cd9a980fa6b8aedd933

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4c39238bbb83d08ee40ffdf616270a87

SHA1
73a3d9b4cb353bdcfc8d8385a90e85274c37c4e4

SHA256
de90f1f818725e889220d5b1955dd295bc157d4d323a15317b505c2ecf5904a2

SHA512
2751db95c60db9e73f7bd2250fae3659846d4079b704e1b1c8d5a897a7b3cbc81c7adfbc463a85b561a5c90d4a8f9ff88d01ec1e19ca50ecc213ac5313e2ebe4

Download Submit
C:\Windows\Logs\PBR\ResetSession.xml

Filesize
7KB

MD5
2b2600fe16d9995e0ff8c1f9fbabb90b

SHA1
7ccff69dee680caeb3465cdd5a8ce763fe1992a9

SHA256
a2b2d3b83caff99a7f1b5d1522ba4ea9c4ac84cd87e2e15aa991562008287836

SHA512
10cd488987d6a18f1eb898cc61089ac3b247bf89a6ee33ed0140856d5c1fd13d4a766949c250c54dca71301de2c13aadf5e3d8edef062185ba954e6b3f01c8f0

Download Submit
C:\Windows\Logs\PBR\SessionID.xml

Filesize
106B

MD5
aee47c1538c8a96268c2e60d54371ccd

SHA1
00008909fa5eed79bdabd01699d0a77acc01da58

SHA256
f7ae4f5e027a5997ba7792e53392c12dcaba41acf9485af6f0663bcf24a062c2

SHA512
3c629a57524265af4912b75db9f4ca6eebec4e80fc2256a08a76f1e67d23f4c4314cbb63e9974b78b59678fc413849f32fdfd6aa74592aad1f66fd825117de54

Download Submit
C:\Windows\Logs\PBR\Timestamp.xml

Filesize
42B

MD5
6db9934c400410837dd27aca08177fec

SHA1
768835c74e0ecdb965462d96013a389b99fa0290

SHA256
41e3c00a9d0ba4bcfef23b0cb587f753cf0126e640f0f1cce398b1c50bc325a3

SHA512
c059f6c39e943f9ea5920a448deefe505322a09d7a5f022850f53d5072a1cbaad39f30a8ef7a174ad0f44fb92603c957103821c18dd5b9890f8de8b679f84a40

Download Submit
C:\Windows\Logs\PBR\WinRE\bootstat.dat

Filesize
66KB

MD5
3c08dea20e350ea34f7309e856576428

SHA1
d7a048ccc07b4d16afc4d778d5601a067fb151b9

SHA256
b7bbc3f2463000f52eadcce2e262512dc79bbbb3355c62c734f18db57e0fba82

SHA512
1c1cdd554cbf98dcb7358808cfa2682bd09a596e24a3708ab73e379e5f8ae7dc394b8e88824589327e2f67487ca19dacba9e3288993e2e92463dc32aaef67f9d

Download Submit
C:\Windows\Panther\UnattendGC\diagerr.xml

Filesize
9KB

MD5
c0f34965f70e864ade175609c293f51e

SHA1
09567b78da56b86088f5bdb50f4b822ad140bc06

SHA256
942a7df9539068bc9fe869c66af387f838311415e486eff602eacf116833fd0f

SHA512
d56ec8cd87141a3bc522b65e3450ff0af794e4c5e52b9a1cb4bbdca18f43b3fa33f3e190488234415804ab71141e864968c857ec751c8d949c9dde100851e170

Download Submit
C:\Windows\Panther\UnattendGC\diagwrn.xml

Filesize
13KB

MD5
2be9b298e1bd3659a377582652e08594

SHA1
6335e24f0270974dc74ddc0ab5f4ce61ecc5364a

SHA256
aa6fbc69df506fb524e8fd5f990bb27776459a8fd0d30096572f9768d53a633f

SHA512
0b3d0b06aafceb45fbb0ff80001f15f2021b7c1c4c8b994f81bee2f1334fe6261ff99d37c3b4d2334a22b901d8914c0aa8ee69165e0d2836306d87ba2e846f12

Download Submit
C:\Windows\System32\Recovery\ReAgent.xml

Filesize
1KB

MD5
e464e11f11651d258f25ed0193f68a23

SHA1
28783ec18b849eb4de3415d5f6cc6a4ced9ab321

SHA256
a5779ba924881369039748f431db1a7a10a7f89b29214ccc8d5c0c2983bdd8a1

SHA512
583fb45fbe5f8e4f3a851883995893e2749f2895a5808fc93a3399b499186969ddf0c288a9fc43515d41317bd7f83cd4c2316dfcf3259e01c59040041541a4c2

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads