Overview

overview

10

Static

static

3

4ujuowcfb6rlt0ew.exe

windows10-2004-x64

10

4ujuowcfb6rlt0ew.exe

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    02/08/2026, 04:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4ujuowcfb6rlt0ew.exe
  • Size 536KB
  • Sample260802-e7jx7sda87
  • SHA256 0846a3c13f0e62176306ccede12913346c513bc8639d7c83c1a9efa86cf1c7eb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
collectiondefense_evasiondiscoveryevasionexecutiondracula_stealerpersistenceprivilege_escalationransomwarespywarestealer

Malware Config

Signatures

  • Family: Dracula, Samurai

    Dracula aka Samurai is a stealer written in C#.

    stealerdracula_stealer
  • Detects Dracula aka Samurai Stealer payload 1 IoCs
  • Modifies WinLogon for persistence 2 TTPs 5 IoCs
    persistence
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Adds policy Run key to start application 2 TTPs 3 IoCs
    persistence
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 9 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
    collection
  • Adds Run key to start application 2 TTPs 13 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops desktop.ini file(s) 8 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: Clear Persistence 1 TTPs 3 IoCs

    remove IFEO.

    defense_evasion
  • Looks up external IP address via web service 1 TTPs 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Start PowerShell.

    execution
  • Drops file in System32 directory 1 IoCs
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 12 IoCs
    defense_evasion
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 4 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    defense_evasion
  • Kills process with taskkill 2 IoCs
    defense_evasion
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 45 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs
  • System policy modification 1 TTPs 2 IoCs
    defense_evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 12 IoCs
    defense_evasion
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4ujuowcfb6rlt0ew.exe
    "C:\Users\Admin\AppData\Local\Temp\4ujuowcfb6rlt0ew.exe"
    1⤵
    • Checks computer location settings
    • Accesses Microsoft Outlook profiles
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    • outlook_office_path
    • outlook_win_path
    PID:1984
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd" /C chcp 65001 && netsh wlan show profiles | findstr All
      2⤵
      • Executes a command shell one-liner
      • System Network Configuration Discovery: Wi-Fi Discovery
      • Suspicious use of WriteProcessMemory
      PID:2084
      • C:\Windows\system32\chcp.com
        chcp 65001
        3⤵
          PID:4496
        • C:\Windows\system32\netsh.exe
          netsh wlan show profiles
          3⤵
          • Event Triggered Execution: Netsh Helper DLL
          • System Network Configuration Discovery: Wi-Fi Discovery
          PID:1836
        • C:\Windows\system32\findstr.exe
          findstr All
          3⤵
            PID:4516
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp8985.tmp.exe"' & exit
          2⤵
          • Executes a command shell one-liner
          PID:2824
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp8985.tmp.exe"'
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1272
            • C:\Users\Admin\AppData\Local\Temp\tmp8985.tmp.exe
              "C:\Users\Admin\AppData\Local\Temp\tmp8985.tmp.exe"
              4⤵
              • Modifies WinLogon for persistence
              • Event Triggered Execution: Image File Execution Options Injection
              • Checks computer location settings
              • Executes dropped EXE
              • Adds Run key to start application
              • Indicator Removal: Clear Persistence
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:3272
              • C:\Windows\SYSTEM32\bcdedit.exe
                "bcdedit" /set {bootmgr} displaybootmenu no
                5⤵
                • Modifies boot configuration data using bcdedit
                PID:4200
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c F: & attrib +h +s +r +i /D & echo [%RANDOM%] ТВОЕМУ КОМПУ ПИЩДА 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:3748
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c cd "%userprofile%\desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] ТВОЕМУ КОМПУ ПИЩДА 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:2112
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib +h +s +r +i /D & echo [%RANDOM%] ТВОЕМУ КОМПУ ПИЩДА 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:3752
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c cd "%userprofile%\downloads"&attrib +h +s +r +i /D & echo [%RANDOM%] ТВОЕМУ КОМПУ ПИЩДА 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:1204
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c cd "%userprofile%\documents"&attrib +h +s +r +i /D & echo [%RANDOM%] ТВОЕМУ КОМПУ ПИЩДА 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:4988
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c cd "%userprofile%"&attrib +h +s +r +i /D & echo [%RANDOM%] ТВОЕМУ КОМПУ ПИЩДА 1>info-Locker.txt & attrib -h +s +r info-Locker.txt
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                PID:1876
              • C:\Windows\SYSTEM32\taskkill.exe
                taskkill.exe /im Explorer.exe /f
                5⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:3464
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c F: & attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                • Suspicious use of WriteProcessMemory
                PID:4060
                • C:\Windows\system32\attrib.exe
