34e5ae66f1417c12ea09219e6582964bd836da0535355a31aa268be9a563051b

Analysis

user interaction
yes
max time kernel
139s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/10/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RwPortableX64V1.7.zip
Size 3.4MB
Sample261018-repdfaez9z
SHA256 34e5ae66f1417c12ea09219e6582964bd836da0535355a31aa268be9a563051b
MD5 4e811b668d0302c8264de237d67eafc1
SHA1 1bc3a25558ff90e586fced40ebbc273c55339f8d
SHA512 a44f5ec2df11337412f74f4bfcdf2f51b87606928a2f999a0503a55f8088a903cf032a4beb3e9c7e36375c9a6aac987afba28e572e8f2dfd80624220ffe99bdf
SSDEEP 98304:pHyT0pZkF3UxZmDMVnWqOG6rif4dUxD0H5E:ZyTIK3UiDGnEG16UZ0H5E
TLSH
T1CAF5338890C7903CB9E7E36EC95E8100103CA36AE6679F5F91DE537F5BBE4ADD41900A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery ransomware

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\Drivers\RwDrv.sys	Rw.exe
File created	C:\Windows\system32\Drivers\RwDrv.sys	Rw.exe
File created	C:\Windows\system32\Drivers\RwDrv.sys	Rw.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4824	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-338007942-693956180-937915117-1000\{8FA54348-D5C6-49A3-8AA1-D9F7817E7C53}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
3616	NOTEPAD.EXE

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
676	Process not Found
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2240	3216	msedge.exe	91
PID 3216 wrote to memory of 4824	3216	msedge.exe	92
PID 3216 wrote to memory of 4488	3216	msedge.exe	93
PID 3216 wrote to memory of 4488	3216	msedge.exe	93
PID 3216 wrote to memory of 4488	3216	msedge.exe	93
PID 3216 wrote to memory of 4580	3216	msedge.exe	94
PID 3216 wrote to memory of 4580	3216	msedge.exe	94
PID 3216 wrote to memory of 4984	3216	msedge.exe	96
PID 3216 wrote to memory of 4984	3216	msedge.exe	96
PID 3216 wrote to memory of 4984	3216	msedge.exe	96
PID 3216 wrote to memory of 4708	3216	msedge.exe	97
PID 3216 wrote to memory of 4708	3216	msedge.exe	97
PID 3216 wrote to memory of 4708	3216	msedge.exe	97
PID 3216 wrote to memory of 4388	3216	msedge.exe	98
PID 3216 wrote to memory of 4388	3216	msedge.exe	98
PID 3216 wrote to memory of 4388	3216	msedge.exe	98
PID 3216 wrote to memory of 4064	3216	msedge.exe	101
PID 3216 wrote to memory of 4064	3216	msedge.exe	101
PID 3216 wrote to memory of 4064	3216	msedge.exe	101
PID 3216 wrote to memory of 1744	3216	msedge.exe	99
PID 3216 wrote to memory of 1744	3216	msedge.exe	99
PID 3216 wrote to memory of 1744	3216	msedge.exe	99
PID 3216 wrote to memory of 2060	3216	msedge.exe	100
PID 3216 wrote to memory of 2060	3216	msedge.exe	100
PID 3216 wrote to memory of 2060	3216	msedge.exe	100
PID 3216 wrote to memory of 3344	3216	msedge.exe	103
PID 3216 wrote to memory of 3344	3216	msedge.exe	103
PID 3216 wrote to memory of 2128	3216	msedge.exe	104
PID 3216 wrote to memory of 2128	3216	msedge.exe	104
PID 3216 wrote to memory of 2248	3216	msedge.exe	105
PID 3216 wrote to memory of 2248	3216	msedge.exe	105
PID 3216 wrote to memory of 2248	3216	msedge.exe	105
PID 3216 wrote to memory of 660	3216	msedge.exe	107
PID 3216 wrote to memory of 660	3216	msedge.exe	107
PID 3216 wrote to memory of 884	3216	msedge.exe	108
PID 3216 wrote to memory of 884	3216	msedge.exe	108
PID 3216 wrote to memory of 2756	3216	msedge.exe	110
PID 3216 wrote to memory of 3244	3216	msedge.exe	111
PID 2756 wrote to memory of 2436	2756	msedge.exe	112
PID 3216 wrote to memory of 772	3216	msedge.exe	113
PID 3216 wrote to memory of 772	3216	msedge.exe	113
PID 3216 wrote to memory of 1192	3216	msedge.exe	114
PID 3216 wrote to memory of 1192	3216	msedge.exe	114
PID 3216 wrote to memory of 484	3216	msedge.exe	115
PID 3216 wrote to memory of 484	3216	msedge.exe	115
PID 3216 wrote to memory of 1076	3216	msedge.exe	116
PID 3216 wrote to memory of 1076	3216	msedge.exe	116
PID 3216 wrote to memory of 1328	3216	msedge.exe	117
PID 3216 wrote to memory of 1328	3216	msedge.exe	117

