debb4f80f2f86fb5c22a2458660f619cbf975de3ee0b97b9628945a588e0e50d

Analysis

user interaction
yes
max time kernel
294s
max time network
295s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 13:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
aisF290.bat
Size 364B
Sample260730-ratscszamd
SHA256 debb4f80f2f86fb5c22a2458660f619cbf975de3ee0b97b9628945a588e0e50d
MD5 c98f1c11833dd23c5f6ff6d5f72bafbe
SHA1 d97ec2d934c64e81f826db4fee3b122e1953154a
SHA512 99efa7a084c5595e01a8b70a396659d4da7701ce24f739573545b35f14f71dd4fcaf85ed17e90bf3f72e2f1cbdeca25ff987caf6c80e8ed897d7cd16cd943940
TLSH
T163E0265924E8E200D3FBAF182EF9213306FCB4B44C3E550D00C08A0C0880D04CE1179B
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery execution persistence ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	SystemSettingsAdminFlows.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	SystemSettingsAdminFlows.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.dev.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\DISM\dism.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\cbs.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_36B3.tmp	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\BCDCopy	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Timestamp.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\Contents0.dir	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\MainQueueOnline1.que	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\SessionID.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.offline.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.setup.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\DISM	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\actionqueue\oobeSystem.uaq	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\_s_3411.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\DDACLSys.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\CBS\CBS.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\setupact.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\unattend.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\INF\setupapi.offline.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\CBS	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\diagerr.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\MainQueueOnline0.que	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\setuperr.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\_s_36B3.tmp	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\ResetSession.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\MainQueueOnline0.que	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\WinRE	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy.LOG1	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy.LOG2	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\Contents1.dir	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\setuperr.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\ResetSession.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\ReAgent\ReAgent.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.setup.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\DISM\dism.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\setup.etl	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\unattend.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\setuperr.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\CBS\CbsPersist_20260730140026.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\UnattendGC\setuperr.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.offline.20191207_091437.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\cbs_unattend.log	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\PushButtonReset.etl	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\BCDCopy	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\DDACLSys.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\diagwrn.xml	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\UnattendGC\diagwrn.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\INF\setupapi.dev.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\CBS\CBS.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\actionqueue\oobeSystem.uaq	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\actionqueue\specialize.uaq	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\actionqueue	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\cbs.log	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\Contents1.dir	SystemSettingsAdminFlows.exe
File created	C:\Windows\Logs\PBR\Panther\diagerr.xml	SystemSettingsAdminFlows.exe
File opened for modification	C:\Windows\Logs\PBR\Panther\MainQueueOnline1.que	SystemSettingsAdminFlows.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2984	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3380	msedge.exe

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "35"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4944	powershell.exe
4944	powershell.exe
4944	powershell.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4660	msedge.exe

Suspicious use of AdjustPrivilegeToken 23 IoCs

description	pid	Process
Token: SeBackupPrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeSystemEnvironmentPrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeBackupPrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeSecurityPrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeTakeOwnershipPrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeDebugPrivilege	4944	powershell.exe
Token: SeDebugPrivilege	3032	Taskmgr.exe
Token: SeSystemProfilePrivilege	3032	Taskmgr.exe
Token: SeCreateGlobalPrivilege	3032	Taskmgr.exe
Token: 33	3032	Taskmgr.exe
Token: SeIncBasePriorityPrivilege	3032	Taskmgr.exe
Token: SeBackupPrivilege	160	vssvc.exe
Token: SeRestorePrivilege	160	vssvc.exe
Token: SeAuditPrivilege	160	vssvc.exe
Token: SeTakeOwnershipPrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeTakeOwnershipPrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeBackupPrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeRestorePrivilege	3496	SystemSettingsAdminFlows.exe
Token: SeShutdownPrivilege	3496	SystemSettingsAdminFlows.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe

Suspicious use of SendNotifyMessage 39 IoCs

pid	Process
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe
3032	Taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3496	SystemSettingsAdminFlows.exe
3008	LogonUI.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 4660	4048	msedge.exe	99
PID 4660 wrote to memory of 4832	4660	msedge.exe	100
PID 4660 wrote to memory of 3380	4660	msedge.exe	101
PID 4660 wrote to memory of 3348	4660	msedge.exe	102
PID 4660 wrote to memory of 3348	4660	msedge.exe	102
PID 4660 wrote to memory of 3348	4660	msedge.exe	102
PID 4660 wrote to memory of 4604	4660	msedge.exe	103
PID 4660 wrote to memory of 4604	4660	msedge.exe	103
PID 4660 wrote to memory of 692	4660	msedge.exe	104
PID 4660 wrote to memory of 692	4660	msedge.exe	104
PID 4660 wrote to memory of 692	4660	msedge.exe	104
PID 4944 wrote to memory of 3032	4944	powershell.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\aisF290.bat"
1⤵
- Executes a command shell one-liner
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2aae6f9dh3751h46d4ha490h4ee846be68fd
1⤵
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2aae6f9dh3751h46d4ha490h4ee846be68fd --edge-skip-compat-layer-relaunch
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7fffcfa6c188,0x7fffcfa6c194,0x7fffcfa6c1a0
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,10008676843256377183,3116461128524736249,524288 --field-trial-handle=2204,i,3117605755332370041,10576419756433309370,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
    3⤵
    - System Time Discovery
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,13895188367564561163,18365355546717982646,262144 --field-trial-handle=2204,i,3117605755332370041,10576419756433309370,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,10583837184271113594,16035532450030197972,524288 --field-trial-handle=2204,i,3117605755332370041,10576419756433309370,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:4604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3308,i,704926407244568431,16287283752290199934,2097152 --field-trial-handle=2204,i,3117605755332370041,10576419756433309370,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:2
    3⤵
    PID:692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3204

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3496

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4408

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2988

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4944
- C:\Windows\system32\Taskmgr.exe
  "C:\Windows\system32\Taskmgr.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:160

C:\Windows\System32\ResetEngine.exe
C:\Windows\System32\ResetEngine.exe
1⤵
PID:4020

C:\Windows\system32\SysResetErr.exe
C:\Windows\system32\sysreseterr.exe
1⤵
PID:1764

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3931055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

setupact.log

Path C:\$SysReset\Logs\setupact.log
Size 110KB
SHA256 1385f13c1db2e92001d60ba652cbd0e10f1805c4dac289d0757b1122f89c264b
MD5 b8e5174e473162ac5c535612860eb398
SHA1 3a87ffdd8edee13705b3cd59a091571bbbdee369
SHA512 d34f8e253cbcd425bf9bbac542d7743dd2eda660579796d9dc376a853983855bc65c9c77a19408c9238588008a9472a81e0aca24cde4464e056029279c3a4649
SSDEEP 768:4fRA3vqPXd+w1IUk6JobLjR2bLYnSOLGhhz5:4f63vk45/I/jV
TLSH
T151B3572313BB81E6A51E4442BF91CF1FB1B2F84D32CCA0297A7E11737B50356D6AE646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setuperr.log

Path C:\$SysReset\Logs\setuperr.log
Size 749B
SHA256 2635ebda870ab3d28f8ffa59e84f6874abea753f28c729e08d1dfe75243cccf8
MD5 9a297392b2103fc2fe8942c04373ebde
SHA1 1a53e15527a40fd0c1a8cd730ae068e764e99d15
SHA512 a1f22a57a0c57823951ec6c1af1ec3e863576dc2fa34d9a7431d779182f0d7d12859d41d46c5c8ed626b48db7a41a508dd5cc6b93c17a098d3e39a64ca2248a9
TLSH
T1D201994756AA05D7C4B42121BD42F92D1ED134E750CCC42A73BC1AE6F7580E0B9BF18A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

