Resubmissions
27-01-2022 18:30
220127-w5lsfshfb8 1027-01-2022 18:25
220127-w2vwysghbr 1027-01-2022 18:21
220127-wzqjfshef7 8Analysis
-
max time kernel
90s -
max time network
65s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 18:30
Static task
static1
Behavioral task
behavioral1
Sample
2f76c2801b2bac498e94d68e99117c5367af97e0.dll
Resource
win10-en-20211208
General
-
Target
2f76c2801b2bac498e94d68e99117c5367af97e0.dll
-
Size
678KB
-
MD5
7ff8505ce55eaf44baf843d3683c5e39
-
SHA1
2f76c2801b2bac498e94d68e99117c5367af97e0
-
SHA256
5e54dfc50c22a8cd92c5d05598bbafc75b999b93224d900017b892a4d9f22077
-
SHA512
bf51272fcf62d9ed3d33718cb1fb707794680b65ea9dcd22f5b5cb28441e7b2423d6bfe43407b2adf4556a88058b5fbc757da6e961d57d34003f15548d2628f0
Malware Config
Extracted
C:\readme.txt
conti
http://contirec7nchr45rx6ympez5rjldibnqzh7lsa56lvjvaeywhvoj3wad.onion/8LijJVnUPEWEaSDvo6Ho56xzmhj8AwiSqncJYX3Hhd3hLoOajUpUdvIF4GHP69AP
Signatures
-
Conti Ransomware
Ransomware generally thought to be a successor to Ryuk.
-
Modifies extensions of user files 9 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
regsvr32.exedescription ioc process File renamed C:\Users\Admin\Pictures\ConvertFromWatch.tif => C:\Users\Admin\Pictures\ConvertFromWatch.tif.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\ConvertUndo.raw => C:\Users\Admin\Pictures\ConvertUndo.raw.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\ExitDisable.tiff => C:\Users\Admin\Pictures\ExitDisable.tiff.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\RevokeShow.crw => C:\Users\Admin\Pictures\RevokeShow.crw.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\UnblockRead.crw => C:\Users\Admin\Pictures\UnblockRead.crw.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\UnregisterUninstall.raw => C:\Users\Admin\Pictures\UnregisterUninstall.raw.SACUR regsvr32.exe File renamed C:\Users\Admin\Pictures\ClearUnblock.tif => C:\Users\Admin\Pictures\ClearUnblock.tif.SACUR regsvr32.exe File opened for modification C:\Users\Admin\Pictures\ExitDisable.tiff regsvr32.exe File renamed C:\Users\Admin\Pictures\GetConvert.raw => C:\Users\Admin\Pictures\GetConvert.raw.SACUR regsvr32.exe -
Drops desktop.ini file(s) 25 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Users\Admin\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Music\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Libraries\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Videos\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Documents\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Searches\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Documents\desktop.ini regsvr32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini regsvr32.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Desktop\desktop.ini regsvr32.exe File opened for modification C:\Program Files\desktop.ini regsvr32.exe File opened for modification C:\Program Files (x86)\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Links\desktop.ini regsvr32.exe File opened for modification C:\Users\Admin\Music\desktop.ini regsvr32.exe File opened for modification C:\Users\Public\Pictures\desktop.ini regsvr32.exe -
Drops file in Program Files directory 64 IoCs
Processes:
regsvr32.exedescription ioc process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\jawt.lib regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019XC2RVL_MAKC2R-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\ct.sym regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-phn.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp4-ppd.xrm-ms regsvr32.exe File created C:\Program Files\Mozilla Firefox\defaults\pref\readme.txt regsvr32.exe File opened for modification C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_Subscription-ul-oob.xrm-ms regsvr32.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\readme.txt regsvr32.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\javaws.jar regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Excel2019VL_MAK_AE-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectPro2019XC2RVL_KMS_ClientC2R-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt regsvr32.exe File created C:\Program Files (x86)\Google\CrashReports\readme.txt regsvr32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsnor.xml regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_SubTrial5-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WordInterProviderRanker.bin regsvr32.