                  attrib -h -s -r -i /D
                  6⤵
                  • Views/modifies file attributes
                  PID:3440
                • C:\Windows\system32\attrib.exe
                  attrib +h +s -r desktop.ini
                  6⤵
                  • Views/modifies file attributes
                  PID:2256
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c cd "%userprofile%\desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                • Suspicious use of WriteProcessMemory
                PID:956
                • C:\Windows\system32\attrib.exe
                  attrib -h -s -r -i /D
                  6⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:4724
                • C:\Windows\system32\attrib.exe
                  attrib +h +s -r desktop.ini
                  6⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:3684
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c cd "%systemdrive%\Users\Public\Desktop"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                • Suspicious use of WriteProcessMemory
                PID:2276
                • C:\Windows\system32\attrib.exe
                  attrib -h -s -r -i /D
                  6⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:1312
                • C:\Windows\system32\attrib.exe
                  attrib +h +s -r desktop.ini
                  6⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:744
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c cd "%userprofile%\downloads"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                • Suspicious use of WriteProcessMemory
                PID:460
                • C:\Windows\system32\attrib.exe
                  attrib -h -s -r -i /D
                  6⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:4452
                • C:\Windows\system32\attrib.exe
                  attrib +h +s -r desktop.ini
                  6⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:1048
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c cd "%userprofile%\documents"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                • Suspicious use of WriteProcessMemory
                PID:4336
                • C:\Windows\system32\attrib.exe
                  attrib -h -s -r -i /D
                  6⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:3936
                • C:\Windows\system32\attrib.exe
                  attrib +h +s -r desktop.ini
                  6⤵
                  • Drops desktop.ini file(s)
                  • Views/modifies file attributes
                  PID:3796
              • C:\Windows\SYSTEM32\cmd.exe
                cmd.exe /c cd "%userprofile%"&attrib -h -s -r -i /D & del info-Locker.txt /q /s & attrib +h +s -r desktop.ini
                5⤵
                • Hide Artifacts: Hidden Files and Directories
                • Suspicious use of WriteProcessMemory
                PID:3500
                • C:\Windows\system32\attrib.exe
                  attrib -h -s -r -i /D
                  6⤵
                  • Views/modifies file attributes
                  PID:2996
                • C:\Windows\system32\attrib.exe
                  attrib +h +s -r desktop.ini
                  6⤵
                  • Views/modifies file attributes
                  PID:1612
              • C:\Windows\SYSTEM32\reagentc.exe
                "reagentc" /enable
                5⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Suspicious use of AdjustPrivilegeToken
                PID:2196
              • C:\Windows\SYSTEM32\bcdedit.exe
                "bcdedit" /set {bootmgr} displaybootmenu yes
                5⤵
                • Modifies boot configuration data using bcdedit
                PID:1488
              • C:\Windows\SYSTEM32\schtasks.exe
                "schtasks" /Delete /TN "SystemProtection" /F
                5⤵
                  PID:3488
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe"
                  5⤵
                  • Boot or Logon Autostart Execution: Active Setup
                  • Enumerates connected drives
                  • Checks SCSI registry key(s)
                  • Modifies registry class
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of SendNotifyMessage
                  • Suspicious use of SetWindowsHookEx
                  PID:2000
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\uninstall.bat""
                  5⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4276
                  • C:\Windows\system32\timeout.exe
                    timeout /t 1 /nobreak
                    6⤵
                    • Delays execution with timeout.exe
                    PID:392
                  • C:\Windows\system32\taskkill.exe
                    taskkill /f /im "tmp8985.tmp.exe"
                    6⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2500
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp1358.tmp.exe"' & exit
            2⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1060
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Local\Temp\tmp1358.tmp.exe"'
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:1196
              • C:\Users\Admin\AppData\Local\Temp\tmp1358.tmp.exe
                "C:\Users\Admin\AppData\Local\Temp\tmp1358.tmp.exe"
                4⤵
                • Adds policy Run key to start application
                • Disables RegEdit via registry modification
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                • System policy modification
                PID:4368
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2416
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:2804