ea07c16f-9f78-41fd-9d9f-c25781dce528.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ea07c16f-9f78-41fd-9d9f-c25781dce528.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 61B
SHA256 e1b77550222c2451772c958e44026abe518a2c8766862f331765788ddd196377
MD5 4df4574bfbb7e0b0bc56c2c9b12b6c47
SHA1 81efcbd3e3da8221444a21f45305af6fa4b71907
SHA512 78b14f60f2d80400fe50360cf303a961685396b7697775d078825a29b717081442d357c2039ad0984d4b622976b0314ede8f478cde320daec118da546cb0682a
TLSH
T139A00254944498FF4655836A05654463C7AA504780285E565B24115E42A25AD0450947
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ee18cfccbb08b27038a564f8f7821b9fa60c077c512965b6f5a10ccc61055037
MD5 b8bc589230b431de0b5e515a0f3a6cd0
SHA1 d16713c6ef935448b0d40f31fe7e6df5fe1c2301
SHA512 79b8791f5a54c4b10062ae41af23fb003eb0656a6ec9c76c05fd3d961594cefdbea1f14defa0057b1aa28db23f54ec1de35121cfea09c18a737137593f03ba0f
SSDEEP 96:sa2jbwiEDWMvErTscnb9fGydHWU6W6hfuH9EOx+WVoMfm+uecpYQj6J67NawUhgF:sxHwuMsTs+GE5HW6+WNGYqaxhgF
TLSH
T1FCF1C8566F64A93B8CCBE11DBA267B43E2F5502166C51948EBFC861C099B6CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 26KB
SHA256 d735a7d42e3c2b309c22079abbe67b3420647b7449d7b90810a21bb3541ca430
MD5 2edac5a4c33ccea7d0ae72c6b69f9c52
SHA1 59bd3a15fcc36694f3d7011d931ef8f75c064cfb
SHA512 cd9632a83b3c28dd13e7cde085cacdc03e46759598deb99781fd52d18c68ecda404015f97e90c213d0902f191b4e2aab3215bd51ddc50b1de9f5af693c2af9ff
SSDEEP 768:fVmjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+F8rofybaA:fVmjYDmWvmKyEu1jakPLZQFnar
TLSH
T1A9C2FA3B244CCF7E4FC41A9DDC5A6F972EA802C76A588D4047FA954C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 474fb3f770b3f0854efd2f4ea7f6e1db21df588507c821e865136f534522dbb8
MD5 55ec7dbf186faecfc160ea8ad96a8906
SHA1 c2ff4b73d8c188074fa6012b09f36f8274c8d0b7
SHA512 344aed2c397a0be23e173ee7882550315c8950347194481a9afb689e744d01fdb9b6220430920f55ac794f7e95437a48d22aa7bea203b41142689a1009c7c907
SSDEEP 192:GON06hZTQmiUyGEPc/+jVqO1QtB+2bS5cOqHqqNU6:GON06JMPu+MOetB+2R9LU6
TLSH
T17E1218356869AC275DE7A654F08732A38EE42177DD86AF84E1E85F1D04C779C370F812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 520dbb969f5bee1daf53db164c12c5ed5334d373f886cb8df3887de15b7315e2
MD5 47e13d8e163afd85bf67f24c372b42e7
SHA1 7b344780ac625ef03b189c1e69ddfa8039a5f2a1
SHA512 d2e9b19ccbde0506f95a782b35b5d3705f238174c1c0efb1f39df1b624792ef0cc83f47e70ea47bb613f81ebcb72b3b4f3aa97db9ab1ee4e8db23bf70c56c99f
SSDEEP 192:zesNV6hZEYQmiUyOfPH/+jVqO1QtB+2bS5cOTDqqNUO:zesNV6A4fPf+MOetB+2RcPUO
TLSH
T1AC121839A968AC2789E7A654F08736A38FE41077DD86BF84E5D85F1C00C779C370B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ca6f6d1da8dc6097d57ebe65bedc3830c2d4de0bdfb1537662d2540233808ffe
MD5 6a973fc1483397e789f8049ed9f618ae
SHA1 80c30e55df5d716cea24923e249a0b3dd880cbe4
SHA512 8c4def52c62ed521e669eb36a21f922b168301df6d9f584f5de02a19599ba5fe63437191e7cdf81032b95162f976cdac6053610ea9a9260abc311039d53d60eb
SSDEEP 192:EONg6hZ0QmiUyyEpc/+jVqO1Qz5wOZjT9U6:EONg6oipu+MOeK2jBU6
TLSH
T1AE02E83969686C778EE2AE45F48737235FE4113BE9956F84E6E81B1D00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 23e40a8d4972044f8f53648d79d0d604a4e8f430c027a97b876054e1e0e076eb
MD5 dc0c753d260c4eae9f82efb7947dfb6f
SHA1 70009e0578f96da40e34787d37f61cda1d6a4feb
SHA512 e9a61aa94e63059aaedc8f0d7cf2204baea3d8ee0834af66bde3a529656717363414bca8102f09c5d632e0cad0ad4deecca9598de93c81e3b2ce06cd5229f8d8
SSDEEP 192:zesNV6hZEYQmiUy9fPH/+jVqO1QtB+2bS5cOTDqqNUO:zesNV6A40Pf+MOetB+2RcPUO
TLSH
T1A81218396968AC2789E7A654F08736A38FE41077DD86BF84E5D85F1C00C779C370B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_otolzbd1.1qo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_otolzbd1.1qo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ResetSession.xml

