a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5

Analysis

max time kernel
135s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 07:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Size 496KB
Sample261002-je3basce54
SHA256 a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5
MD5 4db0d8abcbcee38ba036ce74d6cfdc23
SHA1 d081c8f299b22497a1ff7c96414d293aa9d785e1
SHA512 1c9c82f5d9ff05ec0449045e310a062acb2bd69eb898bb0235cc844d6d72bad06c88a9175478b6348b23a3b5dfbd54f7874d7d9f68de911e40a5a2332946b493
SSDEEP 12288:2eF24rWF+RU45iPlvzlPqUN+cHEJNi761kIi:fFFoZ45ClvL+cHz76WIi
TLSH
T1E2B45A04BFD612F5F9B70D306EF6E27F4A367830A839EC49D6444E0A99B3D61461A327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\K:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\L:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\U:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\H:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\I:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\J:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\V:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\P:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\D:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\G:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\M:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\N:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\O:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\R:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\T:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\E:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\Q:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\S:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\W:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\X:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\Y:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\Z:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe

Drops file in Windows directory 57 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_smrvolume.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\dc1-controller.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_monitor.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_apo.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_diskdrive.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_display.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fshsm.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_holographic.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\xusb22.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_media.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_camera.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_firmware.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fscompression.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsencryption.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_scmdisk.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\remoteposdrv.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\wsdprint.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_netdriver.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_proximity.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_ucm.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\oposdrv.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\rdcameradriver.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fssystem.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\rawsilo.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_scmvolume.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_sslaccel.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_swcomponent.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_volume.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_linedisplay.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_smrdisk.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\ts_generic.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_extension.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\miradisp.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_processor.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_mcx.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsundelete.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsreplication.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe

Opens file in notepad (likely ransom note) 21 IoCs

ransomware

pid	Process
2924	notepad.exe
3808	notepad.exe
936	notepad.exe
4724	notepad.exe
4484	notepad.exe
680	notepad.exe
1408	notepad.exe
1760	notepad.exe
1712	notepad.exe
3528	notepad.exe
2188	notepad.exe
2556	notepad.exe
3952	notepad.exe
4084	notepad.exe
3948	notepad.exe
1680	notepad.exe
2348	notepad.exe
4676	notepad.exe
4212	notepad.exe
1756	notepad.exe
652	notepad.exe

Suspicious behavior: LoadsDriver 38 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 2188	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	98
PID 4444 wrote to memory of 2556	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	100
PID 4444 wrote to memory of 1712	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	101
PID 4444 wrote to memory of 4724	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	103
PID 4444 wrote to memory of 4676	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	106
PID 4444 wrote to memory of 3952	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	112
PID 4444 wrote to memory of 4484	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	113
PID 4444 wrote to memory of 680	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	114
PID 4444 wrote to memory of 4084	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	115
PID 4444 wrote to memory of 3528	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	116
PID 4444 wrote to memory of 1408	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	117
PID 4444 wrote to memory of 4212	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	119
PID 4444 wrote to memory of 936	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	120
PID 4444 wrote to memory of 1756	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	121
PID 4444 wrote to memory of 3948	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	122
PID 4444 wrote to memory of 652	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	123
PID 4444 wrote to memory of 1760	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	124
PID 4444 wrote to memory of 1680	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	125
PID 4444 wrote to memory of 2348	4444	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	126