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.VisualElementsManifest.xml regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O17EnterpriseVL_Bypass30-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019R_PrepidBypass-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\AddConfirm.TTS regsvr32.exe File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-3102-0000-1000-0000000FF1CE.xml regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_Grace-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTrial-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProXC2RVL_MAKC2R-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019R_Retail-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTest-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Retail-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Trial-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd28.tlb regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessVL_MAK-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTest-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Orange Circles.htm regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Grace-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.sig regsvr32.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ul-oob.xrm-ms regsvr32.exe File opened for modification C:\Program Files\MergeUse.MTS regsvr32.exe File opened for modification C:\Program Files\VideoLAN\VLC\NEWS.txt regsvr32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipscsy.xml regsvr32.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\HandPrints.jpg regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ul-phn.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_MAK_AE-ppd.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Trial-pl.xrm-ms regsvr32.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF regsvr32.exe File opened for modification C:\Program Files\VideoLAN\VLC\Documentation.url regsvr32.exe -
Drops file in Windows directory 5 IoCs
Processes:
taskmgr.exeregsvr32.exetaskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\1601268389\1361672858.pri taskmgr.exe File opened for modification C:\Windows\win.ini regsvr32.exe File created C:\Windows\rescache\_merged\4183903823\97717462.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri taskmgr.exe File created C:\Windows\rescache\_merged\4183903823\97717462.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exetaskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 3676 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
regsvr32.exepid process 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe 1956 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
taskmgr.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 3472 taskmgr.exe Token: SeSystemProfilePrivilege 3472 taskmgr.exe Token: SeCreateGlobalPrivilege 3472 taskmgr.exe Token: 33 3472 taskmgr.exe Token: SeIncBasePriorityPrivilege 3472 taskmgr.exe Token: SeDebugPrivilege 2160 taskmgr.exe Token: SeSystemProfilePrivilege 2160 taskmgr.exe Token: SeCreateGlobalPrivilege 2160 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exetaskmgr.exepid process 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exetaskmgr.exepid process 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 3472 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe 2160 taskmgr.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
regsvr32.exedescription pid process target process PID 3772 wrote to memory of 1956 3772 regsvr32.exe regsvr32.exe PID 3772 wrote to memory of 1956 3772 regsvr32.exe regsvr32.exe PID 3772 wrote to memory of 1956 3772 regsvr32.exe regsvr32.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2f76c2801b2bac498e94d68e99117c5367af97e0.dll1⤵
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\2f76c2801b2bac498e94d68e99117c5367af97e0.dll2⤵
- Modifies extensions of user files
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
PID:1956
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3472
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2160
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\readme.txt1⤵
- Opens file in notepad (likely ransom note)
PID:3676
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
050f862ebe4280881ec261b7de17a5eb
SHA1f88837dcc7727abd92298f2868a4e603e36dd4ae
SHA2565a9ee4039e88417093c55cfb4c7b7aea8c5f09695a111fd1c2a78b170536afb4
SHA512b77852e2179808744c1d0234d93f6a11dc7c1b74f2f2951af6b21bce10a0fba95b643af159c64ab3168074855cd26aa30aa625a8363f69b1dd98ca49c90b14b3
-
MD5
b6001b9e5fc5c3d537375f572212762b
SHA1f03b0351d2730994e847d9afcf118395c331e400
SHA2560ee6fb6ae927f06a3f74721d0a2be1d7b2158e171e9d32b68747121054e7f910
SHA512918db362fd4f49d8720c34299dcc1f119bc7a0981f48d9939fcad29e14c58262daab23a131cd386437587bf8084a1dce43a58218dec757074e0004794db1129b
-
MD5
88bdb9eca36eab3488a6b2d0d438649a
SHA1b3d2cf9f51684391fa7e588d3c57b717fcde3b58
SHA2560f0a21dc72dac030b89d30ec2f2d078efac053e5b2ecaab4be843d35a0721121
SHA5128bcaab91cef1c4a1135a27a32f55b34c2d2d16dad483f1a8ca02f51ee50f739d4335bdaa5ccc64f247926f33b715092672bfa1d346192775d2c5964afa7f7e87