Path C:\Windows\Logs\PBR\ResetSession.xml
Size 7KB
SHA256 b59ade2c1f1df217503fc725ea32be85f0b52ce38bff509fc7ff37c7550a4f03
MD5 23bc01cb01a3ede65f6f0c69928b03aa
SHA1 d10ab76fb143533cfa737b3f653158eb4fabd024
SHA512 4ebf77d2f170264070d96ae25d8157bd2b5a077871afaa4500ef91f7e6c192082316486a9ecddcf4f0b51c151a2882ac5a110c31bc3c370614232c7f9f1c5cb4
SSDEEP 96:BytNyqHm8vrT7SWN1CFSe3G47nUaMkR/jXAC7V7x79IB8MGRIyy/eZQTg:4NySmir1CFSe3GOnULajwyZNWBrkOuQE
TLSH
T1F0E10D44F1515B72D2229B7E96A9F888557C7B88CAC8C22DE80C7E52B0C3D1B033B3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SessionID.xml

Path C:\Windows\Logs\PBR\SessionID.xml
Size 106B
SHA256 53eb636f8a0c383771760ed05837d76cd16ed56fa60fd146044167d137225706
MD5 ee3e2c1d50fb281dd9489ef3d5971969
SHA1 cd355823173434ac520757e1b4b25af49de4c940
SHA512 bc656a9bfd3ded82ef472501a0006b92e5368a5ad39949d9b0398b5ba0709813df2b011f0bc10a8d44de65def3dd05f7ffe272f0a081d680cc4fdb87d684093a
TLSH
T1BDB0125B20ECD7D001EF80160E72082C0FF199D4213192E16568021FA1EDF653750608
MD5 SHA1 SHA512 TLSH

Submit Download

Timestamp.xml

Path C:\Windows\Logs\PBR\Timestamp.xml
Size 43B
SHA256 cea5ff0ed9d54e146204fb77661fe35cdc9062adcd4f2bee2094ebbb7e8e4960
MD5 2675abf85fbf630eaa615579bc8a8d29
SHA1 4108ab103aa080ca234685e88dc1bb4b76733622
SHA512 c33a1f76b7670f8fbaef350b51b3db4129ae2b5a09f614222b7c6c0d1ec9f6084fdede2035db9a2731f4b01b9b9d21edfb03d9389d9ae9beb0ae6d0a295e6671
MD5 SHA1 SHA512

Submit Download

bootstat.dat

Path C:\Windows\Logs\PBR\WinRE\bootstat.dat
Size 66KB
SHA256 b7bbc3f2463000f52eadcce2e262512dc79bbbb3355c62c734f18db57e0fba82
MD5 3c08dea20e350ea34f7309e856576428
SHA1 d7a048ccc07b4d16afc4d778d5601a067fb151b9
SHA512 1c1cdd554cbf98dcb7358808cfa2682bd09a596e24a3708ab73e379e5f8ae7dc394b8e88824589327e2f67487ca19dacba9e3288993e2e92463dc32aaef67f9d
SSDEEP 3:dlE/71tCl2:y1tCU
MD5 SHA1 SHA512 SSDEEP