C:\Users\Admin\AppData\Local\Temp\a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
"C:\Users\Admin\AppData\Local\Temp\a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2188
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2556
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1712
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4724
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4676
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3952
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4484
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:680
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4084
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3528
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1408
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4212
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:936
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1756
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3948
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:652
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1760
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1680
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2348
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2924
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 4cac95964e927316b7825ba8b369d54cdfab9d9d408c0d4768de09815b753162
MD5 82ec0a11ee75d79e58f8b3507b6ae0e1
SHA1 c781a85c80c1acb296f4806860e2b7c861a95da7
SHA512 b14111c86ca42d4625c16ce1c3e652817c638da023cc41d52b305779a8061f60dc05ad42d7add47fb9e27c7ebc163c79bcf66a4cff14a163fbb15f70ba30b9ba
TLSH
T145D0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2190AB2F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 6aa675739e4e154859956f5f651c918762772d0a3e5a6dde52092161fadba81b
MD5 477f7b54d0ac886d4fd5d69aea19c5e7
SHA1 2af466242a8732077c49d7fda657776f72fb3ab5
SHA512 1dfac1e219f2976c3926682f18dac46854ffcea0a444d17bb1fd74b0ff9117830ef9862599b517685116102499e0982f23a80f0f73b092822d1a48c46d74c061
TLSH
T1DCD0A90092E9010AB2F38B222BFB00020776FCD08530E14E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 6d7120cec8e3bc78c0408118f488e235aa776c7bd259ecfc2b8a9da3d8f16998
MD5 ebb99f63c77275d2cdd870c3e0ec0111
SHA1 4306cbe079f7733e16529dc13b57eb596b9ed990
SHA512 878276b9d155c160e819cd6fb173b5b4efe6a14cf5c5e63e13c791096d360228d71ef058fc39392e40805f2d36902c3058c2461fb9abecaa82054e63f435ddc0
TLSH
T142D0A90056E90109B2F38B122BFB00020776FCD08530E14E31C0A2190AF1F8489B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 3904eb8e395cbb8af714d276aa4a74d0e34c62df3176e91cdb196cb38c7a9ca9
MD5 4245b5fa3bb97180fadf6fb92b6fcbf9
SHA1 1c602e304a522f11cf21ff5b14f2eba6a5884926
SHA512 5fc3b2470af035d99c609d321bd426bb5259daa068faa5f44953bc467e777415f6d04ac39db019cabf3fe290a7665bbaa533ef8a55068c5a69cc1d8aac9d640c
TLSH
T170D0A90062E8010AB2F38B222BFB00024776FCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 ba0019a59d29e9d92633e4bf0e068b6f4ccf14508e3e048cfd11508af865f8aa
MD5 6cb578a81b8a2db7c2cf5c07a1020596
SHA1 f44ab06dac160272082de59e69d4c0b231e749ec
SHA512 7dff1b245d1da0b8d4104b1014d17af62aa3ee383a038f015331ace4f6a5988eba911443643155a3a5c0f6d467c1ff5e456e9e7e3e35609b9edf7c91f6ec9a6d
TLSH
T18BD0C95156E90509B2F78B222BFB14524776FCD18975E18D31C0A21D0AB1F9489B5773
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 973d23e48cf13a102e333830c91d5397a4dce5737caaeddcfcda2c38e5949da9
MD5 ec2f6d01890144980ad33e62a2584530
SHA1 4f4211a61ac1c46a8d89b43493a8ad5717d9b5c4
SHA512 cae3367b285e98b5821e63322f21b5e89a7cdc4e8fca120427bee058d377ad52e297e5cde672e38099086017cc930bbae00d4e03e25be7457f0c6bf79bb3db16
TLSH
T1EAD0A91052E80109B2F38B122BFB00020776FCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 74011c6f7bc5773dffaeb9255b2e6afd96d56ee5390ab7a51f3db675311a8ce1
MD5 9357e5eb54287682201ed772e7254e99
SHA1 7727334f31e28ffe28770c45cf63e2838eef1b86
SHA512 7c6a43671d04b1da51f35457bff21592dd51d3a56cd7e24cdfd5ded0f3626369e196ce17ab440019e6ef45902f2c5b09fe94b3a9daea8db0928f24129493f50d
TLSH
T1BDD0A90052E80209B2F38B122BFB00020776FCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 0f0833a24954ed761ec32fbbe779895ce8d732bce89dd0e9742b9fcf496edc00
MD5 64ba20bc368dd34db33e5a168cf975ed
SHA1 9d81494c95d37670cec5a9eda130e4d1cdfc092a
SHA512 96ba23017677ef14d81efc1e5beac4b03b65dd5d619ddfa21c617501966c8dfe09d82a24125efb79ca8ef73059717b8d1253b171174052cb6b7daceb4a8fa827
SSDEEP 48:s6j4xIiupQ/sHBTflU/Weqn774QE5iqjYDEwEFeaIDbsRbXkMx86xQ4SVNdcOEZT:xj4xFuKeBTfW/WeqWYgDusNXeDcbcqJ
TLSH
T13FD1AC11B7D88B24F1764930AEF5A1EA8665BC824C05EE5F3518330E2872E95DBF172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 84ad5f4fef70195acc0c735ec42e5be6477593fb98a814f00dbef718cca2ba15
MD5 c5918e9ef5e939beebb9f792c37f0c25
SHA1 4d216963397b74f57855d2eb70ea0117cc4ce9b9
SHA512 9b66271daee9def37d498e08eaa2b9eca8f202241fca541a02a65110f0d34a529f0936ac6f85e74f70ea55f822600c8b5d3ea2399c7a99dc8a10792a8baa37ee
SSDEEP 96:q/cw3dCMNyLfsl7Hk+VNOrtbGRlRtalu32CZWB7QIKPh7VGpR2b8jN:VwEMYa7HGG1L+7j6i
TLSH
T1CA027736B7D9AAA4F1BF59B0EDF850E546767D811C01CE4F3128734E1C72A84D6A032B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 7e6e4436b10e090fb14c2b72a4643d3335b5f6af0f250e19003f9faa17a7d7d5
MD5 c9fcac60ea1d1f9f3a7f84168bd2d264
SHA1 f3ccc2ace2179dceb1dc94bc59ab6699b3368169
SHA512 57dbc4645ffc74f234f5a9d9775ebd378015b73a9da55b63bd7a46c0a66619a092db09a028d68880b4ae13bc23ef896d1b4c5167239523b9494de497fbbe61ca
SSDEEP 96:QyOzh59kjf3WSkEFRcpXyY3q8xPOQlf88GcNy1/HC3T6gYq2hwyvVATCG5qylmqG:o0f3woapXQvQ1HNogE3lJSZmXx7p
TLSH
T119427C56B7D9C919F1BA8E70EDF851D948B57C821D01CE1F3168B34E1872E84EBB072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 6KB
SHA256 8175f3000d31f9afadbbba3149b647da59b30712668751cd04216bbbbc9897ee
MD5 29f6df5957016e418fbd0f2407e3575e
SHA1 0ffdc37e214ad11658b1732a8448eab853713b6b
SHA512 e5916dfd44a4456d0f8c7f42b993426c1196059c053a46ac324104edc674944f622b43c7ecb652e1904dd11932d98b87216e7860f5ce193bcd8899162dcbcc8a
SSDEEP 96:K3P2tl44AX7cWfWOMnVj3yjNMGULTcRXqE18O8t746Efv3VfANNWuyfJ:Offn2j3ExULohRp6WqNWus
TLSH
T198E1865577D98A24F1765931AFF5B0EB82657CC24C42DB5F3208731E18B3A84D3A1B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 6040b942d0887f914a296e8ae0cc67300c479d4d0bb24bd07dde54ee142c4161
MD5 b9fc29f586c7a0abdb7f33a173bd4518
SHA1 8a6386314e2b0dac9e57874164e865a6a94a0ba9
SHA512 b44ea31a19c30c6b1fa4ee964284bc05e6d373d2c22a5012aec388465eb96b84a071804e49d2be577cf07ed24b535bd19e39c30b9a191a140f0c3875682cbfe3
SSDEEP 96:VF7RG+gmXfWAoeS1HOwthgmyDc8Vze8SWtpJO1:zXXfJozJg7Dc8ReBWlc
TLSH
T183B17B45F7F68A18F17B5D30ACF4A4F685B2BC826D01CA5F3248731D1872A94EBB071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 a1adc7fa887697d1ed6665e7bf62450af545d4886c72e8d6a65c1bdad5aa36cf
MD5 a38fe73c827fa9e56d72a7147d3d02a3
SHA1 dd89be63801c5816a70e73c08623717973446b5f
SHA512 35f2238d9646943f71b051994e69790392eb6a517e2cf8fed4ad38d777fd7af5c254cc60842bd5a01c7ce1a945ccf60f1fdd1882a29fb03df144136a4a31eec0
SSDEEP 48:+j5CyGz7ElZd/Wykc5KaMRi1Y7eaIDb4RbXKVMRGGLp7tVCCHr6mv7C:Y5RGzY/WyLYBu4NXDLpxV3r6mvG
TLSH
T11A91589A7BD58E24F27A9D35BDF460E746A2BC428C05CA5F3244331D0C72784E7B162B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4444-384-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-4233-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-1776-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-2844-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-3374-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-1241-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-3806-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-2309-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-814-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-4874-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-5301-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-5836-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-6263-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

memory/4444-6798-0x00000000002E0000-0x0000000000386000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads