a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 07:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Size 496KB
Sample261002-je3basce54
SHA256 a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5
MD5 4db0d8abcbcee38ba036ce74d6cfdc23
SHA1 d081c8f299b22497a1ff7c96414d293aa9d785e1
SHA512 1c9c82f5d9ff05ec0449045e310a062acb2bd69eb898bb0235cc844d6d72bad06c88a9175478b6348b23a3b5dfbd54f7874d7d9f68de911e40a5a2332946b493
SSDEEP 12288:2eF24rWF+RU45iPlvzlPqUN+cHEJNi761kIi:fFFoZ45ClvL+cHz76WIi
TLSH
T1E2B45A04BFD612F5F9B70D306EF6E27F4A367830A839EC49D6444E0A99B3D61461A327
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\I:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\J:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\K:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\N:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\W:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\H:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\L:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\O:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\Q:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\R:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\V:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\P:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\T:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\U:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\X:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\D:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\E:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\F:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\M:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\S:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\Y:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\Z:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
\??\G:\	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\INF\dc1-controller.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_mcx.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\remoteposdrv.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fssystem.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\rawsilo.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_ramdisk.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\miradisp.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fscompression.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_proximity.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_firmware.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_diskdrive.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_primitive.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_smrdisk.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_apo.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsreplication.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\oposdrv.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_netdriver.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_scmvolume.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsundelete.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_sslaccel.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_ucm.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsencryption.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_generic.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_swcomponent.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\eyegazeioctl.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\ts_generic.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fshsm.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_monitor.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_smrvolume.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_processor.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_camera.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\rdcameradriver.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_media.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_extension.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_nvmedisk.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_volume.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\xusb22.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_display.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_i3c.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_linedisplay.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\c_scmdisk.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
File created	C:\Windows\INF\wsdprint.PNF	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe

Opens file in notepad (likely ransom note) 22 IoCs

ransomware

pid	Process
5336	notepad.exe
5240	notepad.exe
4756	notepad.exe
4508	notepad.exe
5852	notepad.exe
560	notepad.exe
3028	notepad.exe
2532	notepad.exe
5996	notepad.exe
2772	notepad.exe
2592	notepad.exe
2564	notepad.exe
2828	notepad.exe
2680	notepad.exe
4448	notepad.exe
6016	notepad.exe
5812	notepad.exe
360	notepad.exe
4812	notepad.exe
4488	notepad.exe
944	notepad.exe
772	notepad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe

Suspicious behavior: LoadsDriver 42 IoCs

pid	Process
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found
824	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 5240	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	89
PID 4524 wrote to memory of 360	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	90
PID 4524 wrote to memory of 3028	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	91
PID 4524 wrote to memory of 4756	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	93
PID 4524 wrote to memory of 2828	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	94
PID 4524 wrote to memory of 4812	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	95
PID 4524 wrote to memory of 2680	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	96
PID 4524 wrote to memory of 2532	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	97
PID 4524 wrote to memory of 5996	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	98
PID 4524 wrote to memory of 4488	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	99
PID 4524 wrote to memory of 4448	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	100
PID 4524 wrote to memory of 944	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	101
PID 4524 wrote to memory of 6016	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	102
PID 4524 wrote to memory of 4508	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	103
PID 4524 wrote to memory of 772	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	104
PID 4524 wrote to memory of 5852	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	105
PID 4524 wrote to memory of 2772	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	106
PID 4524 wrote to memory of 2592	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	107
PID 4524 wrote to memory of 5336	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	108
PID 4524 wrote to memory of 2564	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	109
PID 4524 wrote to memory of 560	4524	a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe	110