Submit Download

diagerr.xml

Path C:\Windows\Panther\UnattendGC\diagerr.xml
Size 9KB
SHA256 35d66d80352ea77ddab275e0656bb5870bed7b7d60db2e6dc6d7626f63eceb7d
MD5 4f157b5055b21ae34028756156c332f4
SHA1 d9c1427ea79fcfb6187b32f206ff796c539e6f67
SHA512 5afd347c51f1176b9d2b7e98d2748e14a1c52751c1734e5b2c753a45c9b1e0f032aa0f4277cdb02712e29cf47b4d01a95d3677e854d936391f82ea13c362d71b
SSDEEP 96:5MwiGdgbneLHMwiGdgbneLHMwiGdgbnYMwiGdgbneLHMwiGdgbnt:53gbq3gbq3gbY3gbq3gbt
TLSH
T15F126229B1992EBB5C9446F9DFD038C26F8097794106A03795C4FDAFB239082F5B17CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

diagwrn.xml

Path C:\Windows\Panther\UnattendGC\diagwrn.xml
Size 13KB
SHA256 cc635aed35dd6a017cf8024aa363b85919106c149f616d41d0de270d60c6710b
MD5 7fc3fb63fb9ad997c5e14ceca6f263d5
SHA1 6b6125243b90624d54a8eac7f5a576b75787f159
SHA512 e2d19dd374033b2bf7055bb58887b7bfae3c168dbcce024bcb8280a0f1656c3d1ea396c35c30239224c11b9a1ba20dc121ed8605df06a8769720563b881a98c2
SSDEEP 192:53gbq3gbE7cRmDy/3gbY3gbq3gbEjkDQ1BFvQ1l8y5Q11:53Iq3IScJ3IY3Iq3IHc
TLSH
T117523A3DB1942EB75C9002E8DFD038D26B80AB754116A03795C5FDABB275082F9B17DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReAgent.xml

Path C:\Windows\System32\Recovery\ReAgent.xml
Size 1KB
SHA256 b1188e455aa4a65571899fd3a153574ceab6bdddd79b6c684bd629b757cdec4c
MD5 7d1abd74f8a895401f66a5f2620c81bf
SHA1 4035b1c24348e567485f07faf39e4b18f2ccb594
SHA512 ec9a70a5600be1a5bae4e2bc0359b36aff321293e17facc99ef9adbf2d1ac508bdb3a3988cc58ff4b5f31d943862985722d0abfb118237a91e2ecfcb556d399c
TLSH
T19921E74681B818B6D7B1D366F1F8BD60463FF1DD02E08A5CA029F6E394474528B5F9B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3032-171-0x000001DEFE300000-0x000001DEFE301000-memory.dmp

Download

memory/3032-169-0x000001DEFE300000-0x000001DEFE301000-memory.dmp

Download

memory/3032-168-0x000001DEFE300000-0x000001DEFE301000-memory.dmp

Download

memory/3032-167-0x000001DEFE300000-0x000001DEFE301000-memory.dmp

Download

memory/3032-173-0x000001DEFE300000-0x000001DEFE301000-memory.dmp

Download

memory/3032-172-0x000001DEFE300000-0x000001DEFE301000-memory.dmp

Download

memory/3032-163-0x000001DEFE300000-0x000001DEFE301000-memory.dmp

Download

memory/3032-162-0x000001DEFE300000-0x000001DEFE301000-memory.dmp

Download

memory/3032-161-0x000001DEFE300000-0x000001DEFE301000-memory.dmp

Download

memory/3032-170-0x000001DEFE300000-0x000001DEFE301000-memory.dmp

Download

memory/4944-159-0x0000024866470000-0x00000248664E6000-memory.dmp

Download

memory/4944-158-0x00000248663A0000-0x00000248663E4000-memory.dmp

Download

memory/4944-157-0x0000024865FC0000-0x0000024865FE2000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads