Analysis
-
max time kernel
103s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 16:40
Static task
static1
Behavioral task
behavioral1
Sample
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe
Resource
win7-20220715-en
General
-
Target
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe
-
Size
741KB
-
MD5
7563f26bececeda03204733e06cc06c3
-
SHA1
54e5f16147df489a2f1fd7a02cc496a5c334697c
-
SHA256
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019
-
SHA512
bf42b6ce06b5d1ad7ced233e838a264fb1d31914627b294a036d6d9346e76fd48d34dbf03e562c9b951d772e806e94c62dbef4743313fa226eddbc316f8ece7b
Malware Config
Signatures
-
NirSoft MailPassView 11 IoCs
Password recovery tool for various email clients
Processes:
resource yara_rule behavioral1/memory/1676-62-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/1676-65-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/1676-67-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/1676-69-0x0000000000480BAE-mapping.dmp MailPassView behavioral1/memory/1676-71-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/1676-73-0x0000000000400000-0x0000000000488000-memory.dmp MailPassView behavioral1/memory/1964-78-0x0000000000411654-mapping.dmp MailPassView behavioral1/memory/1964-77-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1964-82-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1964-83-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView behavioral1/memory/1964-85-0x0000000000400000-0x000000000041B000-memory.dmp MailPassView -
NirSoft WebBrowserPassView 11 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/1676-62-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/1676-65-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/1676-67-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/1676-69-0x0000000000480BAE-mapping.dmp WebBrowserPassView behavioral1/memory/1676-71-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/1676-73-0x0000000000400000-0x0000000000488000-memory.dmp WebBrowserPassView behavioral1/memory/1468-86-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1468-87-0x0000000000442628-mapping.dmp WebBrowserPassView behavioral1/memory/1468-90-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1468-91-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView behavioral1/memory/1468-93-0x0000000000400000-0x0000000000458000-memory.dmp WebBrowserPassView -
Nirsoft 16 IoCs
Processes:
resource yara_rule behavioral1/memory/1676-62-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/1676-65-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/1676-67-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/1676-69-0x0000000000480BAE-mapping.dmp Nirsoft behavioral1/memory/1676-71-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/1676-73-0x0000000000400000-0x0000000000488000-memory.dmp Nirsoft behavioral1/memory/1964-78-0x0000000000411654-mapping.dmp Nirsoft behavioral1/memory/1964-77-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1964-82-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1964-83-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1964-85-0x0000000000400000-0x000000000041B000-memory.dmp Nirsoft behavioral1/memory/1468-86-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1468-87-0x0000000000442628-mapping.dmp Nirsoft behavioral1/memory/1468-90-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1468-91-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft behavioral1/memory/1468-93-0x0000000000400000-0x0000000000458000-memory.dmp Nirsoft -
Uses the VBS compiler for execution 1 TTPs
-
Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts vbc.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 7 whatismyipaddress.com 9 whatismyipaddress.com 10 whatismyipaddress.com -
Suspicious use of SetThreadContext 3 IoCs
Processes:
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exeRegAsm.exedescription pid process target process PID 2000 set thread context of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 1676 set thread context of 1964 1676 RegAsm.exe vbc.exe PID 1676 set thread context of 1468 1676 RegAsm.exe vbc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegAsm.exepid process 1676 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegAsm.exedescription pid process Token: SeDebugPrivilege 1676 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegAsm.exepid process 1676 RegAsm.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exeRegAsm.exedescription pid process target process PID 2000 wrote to memory of 1448 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe schtasks.exe PID 2000 wrote to memory of 1448 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe schtasks.exe PID 2000 wrote to memory of 1448 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe schtasks.exe PID 2000 wrote to memory of 1448 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe schtasks.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 2000 wrote to memory of 1676 2000 55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe RegAsm.exe PID 1676 wrote to memory of 1964 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1964 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1964 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1964 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1964 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1964 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1964 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1964 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1964 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1964 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1468 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1468 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1468 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1468 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1468 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1468 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1468 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1468 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1468 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 1468 1676 RegAsm.exe vbc.exe PID 1676 wrote to memory of 2020 1676 RegAsm.exe dw20.exe PID 1676 wrote to memory of 2020 1676 RegAsm.exe dw20.exe PID 1676 wrote to memory of 2020 1676 RegAsm.exe dw20.exe PID 1676 wrote to memory of 2020 1676 RegAsm.exe dw20.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe"C:\Users\Admin\AppData\Local\Temp\55397598501af363b49f8ebb09b5328357ea4bb1522ae5fa26384ddecae58019.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Update\VDFFSHBXCTFGHDNMBGKZXDDXNVMNCCXBGBNXJNCJM" /XML "C:\Users\Admin\AppData\Local\Temp\z992"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"3⤵
- Accesses Microsoft Outlook accounts
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"3⤵
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 14603⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\holderwb.txtFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\AppData\Local\Temp\z992Filesize
1KB
MD53bbda79b1b4d2f1e6fe83ba6e8e26423
SHA1e74da275d666a6f9eb3515242708a6b2e8531d12
SHA25616ece94161074da6f58f253f7a89d90e455dc4e2e5721b29649e3666c8df3f64
SHA51204b98286361691a7f7f00f9753cd46eaa0412a58f0b59f9d22b6cf102a05f105f91272767220eda399a786b0f6b8c757a74ad4441b21f75a88db60efdf9711c3
-
memory/1448-57-0x0000000000000000-mapping.dmp
-
memory/1468-86-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1468-93-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1468-91-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1468-90-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1468-87-0x0000000000442628-mapping.dmp
-
memory/1676-76-0x0000000074D60000-0x000000007530B000-memory.dmpFilesize
5.7MB
-
memory/1676-84-0x0000000074D60000-0x000000007530B000-memory.dmpFilesize
5.7MB
-
memory/1676-69-0x0000000000480BAE-mapping.dmp
-
memory/1676-71-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1676-73-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1676-94-0x0000000000B76000-0x0000000000B87000-memory.dmpFilesize
68KB
-
memory/1676-59-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1676-60-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1676-62-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1676-65-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1676-81-0x0000000000B76000-0x0000000000B87000-memory.dmpFilesize
68KB
-
memory/1676-67-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1964-83-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1964-85-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1964-82-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1964-77-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1964-78-0x0000000000411654-mapping.dmp
-
memory/2000-54-0x0000000075791000-0x0000000075793000-memory.dmpFilesize
8KB
-
memory/2000-56-0x0000000074E00000-0x00000000753AB000-memory.dmpFilesize
5.7MB
-
memory/2000-55-0x0000000074E00000-0x00000000753AB000-memory.dmpFilesize
5.7MB
-
memory/2000-74-0x0000000074E00000-0x00000000753AB000-memory.dmpFilesize
5.7MB
-
memory/2020-95-0x0000000000000000-mapping.dmp