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\RwPortableX64V1.7.zip
1⤵
PID:2392

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3096

C:\Users\Admin\Desktop\RwPortableX64V1.7\Win64\Portable\Rw.exe
"C:\Users\Admin\Desktop\RwPortableX64V1.7\Win64\Portable\Rw.exe"
1⤵
- Drops file in Drivers directory
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://rweverything.phpnet.us/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffebcd0c188,0x7ffebcd0c194,0x7ffebcd0c1a0
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,11889943036688067901,10809967067238849643,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,4758312483857626653,5163487841181095340,262144 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,14656533420668845288,8949415724106475633,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:13
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,4767302386904826373,13369252549212919180,2097152 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,4199331885729424638,506506081753763288,2097152 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,4809968228329173404,14580121998633718698,2097152 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,845605814481727073,5745900166584261055,2097152 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:9
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4300,i,16617986567359815887,4105434889625952124,2097152 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4360,i,4594352135209882312,18323194404667008799,2097152 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4892,i,12549912264188454410,14563776628840703169,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,17857188944676192603,15348470254994531216,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5608,i,14815160488228120340,13036228671577428511,2097152 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,3553682835615982378,1921651047215250243,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:14
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,1123328758319619248,12378278318887812992,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:14
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,6527672032215658341,562435552078113792,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,14748659017958461433,15514844895995302051,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,6527672032215658341,562435552078113792,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,8322608924712383003,16961150234227552621,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:14
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,13900000609464686847,376534329797546330,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:14
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,12859592717310129794,12069235507174243998,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:14
  2⤵
  PID:484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,13121774116563852958,15915204349824658848,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,1624645338307386299,16620512413978673653,524288 --field-trial-handle=2196,i,7349844525384986802,3092350865187189997,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14
  2⤵
  PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4948

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\RwPortableX64V1.7\Win64\Portable\Log.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3616

C:\Users\Admin\Desktop\RwPortableX64V1.7\Win64\Portable\Rw.exe
"C:\Users\Admin\Desktop\RwPortableX64V1.7\Win64\Portable\Rw.exe"
1⤵
- Drops file in Drivers directory
PID:4648