C:\Users\Admin\AppData\Local\Temp\a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe
"C:\Users\Admin\AppData\Local\Temp\a9f4406f7a5b7b174c09dbb7394db4128a6070adc74754789b01b1720ba994d5.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5240
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:360
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3028
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4756
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2828
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4812
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2680
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2532
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5996
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4488
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4448
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:944
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:6016
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4508
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:772
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5852
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2772
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2592
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5336
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2564
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:560
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 6aa675739e4e154859956f5f651c918762772d0a3e5a6dde52092161fadba81b
MD5 477f7b54d0ac886d4fd5d69aea19c5e7
SHA1 2af466242a8732077c49d7fda657776f72fb3ab5
SHA512 1dfac1e219f2976c3926682f18dac46854ffcea0a444d17bb1fd74b0ff9117830ef9862599b517685116102499e0982f23a80f0f73b092822d1a48c46d74c061
TLSH
T1DCD0A90092E9010AB2F38B222BFB00020776FCD08530E14E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 7d5ed5e3d24b2c4b35059361112caa01709332efda89302345765c6a04f54ec9
MD5 5edb51eea1eaf57d6fdd20fd525db455
SHA1 51c387a4c7db209e9ae6be1f55cc3a101b85e061
SHA512 102ed090abac8a57ab28a6483caa44b84ec23c6dd498217f7bd7d638954ed300ac70bc1f65a6125a09e11eb664d512348f4a5d9fb40ffe040d428e367cb5de9a
TLSH
T1A1D0A90052E80109B2F38B122BFB00020776FCD18630E54E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 2fe23b4612eb3b134ecc98ff66ec700c25bcdb0586dc8e89fe0e22aac2c4c488
MD5 e6b4618e0cd2fbdb9ed1a5e58990d40a
SHA1 fbee2c5851c6c7bf7e19d280eafe607385c17ddd
SHA512 a9c7a17c03ec264bdc5b3e8f454eb661c056031b0450df56585ed0612a3e634c85ed0f197c7b3f8f6f9ebe89e6d1d7beebf92e2d65aab0ce430c9b0220e08b36
TLSH
T188D0A90052E80509B2F38B122BFB0002077AFCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 a0d7e291f0e99f8aa3400815de44d4f8c3e124b170f00fd1630c6aa977746d9c
MD5 6d2eabcc562e6c3484f04cc6dfb95f57
SHA1 8747f7a8524df11f23476e7f3f385cd51cb2ba2a
SHA512 51c57d5a7787b64d6cf6d9d694c896003d9438275427968b0bc597bba4ffff3c20a63d9fbb07fc0434a21ae65b835ea6708d113a929745929931e4f1911858d7
SSDEEP 96:oalWHRvQGW8J/9JeqrYtDusNXe2c87hpXv3211Lh:dlcX0niMb/32F
TLSH
T1FBD1B195B7D98B28F17A8D31ADF560EE85657C825C02CE5F3118330D2872E84EBF172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 a5da1472a6161a6a9fffc2815d00d6886f2d6bf2fb92da1acdf851d070d8c0fb
MD5 b41a65a9b33f70302c861da2a5225b5b
SHA1 d37ffd31b8e44993ea0d3664938642e193e7a0fc
SHA512 c1fb6285e485d8e303cd1bec242243a763823f9d19233e83f8ec005308002dd4c4b57df55c37f310aeaf932c478effd8a32b0bbd565fd28375547dd376a6a9ad
SSDEEP 96:tHj5XgRfWWzlH4VfOrtlEARvoLi+XT7+KZt/Y0BnuOTITdaU4Zvo3KRUmWR:0f5LEAqLjXvF1Nnujkvo3R
TLSH
T10D028825B7E58B24F2B65970DDF0A0DA45757CC21C81DA9F3628730E7C72F8496B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 3ac7120b967505efee27ff73c1b9e8b7cd62a008fab7965ff09d9995c49c941c
MD5 8faed77cd1e7fa827ec083e745b4b4a1
SHA1 4fd6297bff1ead475aa94dc196d25190a0539a51
SHA512 1eb8e6b48daefb3d929974f1e08ba6b238d2f4f1b8ccd02420899fecd577a25209aca390b52f9c7f0f61725d150ecd21f3ac825caa675d495b7eb0a3b7ccf484
SSDEEP 192:aTf31oagX35QwGNogE4xsCDa/HlR1VpRhJElAEm:Cf31oaO5Qw47xsCaX
TLSH
T182525413B7D88919F1F74A70EDBD21E64CA57C821D11DA4F3258B34E1872E84FBA072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 9KB
SHA256 c6dc600a917a5bafffb540b9f1f1194e6391794a2eb90b2abcc14bc596b25d3e
MD5 d0ceb0cdcfbe6f3d1490ab1e30e4d5d4
SHA1 cfc841e87a49911ed186bc54174974fa13d4008d
SHA512 aaeab55dda5e09c514398e0ad0225a1b5fb3dc8c73b0a84cf8af4c9674a5029e2172ea51f751d2bd21f54c045afc009afd3a0d6862407bcc6b208e723c6f32a9
SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMx9POiE18O8tR6Efv1Qc5M4+I8wuCXDH//1ujVGBSSrM:J5fn2j3V+cZU6S5swugYv
TLSH
T1ED12DB55BBE98914F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 63adadc8c5f92cc69c61bf77e01c67be9a1abb9a0bfcf9d8d20718aa948e0fe5
MD5 d4a34a4e0c25bb0d1e0018035ed54b65
SHA1 83ef689a34680d92d009fa5d2fcd2cb64a6331e1
SHA512 d36514dd60e780ddd3c5b97a63228e1530ac011b2c89157c72b81519a59139c9903aae1d32dba2118972471d9bf0d22c6b194cf569261be2f9365306a2800d45
SSDEEP 96:toMRiOARXGiSeQ8HOqth0myDc8VzE8S0RupQ:uRGfa907Dc8REBVQ
TLSH
T1F7B15A56B3E99A54F17B4E70BDB890F641B5BC525C01CA5F3248731D1C71A88EBB072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 f96da3374c24c3ce1f98ffb8592521e55a41032f54c95d7b7019d7dbaecf8473
MD5 9dd0eec7c752bb1591bc2fb4ec33c02f
SHA1 4e460139b5a3feda7b9e6d383636792b9d3b2a82
SHA512 019a377658ffbc74f945b078a86b3b157e0612b42006d1414013a3cd0109c9c5495b05840cea1be398aa05bf02812fc55d07eb0d29873e7484adb5a085708669
SSDEEP 48:FQ9AgrNDt7/Wyki5m6MRu3owYWeaIDbsRbXcVMRTplqEEt45a/U:FQ93rht7/Wy3owY0usNXl3OKP
TLSH
T128A14445B7E88E24F27A9935BCF060E64266BC924C15DA5F3384730D5CB3794E7B071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4524-1017-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-2985-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-1308-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-1599-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-1964-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-2329-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-2620-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-652-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-287-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-3276-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-3641-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-3932-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-4297-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

memory/4524-4588-0x00000000009E0000-0x0000000000A86000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads