Analysis
-
max time kernel
151s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 17:00
Static task
static1
Behavioral task
behavioral1
Sample
f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe
Resource
win10v2004-20221111-en
General
-
Target
f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe
-
Size
140KB
-
MD5
e25b989b80f9ec7344754fe47828f8d3
-
SHA1
134653a26c79ec48c2ccfa1c9bb855e4fdb1cd25
-
SHA256
f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0
-
SHA512
ebd662b8dc895a15708c2af4148bef8baf9a971ee9a07cbe8a9195a8381955946825d2a5574c47ded991998c766f8c350f1057501266e77bf637b2bce41711e1
-
SSDEEP
1536:yOyiGUJJXGPteKPNA3aBn+ryflYTbHyHvbnMJ4LIfN+AzaNPPRu+RsA:yOOUnf6n+ryfuTbSP7MJ4mPzaZ/RsA
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
msiexec.exesvchost.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list msiexec.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\list\C:\Windows\SysWOW64\msiexec.exe = "C:\\Windows\\SysWOW64\\msiexec.exe:*:Generic Host Process" msiexec.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list svchost.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\list\C:\Windows\SysWOW64\svchost.exe = "C:\\Windows\\SysWOW64\\svchost.exe:*:Generic Host Process" svchost.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
msiexec.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\10717 = "c:\\progra~3\\dxvvltyg.exe" msiexec.exe -
Executes dropped EXE 2 IoCs
Processes:
dxvvltyg.exedxvvltyg.exepid process 240 dxvvltyg.exe 1928 dxvvltyg.exe -
Deletes itself 1 IoCs
Processes:
msiexec.exepid process 1692 msiexec.exe -
Loads dropped DLL 2 IoCs
Processes:
msiexec.exedxvvltyg.exepid process 1692 msiexec.exe 240 dxvvltyg.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exedxvvltyg.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum dxvvltyg.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 dxvvltyg.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exedxvvltyg.exedescription pid process target process PID 1612 set thread context of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 240 set thread context of 1928 240 dxvvltyg.exe dxvvltyg.exe -
Drops file in Program Files directory 1 IoCs
Processes:
msiexec.exedescription ioc process File created \??\c:\progra~3\dxvvltyg.exe msiexec.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exef3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exedxvvltyg.exedxvvltyg.exepid process 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe 1620 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe 240 dxvvltyg.exe 240 dxvvltyg.exe 1928 dxvvltyg.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exedxvvltyg.exepid process 1620 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe 1620 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe 1928 dxvvltyg.exe 1928 dxvvltyg.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exedescription pid process Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: 33 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe Token: SeIncBasePriorityPrivilege 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exef3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exemsiexec.exedxvvltyg.exedxvvltyg.exedescription pid process target process PID 1612 wrote to memory of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 1612 wrote to memory of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 1612 wrote to memory of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 1612 wrote to memory of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 1612 wrote to memory of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 1612 wrote to memory of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 1612 wrote to memory of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 1612 wrote to memory of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 1612 wrote to memory of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 1612 wrote to memory of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 1612 wrote to memory of 1620 1612 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe PID 1620 wrote to memory of 1692 1620 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe msiexec.exe PID 1620 wrote to memory of 1692 1620 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe msiexec.exe PID 1620 wrote to memory of 1692 1620 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe msiexec.exe PID 1620 wrote to memory of 1692 1620 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe msiexec.exe PID 1620 wrote to memory of 1692 1620 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe msiexec.exe PID 1620 wrote to memory of 1692 1620 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe msiexec.exe PID 1620 wrote to memory of 1692 1620 f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe msiexec.exe PID 1692 wrote to memory of 240 1692 msiexec.exe dxvvltyg.exe PID 1692 wrote to memory of 240 1692 msiexec.exe dxvvltyg.exe PID 1692 wrote to memory of 240 1692 msiexec.exe dxvvltyg.exe PID 1692 wrote to memory of 240 1692 msiexec.exe dxvvltyg.exe PID 1692 wrote to memory of 240 1692 msiexec.exe dxvvltyg.exe PID 1692 wrote to memory of 240 1692 msiexec.exe dxvvltyg.exe PID 1692 wrote to memory of 240 1692 msiexec.exe dxvvltyg.exe PID 240 wrote to memory of 1928 240 dxvvltyg.exe dxvvltyg.exe PID 240 wrote to memory of 1928 240 dxvvltyg.exe dxvvltyg.exe PID 240 wrote to memory of 1928 240 dxvvltyg.exe dxvvltyg.exe PID 240 wrote to memory of 1928 240 dxvvltyg.exe dxvvltyg.exe PID 240 wrote to memory of 1928 240 dxvvltyg.exe dxvvltyg.exe PID 240 wrote to memory of 1928 240 dxvvltyg.exe dxvvltyg.exe PID 240 wrote to memory of 1928 240 dxvvltyg.exe dxvvltyg.exe PID 240 wrote to memory of 1928 240 dxvvltyg.exe dxvvltyg.exe PID 240 wrote to memory of 1928 240 dxvvltyg.exe dxvvltyg.exe PID 240 wrote to memory of 1928 240 dxvvltyg.exe dxvvltyg.exe PID 240 wrote to memory of 1928 240 dxvvltyg.exe dxvvltyg.exe PID 1928 wrote to memory of 1112 1928 dxvvltyg.exe svchost.exe PID 1928 wrote to memory of 1112 1928 dxvvltyg.exe svchost.exe PID 1928 wrote to memory of 1112 1928 dxvvltyg.exe svchost.exe PID 1928 wrote to memory of 1112 1928 dxvvltyg.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe"C:\Users\Admin\AppData\Local\Temp\f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe"C:\Users\Admin\AppData\Local\Temp\f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0.exe"2⤵
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\msiexec.exeC:\Windows\SysWOW64\msiexec.exe3⤵
- Modifies firewall policy service
- Adds policy Run key to start application
- Deletes itself
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
-
\??\c:\progra~3\dxvvltyg.exec:\progra~3\dxvvltyg.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
\??\c:\progra~3\dxvvltyg.exec:\progra~3\dxvvltyg.exe5⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe6⤵
- Modifies firewall policy service
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\PROGRA~3\dxvvltyg.exeFilesize
140KB
MD5e25b989b80f9ec7344754fe47828f8d3
SHA1134653a26c79ec48c2ccfa1c9bb855e4fdb1cd25
SHA256f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0
SHA512ebd662b8dc895a15708c2af4148bef8baf9a971ee9a07cbe8a9195a8381955946825d2a5574c47ded991998c766f8c350f1057501266e77bf637b2bce41711e1
-
C:\PROGRA~3\dxvvltyg.exeFilesize
140KB
MD5e25b989b80f9ec7344754fe47828f8d3
SHA1134653a26c79ec48c2ccfa1c9bb855e4fdb1cd25
SHA256f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0
SHA512ebd662b8dc895a15708c2af4148bef8baf9a971ee9a07cbe8a9195a8381955946825d2a5574c47ded991998c766f8c350f1057501266e77bf637b2bce41711e1
-
\??\c:\progra~3\dxvvltyg.exeFilesize
140KB
MD5e25b989b80f9ec7344754fe47828f8d3
SHA1134653a26c79ec48c2ccfa1c9bb855e4fdb1cd25
SHA256f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0
SHA512ebd662b8dc895a15708c2af4148bef8baf9a971ee9a07cbe8a9195a8381955946825d2a5574c47ded991998c766f8c350f1057501266e77bf637b2bce41711e1
-
\PROGRA~3\dxvvltyg.exeFilesize
140KB
MD5e25b989b80f9ec7344754fe47828f8d3
SHA1134653a26c79ec48c2ccfa1c9bb855e4fdb1cd25
SHA256f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0
SHA512ebd662b8dc895a15708c2af4148bef8baf9a971ee9a07cbe8a9195a8381955946825d2a5574c47ded991998c766f8c350f1057501266e77bf637b2bce41711e1
-
\PROGRA~3\dxvvltyg.exeFilesize
140KB
MD5e25b989b80f9ec7344754fe47828f8d3
SHA1134653a26c79ec48c2ccfa1c9bb855e4fdb1cd25
SHA256f3cc94edcd84798f7fe8299311afaa9f5801ea241183125aa74e17e6dbd698f0
SHA512ebd662b8dc895a15708c2af4148bef8baf9a971ee9a07cbe8a9195a8381955946825d2a5574c47ded991998c766f8c350f1057501266e77bf637b2bce41711e1
-
memory/240-71-0x0000000000000000-mapping.dmp
-
memory/1112-85-0x0000000000000000-mapping.dmp
-
memory/1112-89-0x000000007EFA0000-0x000000007EFA6000-memory.dmpFilesize
24KB
-
memory/1112-87-0x000000007EFA0000-0x000000007EFA6000-memory.dmpFilesize
24KB
-
memory/1112-86-0x0000000000870000-0x0000000000878000-memory.dmpFilesize
32KB
-
memory/1612-54-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1612-61-0x0000000000240000-0x0000000000246000-memory.dmpFilesize
24KB
-
memory/1620-60-0x0000000000401B0E-mapping.dmp
-
memory/1620-64-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1620-63-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1620-59-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1620-58-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1620-56-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1620-55-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1692-69-0x000000007EFA0000-0x000000007EFA6000-memory.dmpFilesize
24KB
-
memory/1692-68-0x0000000000090000-0x0000000000097000-memory.dmpFilesize
28KB
-
memory/1692-67-0x0000000000590000-0x00000000005A4000-memory.dmpFilesize
80KB
-
memory/1692-88-0x000000007EFA0000-0x000000007EFA6000-memory.dmpFilesize
24KB
-
memory/1692-65-0x0000000000000000-mapping.dmp
-
memory/1928-81-0x0000000000401B0E-mapping.dmp