C:\Users\Admin\Desktop\RwPortableX64V1.7\Win64\Portable\Rw.exe
"C:\Users\Admin\Desktop\RwPortableX64V1.7\Win64\Portable\Rw.exe"
1⤵
- Drops file in Drivers directory
PID:4812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0fc50752-12e6-45fe-b2b3-da6264d44156.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0fc50752-12e6-45fe-b2b3-da6264d44156.tmp
Size 18KB
SHA256 809ca7a404977f22dac78ff9d21cfcfd2e125ff32e415f79eba4170094756688
MD5 4608d82daee9a4f3f3bde6772eb8bc07
SHA1 0813e18b1a856d977a535dcce0b91474165a3fdb
SHA512 b69a1fe6b7dc2723a749c3155f9a9c979ff935b0a1e9dc4e876f382915e9333bdb8b4f1f431ec5b5020293ce9ba39de3314f4c41544eaba78b3f31eae0f1f632
SSDEEP 384:nnQkUSv08NwLHrJ2l6Z9ckX5mV8WAyLweLAfsLAIIl/T:50sl6ksAzfLdLAfjLlT
TLSH
T1AB827B316C79AC378AEBA501F58E3683AEB46167E9842F54D9DC4B1C00CA3DC370B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6efedce1-f621-438e-b603-c01f32429ff9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6efedce1-f621-438e-b603-c01f32429ff9.tmp
Size 22KB
SHA256 c761ea7d79cd67a54c12c58d21954398a9c563e4076a6830ec00fbf20a71d1e5
MD5 a4d95a28bd9f13a4803881ec930b61a0
SHA1 280f1c9f487efea19fec1e08d5c4495ddb304882
SHA512 ca65b33e4e94c6a855838280ffb0cb7aac8c1cc4512e6fad980983b5267e89cd105e71ab153ee9de73b00b3584d4163726b65c1de8ae0bcaf4fe7239b42c0f6a
SSDEEP 384:nxQkUSvy8NwLHrJn3IZ9ckX5mV8WAyLwecv1fSX9ZjoAfsLAIIl/T:jyt3IksAzfLdefW9ZkAfjLlT
TLSH
T16CA23A3D5C346C3F85AFB705A64D35275D69823BEAB42A98D7C81B0DC0B929CF303926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 635a17b62bc802a1d6d2ac977e63b5a2027aa2bf3d1b5551e63352afa4362fd9
MD5 7fe12d00d13e30949f1419fc02757c7e
SHA1 7fe9042bd95f9f143a17aee8b65dd97f8f4eb44e
SHA512 c9251c530a2927beaa3f58a69cd075267ab37b951ce23f2f159ff17f194ed9b03a08d41f5cce2d4dd1a091898135db5440df49406cc67c2f8fa1bd50c44edd4e
TLSH
T1B1D011A2FB32008CE0802238A23B2B282E00820000C30000AA2000AEAC882A2AABE028
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d5203709d191cefd619c9b1777d39aff6cab97309c7e64a26cca768a0982a1c1
MD5 557bc82a1999f7b11291385864c1d95a
SHA1 3e6c218368478c58448f56f0a579d50a586fef13
SHA512 a9b3c0413a0c2e323247435861e122817cc75b3a631c1cb370d12f61e774b277ad13ae194d55801409143528ecdaa2800eb07e6939afdd052a89984749a6f9fc
TLSH
T16BD01261B93739EDE16A617855795A4459009A53419201115A020C6D596419368B59E8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aa0ef8543982e42f2141a859cd78cf0f780a6b139ea99c1c2ad33fd4f56cb7b
MD5 cf1ef0f6a6585003596ad6b09c83cbc3
SHA1 80edf8da49bc458828bf3125b8b4aa3036814e22
SHA512 0c23492cf0d4ab37f4a7f42f865cc6238ff5b3cdabf212ce523b204513d6aa133d66ec3e381caf548455fba3f37294ba5fdf00ad1dbaac1945115047c226530d
TLSH
T198D012A1FB31008CE4801134613A1B281D00810000C301015510009D4C441D2657D024
MD5 SHA1 SHA512 TLSH