        Network

              MITRE ATT&CK Enterprise v16

              Reconnaissance

              Resource Development

              Initial Access

              Execution

              Command and Scripting Interpreter

              2
              T1059

              PowerShell

              1
              T1059.001

              Windows Command Shell

              1
              T1059.003

              Persistence

              Boot or Logon Autostart Execution

              4
              T1547

              Active Setup

              1
              T1547.014

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Event Triggered Execution

              2
              T1546

              Image File Execution Options Injection

              1
              T1546.012

              Netsh Helper DLL

              1
              T1546.007

              Privilege Escalation

              Boot or Logon Autostart Execution

              4
              T1547

              Active Setup

              1
              T1547.014

              Registry Run Keys / Startup Folder

              2
              T1547.001

              Winlogon Helper DLL

              1
              T1547.004

              Event Triggered Execution

              2
              T1546

              Image File Execution Options Injection

              1
              T1546.012

              Netsh Helper DLL

              1
              T1546.007

              Defense Evasion

              Hide Artifacts

              2
              T1564

              Hidden Files and Directories

              2
              T1564.001

              Indicator Removal

              1
              T1070

              Clear Persistence

              1
              T1070.009

              Modify Registry

              5
              T1112

              Credential Access

              Credentials from Password Stores

              1
              T1555

              Credentials from Web Browsers

              1
              T1555.003

              Unsecured Credentials

              1
              T1552

              Credentials In Files

              1
              T1552.001

              Discovery

              Peripheral Device Discovery

              2
              T1120

              Query Registry

              6
              T1012

              System Information Discovery

              5
              T1082

              System Location Discovery

              1
              T1614

              System Language Discovery

              1
              T1614.001

              System Network Configuration Discovery

              2
              T1016

              Internet Connection Discovery

              1
              T1016.001

              Wi-Fi Discovery

              1
              T1016.002

              Lateral Movement

              Collection

              Data from Local System

              1
              T1005

              Email Collection

              1
              T1114

              Command and Control

              Exfiltration

              Impact

              Inhibit System Recovery

              1
              T1490

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              powershell.exe.log
              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
              • Size 2KB
              • SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              StartupProfileData-NonInteractive
              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
              • Size 64B
              • SHA256 2655308486e53c293961ee262b91f0f36049b0910ffecb1d22efe9494e0c3c3c
              • MD5 SHA1 SHA512
              Submit Download

              AppCache134301190365146751.txt
              • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134301190365146751.txt
              • Size 85KB
              • SHA256 b12d1f8abf3c76564b77cd2f22c2b947d3a86c47b5fbd7409c3927a2bd7ffcd2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              __PSScriptPolicyTest_3j5qqjru.554.ps1
              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3j5qqjru.554.ps1
              • Size 60B
              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              tmp1358.tmp.exe
              • Path C:\Users\Admin\AppData\Local\Temp\tmp1358.tmp.exe
              • Size 30KB
              • SHA256 3aa434af770e3e65a44baa222cd7fab6c08f2efa8a80e3ac0f39297cc08d16b3
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmp2715.tmp.dat
              • Path C:\Users\Admin\AppData\Local\Temp\tmp2715.tmp.dat
              • Size 138KB
              • SHA256 8557f90c38f7d05792217c45dae6269a0f753e652f283c29ad5a574de99ef36b
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmp2716.tmp.dat
              • Path C:\Users\Admin\AppData\Local\Temp\tmp2716.tmp.dat
              • Size 224KB
              • SHA256 d781b56555e65272ef4019de8706cba5042fb7afcf0f6e2ca56183ca9567ba8e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              tmp8985.tmp.exe
              • Path C:\Users\Admin\AppData\Local\Temp\tmp8985.tmp.exe
              • Size 212KB
              • SHA256 0d9a318f86cdfc0b7d9118ac69486b9fa6da83055e4f01a8828c199a1de8e2e1
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              uninstall.bat
              • Path C:\Users\Admin\AppData\Local\Temp\uninstall.bat
              • Size 183B
              • SHA256 0b287c7e16c0cc597e4d45dc08cda74f0da37a7a93738b62215ee3c46b2b24d0
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              ReAgent.xml
              • Path C:\Windows\System32\Recovery\ReAgent.xml
              • Size 1KB
              • SHA256 ac8570ece24ae2d3df01b063d75c245e0f53c89b60baf89dd651b7d811818d17
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/1272-42-0x000001D1D3C70000-0x000001D1D3C92000-memory.dmp
              Download

              memory/1984-39-0x0000020101A60000-0x0000020101A6C000-memory.dmp
              Download

              memory/1984-38-0x0000020103390000-0x00000201033A0000-memory.dmp
              Download

              memory/1984-0-0x0000020101630000-0x00000201016BC000-memory.dmp
              Download

              memory/1984-1-0x0000020103390000-0x00000201033A0000-memory.dmp
              Download

              memory/1984-4-0x00000201032F0000-0x000002010331A000-memory.dmp
              Download

              memory/1984-5-0x000002011D0F0000-0x000002011D140000-memory.dmp
              Download

              memory/2000-83-0x0000000004F10000-0x0000000004F11000-memory.dmp
              Download

              memory/2804-89-0x0000024AE9880000-0x0000024AE98A0000-memory.dmp
              Download

              memory/2804-120-0x0000024AE9C90000-0x0000024AE9CB0000-memory.dmp
              Download

              memory/2804-119-0x0000024AE9840000-0x0000024AE9860000-memory.dmp
              Download

              memory/2804-84-0x0000024AE8900000-0x0000024AE8A00000-memory.dmp
              Download

              memory/2804-85-0x0000024AE8900000-0x0000024AE8A00000-memory.dmp
              Download

              memory/3272-53-0x0000000000010000-0x000000000004C000-memory.dmp
              Download

              memory/4368-249-0x0000000000720000-0x000000000072E000-memory.dmp
              Download

              memory/4368-250-0x0000000005640000-0x0000000005BE4000-memory.dmp
              Download

              memory/4368-251-0x0000000005130000-0x00000000051C2000-memory.dmp
              Download

              memory/4368-252-0x00000000051D0000-0x00000000051DA000-memory.dmp
              Download