Submit Download

835ef341-a551-4985-b21c-b5326384b766.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\835ef341-a551-4985-b21c-b5326384b766.tmp
Size 11KB
SHA256 49ed8a1f6d6b4b771ced6924c52ffd589832c3059cef5efa89b4e1e92270f9d1
MD5 935bd8114f625009fe1cf7a892460895
SHA1 c09359d99691afa454d23004764054e28d505957
SHA512 fe13d339a5e8031492780d49a155aebc8609b0e9bb601618ad0cc3217985f29fe88ad8613a4f91bb5900185c4b79b9f76d30f76857f127b79480e63aacb9e3de
SSDEEP 192:sxZnRhxQ/fNs9WpVirbP0iSIdpXT/W6+WN1vIO/Y0nGScjUIgyJ:sxZnFQ/fNs9WvMzxj/b3/5SUO
TLSH
T16332C756AE38697B8CCBE21DBE557F13D6F9502291D01E48AAFC861C04E66DD230781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8457ebbd-2ab7-42ab-a07c-adb6e3dd9417.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8457ebbd-2ab7-42ab-a07c-adb6e3dd9417.tmp
Size 33KB
SHA256 97c0682488c4595a6e370cd78f395d5fbb567e375b792105085ab36551672105
MD5 d8d7de9fc49258af742c4cd884c81449
SHA1 a6ec65fa525aa4a13ef8702fbb31b1ca433ba6a9
SHA512 5822a7c41d9b41d3c2b60c3c3f6bf6579fe8b42fafe7ebbd0942e5feadb2537ed6b363f42480eaf7aa690654b69e8f71a1bb0e442e5bd4dbc401c395c64fac24
SSDEEP 768:JGY2I87M2Vd7pLuLjXTWRmjdQVx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nyLyLlt:JGY2I87M2VLEjXTWRmjdQVxu1jaKnyLM
TLSH
T1EAF2E97B380CCB7F4FC05E9DDD1A6F9B6DA8028B9698898047FA855C02C77EE51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c24168ae940b9188bcb4412ab16e6681fade791f74a2aed7cd39c8b2ab62b48a
MD5 4891fd924e116cbf2372c156e5c983ab
SHA1 ffdcb230825bd2f6e77147545d53358e2fde7e02
SHA512 01c6a28e0b671f99f2556752ed0488895d930bcc5ff5a4366db01584049d99df2979ffebbf9d6f2c0b618469b8149ad47d3590d164b4217da0876896db439856
TLSH
T1D8613CD3185840E4FBBA733C9FED20833A78A54575437E191E54D478B80E767A1B5F40
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e4b55613374ec723e1130151b91f8e4922d364ebdb6b43d1bd0eba3ee2843bb9
MD5 96088c24f51e934ec0a417960a19439a
SHA1 f9a3b9d037d9accb7fca082b2f07fff1ab28bd26
SHA512 a5f8d2bf785b0df820beaaa485ebbbcad08b049c2b3dc62dfd925af44e24f5284eb54eaade8f8b93a442b2206b1090ecda836b557a558e1911abccc2d7c51316
TLSH
T1F1613ED3185841E4FBBA733C9FED20833A78A54575437E291E64D878780E76791B5F40
MD5 SHA1 SHA512 TLSH

Submit Download

7f3a6099-085a-434a-a83d-b433d1eba5b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7f3a6099-085a-434a-a83d-b433d1eba5b4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.111.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

3fa9b1f1-38ec-4e5e-b6b9-a04d7a69c7eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3fa9b1f1-38ec-4e5e-b6b9-a04d7a69c7eb.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f3dc61e6-10c2-4bb5-8139-0df63826247e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f3dc61e6-10c2-4bb5-8139-0df63826247e.tmp
Size 1KB
SHA256 136d4c89106e1892636da9179235951dbfbee00fa4da7500d0b7e275aa5a750e
MD5 df9690199bdd08292500e6fc31961a3b
SHA1 43d9f5c80c7592b0654d4ce3365702ff56608378
SHA512 1551c204b9d040feb2afe7dc28ddcb6c49568e8ad1ab330be975845519a0e9fd992e2190a26a0c9a60fb8a58b31b6526bccddc3638fe7cd34c49da66fcd9da2a
TLSH
T17C419DF3C3E8866E890156F0A728BE2BDE2D0954832C3D5AC4E8AF1B93E2871D14155F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 afe7fd6037e8190329352d77848d5fb2f76af24c562d1646f0af4f025e220b8c
MD5 73cc27aec757ba3be81d4e417804fb47
SHA1 0cc5e4a746f14a560122e02321ccdf605e458fa0
SHA512 4fd164d02e40370f143a979e136d93f721825a4e7e2a76accd108061cbf2cd1f8b0d7d7c4b0eb3da13c9e55ce395a39d553c515bdec085147442a41a0fd06047
TLSH
T1D4319D20762753C13AFD36184599D617726174B33918B86E7AF843B50A2AF005DFECCD
MD5 SHA1 SHA512 TLSH

Submit Download

f8e8f1a3-2684-4e00-a6c6-614130ac5c63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8e8f1a3-2684-4e00-a6c6-614130ac5c63.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fab3e0fa-8773-46c1-91d8-a05b578a94b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fab3e0fa-8773-46c1-91d8-a05b578a94b0.tmp
Size 10KB
SHA256 df63a2d91afcc013ce2c94a15bdbbc66b2fb1afa5197da1a92e18f936a64351d
MD5 a6d1e929453695961ca4020c89d3063f
SHA1 45de2e22197a3d69e26f78094eb8c109ac217748
SHA512 5c7a1ad192c2b4d859be17d2f8a46779ea58db48f57919702e5a568177f57e1eeb236604d41d94c34a21289a4fb0d96ce7ce3b3c1729ebf3e564ce440877624c
SSDEEP 192:sxZnRaxQ/fNsxrbP0iSIdpXT/W6+WNvIO/Y0HKhcyGIg4J:sxZn4Q/fNsRzxj/bB/5DXc
TLSH
T1EF22C6566E38697B8CCBE21DBA65BF43E6F9503291D01E48AAFC861C04E66DD130781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

ca629492-27f5-49f5-a257-19ad01c343c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ca629492-27f5-49f5-a257-19ad01c343c4.tmp
Size 8KB
SHA256 7664e15183fc54483279e5e9bde252042602144f1409f6c617a4b7744cbb400b
MD5 13989517edc80f7aea76988f27466fed
SHA1 457724a6fc07ecca801b7b024913150f7e21df88
SHA512 7435fc46c846ac7f6a0588fcbd7e971e2b629c7674244e2418b8debccd568c9cc50c735a56666dc8ddea7f4af61bbe987ab3b52bc7fabccd92faf31916549b90
SSDEEP 192:zGNh6WLfQmiUy1yn1yGbEbnckX5m9r8WApoLwWMeZrqpqlU6:zGNh6ahzcGbQckX5mV8WAyLwoLU6
TLSH
T1E0120975BC78AC375EE3F815B98737179EA52167E9846F44D6E80A1C00EA39C370B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da8f0418-1028-462e-a896-a2d700419f41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da8f0418-1028-462e-a896-a2d700419f41.tmp
Size 8KB
SHA256 2676cc89f30c019875d27e533a2d83d7d69ede1babbee8912937acbd655c3a46
MD5 cad15c20e52576ed45eb4c47e7880425
SHA1 3e757359ef5a24eba7fdc2fb22a3ba5f03599974
SHA512 c1420e9469770966baf5adf81aab24686494676b42dc021bfb124b38151cc75789649e6644a89d79f614d17b35dba9d9ca60a69bb542c5418566512d82bf1575
SSDEEP 192:AGN46WLkQmiUy1y0m1yGLEbnckX5m9r8WApo24lXbU6:AGN46a0z0PGLQckX5mV8WAyfrU6
TLSH
T1A402E739AC787C7B9EF3AD59B94636175EE5102BEA852F44DAE81E1D00D729C2307823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d403302-3116-4305-a908-7b20bc5cd0b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3d403302-3116-4305-a908-7b20bc5cd0b5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

610e83ca-2e7f-428b-952d-2d018262934c.tmp

Path C:\Users\Admin\AppData\Local\Temp\610e83ca-2e7f-428b-952d-2d018262934c.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

b99eda35-ab95-4df6-a001-43f26ccfe7c5.tmp

Path C:\Users\Admin\AppData\Local\Temp\b99eda35-ab95-4df6-a001-43f26ccfe7c5.tmp
Size 158KB
SHA256 3d0a40deb15b80333a0b152bac6856a3345cbfcd29fd6a5c33a6e4bd22c1b272
MD5 9c18c4721b560ec55f0d5de055144d5c
SHA1 6af37a3bda916cac276ad5879c9f61262d9ae523
SHA512 51466928eb8d3cf7b917919c98bd8168453583d2c3dc5836036d87ffd0d2c732ab8450212a880fc6de199ea569a96993ba0d250a5012160d2d72211880695f92
SSDEEP 3072:5ZwEurOxn8zXnHc2qHNYEU/rUHCVJWGdi0Ha5HnXk9TFzBsuht7yGik:5ZwPOx8D85UIHEI0HaZ09JzKStjik
TLSH
T1CFF3E13E7EDE891AD80B10BB7F16B18BD80D8E0B460AB44B769D80155B3668D1BD1CFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3216_1608740502\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be8ff8be-f1eb-46b1-b74e-87e00a6c1db9.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3216_1608740502\be8ff8be-f1eb-46b1-b74e-87e00a6c1db9.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3216_1633243393\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4460-0-0x0000000000400000-0x0000000000E61000-memory.dmp

Download

memory/4460-3-0x0000000000400000-0x0000000000E61000-memory.dmp

Download

memory/4460-1-0x0000000001360000-0x0000000001361000-memory.dmp

Download

memory/4648-571-0x0000000000400000-0x0000000000E61000-memory.dmp

Download

memory/4812-574-0x0000000000400000-0x0000000000E61000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads