Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01-04-2023 01:36
Static task
static1
Behavioral task
behavioral1
Sample
affb629af9de8ff0c78c3feaf7b81108.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
affb629af9de8ff0c78c3feaf7b81108.exe
Resource
win10v2004-20230220-en
General
-
Target
affb629af9de8ff0c78c3feaf7b81108.exe
-
Size
270KB
-
MD5
affb629af9de8ff0c78c3feaf7b81108
-
SHA1
a84cabf3aa2b6542e57a101f94f8ea0ea548a91b
-
SHA256
aca2368fa225fda4ea1d223ac914bf42ee81884dbe97536b832fb3706ca6ac1f
-
SHA512
f690f355b7e1e50ab82502009b98d054d5938fc9ff06918cf868ae3f10308a89b101b987655f9ed83dace43dd790d93d4792ac3a0fbac61614822c07d6f9b0a8
-
SSDEEP
3072:8cgSq3amsUo24elcTlq1Scfubj8X6MlC5MX6Gw+TDqYI:XqK5J2ONf8XVlC5MT
Malware Config
Extracted
smokeloader
sprg
Extracted
smokeloader
2022
http://hoh0aeghwugh2gie.com/
http://hie7doodohpae4na.com/
http://aek0aicifaloh1yo.com/
http://yic0oosaeiy7ahng.com/
http://wa5zu7sekai8xeih.com/
Extracted
redline
vip
176.123.9.142:14845
-
auth_value
04988fae39606b9c65a0cc86dfa46c41
Extracted
aurora
94.142.138.30:8081
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\p2p.dll acprotect C:\Users\Admin\AppData\Local\Temp\p2p.dll acprotect -
Executes dropped EXE 3 IoCs
Processes:
3C9.exe3113.exe4855.exepid process 2216 3C9.exe 836 3113.exe 4732 4855.exe -
Loads dropped DLL 1 IoCs
Processes:
3113.exepid process 836 3113.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
3113.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Audio WiMAX Service 0.6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3113.exe\"" 3113.exe Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Audio WiMAX Service 0.6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3113.exe\"" 3113.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
4855.exepid process 4732 4855.exe 4732 4855.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
3C9.exeAppLaunch.exedescription pid process target process PID 2216 set thread context of 4892 2216 3C9.exe AppLaunch.exe PID 4892 set thread context of 3744 4892 AppLaunch.exe AppLaunch.exe -
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4608 2216 WerFault.exe 3C9.exe 1792 4892 WerFault.exe AppLaunch.exe 4080 4892 WerFault.exe AppLaunch.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
affb629af9de8ff0c78c3feaf7b81108.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI affb629af9de8ff0c78c3feaf7b81108.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI affb629af9de8ff0c78c3feaf7b81108.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI affb629af9de8ff0c78c3feaf7b81108.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
affb629af9de8ff0c78c3feaf7b81108.exepid process 1880 affb629af9de8ff0c78c3feaf7b81108.exe 1880 affb629af9de8ff0c78c3feaf7b81108.exe 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 772 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
affb629af9de8ff0c78c3feaf7b81108.exepid process 1880 affb629af9de8ff0c78c3feaf7b81108.exe 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 772 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AppLaunch.exe3113.exeWMIC.exedescription pid process Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeDebugPrivilege 3744 AppLaunch.exe Token: SeDebugPrivilege 836 3113.exe Token: 33 836 3113.exe Token: SeIncBasePriorityPrivilege 836 3113.exe Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeShutdownPrivilege 772 Token: SeCreatePagefilePrivilege 772 Token: SeIncreaseQuotaPrivilege 4280 WMIC.exe Token: SeSecurityPrivilege 4280 WMIC.exe Token: SeTakeOwnershipPrivilege 4280 WMIC.exe Token: SeLoadDriverPrivilege 4280 WMIC.exe Token: SeSystemProfilePrivilege 4280 WMIC.exe Token: SeSystemtimePrivilege 4280 WMIC.exe Token: SeProfSingleProcessPrivilege 4280 WMIC.exe Token: SeIncBasePriorityPrivilege 4280 WMIC.exe Token: SeCreatePagefilePrivilege 4280 WMIC.exe Token: SeBackupPrivilege 4280 WMIC.exe Token: SeRestorePrivilege 4280 WMIC.exe Token: SeShutdownPrivilege 4280 WMIC.exe Token: SeDebugPrivilege 4280 WMIC.exe Token: SeSystemEnvironmentPrivilege 4280 WMIC.exe Token: SeRemoteShutdownPrivilege 4280 WMIC.exe Token: SeUndockPrivilege 4280 WMIC.exe Token: SeManageVolumePrivilege 4280 WMIC.exe Token: 33 4280 WMIC.exe Token: 34 4280 WMIC.exe Token: 35 4280 WMIC.exe Token: 36 4280 WMIC.exe Token: SeIncreaseQuotaPrivilege 4280 WMIC.exe Token: SeSecurityPrivilege 4280 WMIC.exe Token: SeTakeOwnershipPrivilege 4280 WMIC.exe Token: SeLoadDriverPrivilege 4280 WMIC.exe Token: SeSystemProfilePrivilege 4280 WMIC.exe Token: SeSystemtimePrivilege 4280 WMIC.exe Token: SeProfSingleProcessPrivilege 4280 WMIC.exe Token: SeIncBasePriorityPrivilege 4280 WMIC.exe Token: SeCreatePagefilePrivilege 4280 WMIC.exe Token: SeBackupPrivilege 4280 WMIC.exe Token: SeRestorePrivilege 4280 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
3C9.exeAppLaunch.exe4855.execmd.execmd.execmd.execmd.exedescription pid process target process PID 772 wrote to memory of 2216 772 3C9.exe PID 772 wrote to memory of 2216 772 3C9.exe PID 772 wrote to memory of 2216 772 3C9.exe PID 2216 wrote to memory of 532 2216 3C9.exe AppLaunch.exe PID 2216 wrote to memory of 532 2216 3C9.exe AppLaunch.exe PID 2216 wrote to memory of 532 2216 3C9.exe AppLaunch.exe PID 2216 wrote to memory of 4892 2216 3C9.exe AppLaunch.exe PID 2216 wrote to memory of 4892 2216 3C9.exe AppLaunch.exe PID 2216 wrote to memory of 4892 2216 3C9.exe AppLaunch.exe PID 2216 wrote to memory of 4892 2216 3C9.exe AppLaunch.exe PID 2216 wrote to memory of 4892 2216 3C9.exe AppLaunch.exe PID 4892 wrote to memory of 3744 4892 AppLaunch.exe AppLaunch.exe PID 4892 wrote to memory of 3744 4892 AppLaunch.exe AppLaunch.exe PID 4892 wrote to memory of 3744 4892 AppLaunch.exe AppLaunch.exe PID 4892 wrote to memory of 3744 4892 AppLaunch.exe AppLaunch.exe PID 4892 wrote to memory of 3744 4892 AppLaunch.exe AppLaunch.exe PID 772 wrote to memory of 836 772 3113.exe PID 772 wrote to memory of 836 772 3113.exe PID 772 wrote to memory of 836 772 3113.exe PID 772 wrote to memory of 4732 772 4855.exe PID 772 wrote to memory of 4732 772 4855.exe PID 772 wrote to memory of 636 772 explorer.exe PID 772 wrote to memory of 636 772 explorer.exe PID 772 wrote to memory of 636 772 explorer.exe PID 772 wrote to memory of 636 772 explorer.exe PID 772 wrote to memory of 4752 772 explorer.exe PID 772 wrote to memory of 4752 772 explorer.exe PID 772 wrote to memory of 4752 772 explorer.exe PID 772 wrote to memory of 4028 772 explorer.exe PID 772 wrote to memory of 4028 772 explorer.exe PID 772 wrote to memory of 4028 772 explorer.exe PID 772 wrote to memory of 4028 772 explorer.exe PID 772 wrote to memory of 1436 772 explorer.exe PID 772 wrote to memory of 1436 772 explorer.exe PID 772 wrote to memory of 1436 772 explorer.exe PID 4732 wrote to memory of 3460 4732 4855.exe cmd.exe PID 4732 wrote to memory of 3460 4732 4855.exe cmd.exe PID 3460 wrote to memory of 4280 3460 cmd.exe WMIC.exe PID 3460 wrote to memory of 4280 3460 cmd.exe WMIC.exe PID 4732 wrote to memory of 3204 4732 4855.exe wmic.exe PID 4732 wrote to memory of 3204 4732 4855.exe wmic.exe PID 772 wrote to memory of 3820 772 explorer.exe PID 772 wrote to memory of 3820 772 explorer.exe PID 772 wrote to memory of 3820 772 explorer.exe PID 772 wrote to memory of 3820 772 explorer.exe PID 4732 wrote to memory of 1184 4732 4855.exe cmd.exe PID 4732 wrote to memory of 1184 4732 4855.exe cmd.exe PID 1184 wrote to memory of 4540 1184 cmd.exe WMIC.exe PID 1184 wrote to memory of 4540 1184 cmd.exe WMIC.exe PID 4732 wrote to memory of 4404 4732 4855.exe cmd.exe PID 4732 wrote to memory of 4404 4732 4855.exe cmd.exe PID 4404 wrote to memory of 3320 4404 cmd.exe WMIC.exe PID 4404 wrote to memory of 3320 4404 cmd.exe WMIC.exe PID 772 wrote to memory of 4388 772 explorer.exe PID 772 wrote to memory of 4388 772 explorer.exe PID 772 wrote to memory of 4388 772 explorer.exe PID 772 wrote to memory of 4388 772 explorer.exe PID 4732 wrote to memory of 1500 4732 4855.exe cmd.exe PID 4732 wrote to memory of 1500 4732 4855.exe cmd.exe PID 1500 wrote to memory of 3472 1500 cmd.exe systeminfo.exe PID 1500 wrote to memory of 3472 1500 cmd.exe systeminfo.exe PID 772 wrote to memory of 3180 772 explorer.exe PID 772 wrote to memory of 3180 772 explorer.exe PID 772 wrote to memory of 3180 772 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\affb629af9de8ff0c78c3feaf7b81108.exe"C:\Users\Admin\AppData\Local\Temp\affb629af9de8ff0c78c3feaf7b81108.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1880
-
C:\Users\Admin\AppData\Local\Temp\3C9.exeC:\Users\Admin\AppData\Local\Temp\3C9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵PID:532
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3744 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 1483⤵
- Program crash
PID:1792 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4892 -s 4883⤵
- Program crash
PID:4080 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2216 -s 5122⤵
- Program crash
PID:4608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2216 -ip 22161⤵PID:908
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4892 -ip 48921⤵PID:4812
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4892 -ip 48921⤵PID:3696
-
C:\Users\Admin\AppData\Local\Temp\3113.exeC:\Users\Admin\AppData\Local\Temp\3113.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:836
-
C:\Users\Admin\AppData\Local\Temp\4855.exeC:\Users\Admin\AppData\Local\Temp\4855.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Windows\system32\cmd.execmd.exe /c "wmic csproduct get uuid"2⤵
- Suspicious use of WriteProcessMemory
PID:3460 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4280 -
C:\Windows\System32\Wbem\wmic.exewmic os get Caption2⤵PID:3204
-
C:\Windows\system32\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵PID:4540
-
C:\Windows\system32\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Windows\System32\Wbem\WMIC.exewmic cpu get name3⤵PID:3320
-
C:\Windows\system32\cmd.execmd "/c " systeminfo2⤵
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3472 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History\" \"C:\Users\Admin\AppData\Local\Temp\XVlBzgbaiC\""2⤵PID:3728
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHctcuAx\""2⤵PID:3416
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\hxKQFDaFpL\""2⤵PID:4924
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFfRsWxP\""2⤵PID:4844
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\LDnJObCsNV\""2⤵PID:5028
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\lgTeMaPEZQleQYh\""2⤵PID:3088
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\YzRyWJjPjz\""2⤵PID:4348
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\pfRFEgmotaFetHs\""2⤵PID:3748
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\bZRjxAwnwe\""2⤵PID:2668
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\krBEmfdzdcEkXBA\""2⤵PID:2080
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History\" \"C:\Users\Admin\AppData\Local\Temp\kjQZLCtTMt\""2⤵PID:1308
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\TCoaNatyyiNKARe\""2⤵PID:4280
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\KJyiXJrscc\""2⤵PID:1028
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\tNswYNsGRussVma\""2⤵PID:3224
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\ozFZBsbOJi\""2⤵PID:4692
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\FQGZsnwTKSmVoiG\""2⤵PID:1676
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\LOpbUOpEdK\""2⤵PID:2156
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\updOMeRVjaRzLNT\""2⤵PID:4916
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Windows\History\" \"C:\Users\Admin\AppData\Local\Temp\XYeUCWKsXb\""2⤵PID:3660
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:636
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4752
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4028
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1436
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3820
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4388
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:3180
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3476
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4912
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD56cf293cb4d80be23433eecf74ddb5503
SHA124fe4752df102c2ef492954d6b046cb5512ad408
SHA256b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
SHA5120f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
-
Filesize
64B
MD5235a8eb126d835efb2e253459ab8b089
SHA1293fbf68e6726a5a230c3a42624c01899e35a89f
SHA2565ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686
SHA512a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
64B
MD5446dd1cf97eaba21cf14d03aebc79f27
SHA136e4cc7367e0c7b40f4a8ace272941ea46373799
SHA256a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
SHA512a6d754709f30b122112ae30e5ab22486393c5021d33da4d1304c061863d2e1e79e8aeb029cae61261bb77d0e7becd53a7b0106d6ea4368b4c302464e3d941cf7
-
Filesize
380KB
MD581fad35a0649e5c3806853449fd84e5a
SHA1fae6c1e654fd1e4e1785ed2965708f75f86905c3
SHA2560f5d2216ad474ad8ff99bdc852df66c1b084282262ed6f546f0eaffa17e1cd22
SHA5129f063d513e96db04b6f9b243d6abf831bd828c0e340a1b14491b8f2b185cf77d783d244b30b6b8fc916cb47572a38696b70cf73b882daa1add97aa706beff7bf
-
Filesize
380KB
MD581fad35a0649e5c3806853449fd84e5a
SHA1fae6c1e654fd1e4e1785ed2965708f75f86905c3
SHA2560f5d2216ad474ad8ff99bdc852df66c1b084282262ed6f546f0eaffa17e1cd22
SHA5129f063d513e96db04b6f9b243d6abf831bd828c0e340a1b14491b8f2b185cf77d783d244b30b6b8fc916cb47572a38696b70cf73b882daa1add97aa706beff7bf
-
Filesize
576KB
MD547e77a325cc1285b6a287c35750fa829
SHA1c486c319b45ce9d49fa061e36a2db28010a8eb1e
SHA256562647893899dd3a4e5ea433086c45665737a1fc1d55c49fee5ad9c18a0e39ab
SHA512f3c40ba7e37fc099d5afc551d179ac4740be778ba1f6327209d2cf817ea151cd53e23f3ef62fee549dfee9c2f834efdc0bb9914621b027464cbaa588353deed0
-
Filesize
576KB
MD547e77a325cc1285b6a287c35750fa829
SHA1c486c319b45ce9d49fa061e36a2db28010a8eb1e
SHA256562647893899dd3a4e5ea433086c45665737a1fc1d55c49fee5ad9c18a0e39ab
SHA512f3c40ba7e37fc099d5afc551d179ac4740be778ba1f6327209d2cf817ea151cd53e23f3ef62fee549dfee9c2f834efdc0bb9914621b027464cbaa588353deed0
-
Filesize
7.2MB
MD5070ac907c70dae8f05fd7b864fb442f7
SHA146455f37215389c5a63275f94a1286fe45a08b0b
SHA25602b90f5cf492d89bf7179629aba019af45dfdbd849d218e598511127b33a2990
SHA512e34358369c6850c76166b5b9ef6c6d2bc70ffacf33480dce8bf4804308dd23d885b42e88167e3e05996323d3528eda53f0fbf9a8f1ef6b4e23cb4fe5b551261b
-
Filesize
7.2MB
MD5070ac907c70dae8f05fd7b864fb442f7
SHA146455f37215389c5a63275f94a1286fe45a08b0b
SHA25602b90f5cf492d89bf7179629aba019af45dfdbd849d218e598511127b33a2990
SHA512e34358369c6850c76166b5b9ef6c6d2bc70ffacf33480dce8bf4804308dd23d885b42e88167e3e05996323d3528eda53f0fbf9a8f1ef6b4e23cb4fe5b551261b
-
Filesize
2KB
MD5dd7a4110e2dc0760efdd47ee918c0deb
SHA15ed5efe128e521023e0caf4fff9af747522c8166
SHA256550ad8794d9ec26bc7e09225cb1cbe648ee7c1c2349aabec8172f08bdec26084
SHA512c928725e5f010d371727aadcc057da91378a0b24c66b2848217e9186dd319b6bf09c0859d7bf523ff1736fc41591eb25662a900fbe3977b63132a0c40dcd35dc
-
Filesize
48KB
MD5349e6eb110e34a08924d92f6b334801d
SHA1bdfb289daff51890cc71697b6322aa4b35ec9169
SHA256c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a
SHA5122a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574
-
Filesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
Filesize
2KB
MD5dd7a4110e2dc0760efdd47ee918c0deb
SHA15ed5efe128e521023e0caf4fff9af747522c8166
SHA256550ad8794d9ec26bc7e09225cb1cbe648ee7c1c2349aabec8172f08bdec26084
SHA512c928725e5f010d371727aadcc057da91378a0b24c66b2848217e9186dd319b6bf09c0859d7bf523ff1736fc41591eb25662a900fbe3977b63132a0c40dcd35dc
-
Filesize
71KB
MD5dc2b0f48d8f547d5ff7d67b371d850f0
SHA184d02ddbf478bf7cfe9ccb466362860ee18b3839
SHA2560434c46910f48821a0a442b510260a3faea9404d7e6a8edd2cf44cc7dfea3890
SHA5123470ae3db7053a7e606a221f97f8cadf58500a746daaa4c763d714fe99df026d1c7858aaaf6d34ec1bbaa5305f8eead00101b6a7ac6f4d457425d04bcf92e8d7
-
Filesize
71KB
MD5dc2b0f48d8f547d5ff7d67b371d850f0
SHA184d02ddbf478bf7cfe9ccb466362860ee18b3839
SHA2560434c46910f48821a0a442b510260a3faea9404d7e6a8edd2cf44cc7dfea3890
SHA5123470ae3db7053a7e606a221f97f8cadf58500a746daaa4c763d714fe99df026d1c7858aaaf6d34ec1bbaa5305f8eead00101b6a7ac6f4d457425d04bcf92e8d7
-
Filesize
2KB
MD5dd7a4110e2dc0760efdd47ee918c0deb
SHA15ed5efe128e521023e0caf4fff9af747522c8166
SHA256550ad8794d9ec26bc7e09225cb1cbe648ee7c1c2349aabec8172f08bdec26084
SHA512c928725e5f010d371727aadcc057da91378a0b24c66b2848217e9186dd319b6bf09c0859d7bf523ff1736fc41591eb25662a900fbe3977b63132a0c40dcd35dc
-
Filesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
Filesize
92KB
MD54b609cebb20f08b79628408f4fa2ad42
SHA1f725278c8bc0527c316e01827f195de5c9a8f934
SHA2562802818c570f9da1ce2e2fe2ff12cd3190b4c287866a3e4dfe2ad3a7df4cecdf
SHA51219111811722223521c8ef801290e2d5d8a49c0800363b9cf4232ca037dbcc515aa16ba6c043193f81388260db0e9a7cdb31b0da8c7ffa5bcad67ddbd842e2c60
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
71KB
MD5dc2b0f48d8f547d5ff7d67b371d850f0
SHA184d02ddbf478bf7cfe9ccb466362860ee18b3839
SHA2560434c46910f48821a0a442b510260a3faea9404d7e6a8edd2cf44cc7dfea3890
SHA5123470ae3db7053a7e606a221f97f8cadf58500a746daaa4c763d714fe99df026d1c7858aaaf6d34ec1bbaa5305f8eead00101b6a7ac6f4d457425d04bcf92e8d7
-
Filesize
71KB
MD5dc2b0f48d8f547d5ff7d67b371d850f0
SHA184d02ddbf478bf7cfe9ccb466362860ee18b3839
SHA2560434c46910f48821a0a442b510260a3faea9404d7e6a8edd2cf44cc7dfea3890
SHA5123470ae3db7053a7e606a221f97f8cadf58500a746daaa4c763d714fe99df026d1c7858aaaf6d34ec1bbaa5305f8eead00101b6a7ac6f4d457425d04bcf92e8d7
-
Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
Filesize
124KB
MD59618e15b04a4ddb39ed6c496575f6f95
SHA11c28f8750e5555776b3c80b187c5d15a443a7412
SHA256a4cd72e529e60b5f74c50e4e5b159efaf80625f23534dd15a28203760b8b28ab
SHA512f802582aa7510f6b950e3343b0560ffa9037c6d22373a6a33513637ab0f8e60ed23294a13ad8890935b02c64830b5232ba9f60d0c0fe90df02b5da30ecd7fa26
-
Filesize
71KB
MD5dc2b0f48d8f547d5ff7d67b371d850f0
SHA184d02ddbf478bf7cfe9ccb466362860ee18b3839
SHA2560434c46910f48821a0a442b510260a3faea9404d7e6a8edd2cf44cc7dfea3890
SHA5123470ae3db7053a7e606a221f97f8cadf58500a746daaa4c763d714fe99df026d1c7858aaaf6d34ec1bbaa5305f8eead00101b6a7ac6f4d457425d04bcf92e8d7
-
Filesize
71KB
MD5dc2b0f48d8f547d5ff7d67b371d850f0
SHA184d02ddbf478bf7cfe9ccb466362860ee18b3839
SHA2560434c46910f48821a0a442b510260a3faea9404d7e6a8edd2cf44cc7dfea3890
SHA5123470ae3db7053a7e606a221f97f8cadf58500a746daaa4c763d714fe99df026d1c7858aaaf6d34ec1bbaa5305f8eead00101b6a7ac6f4d457425d04bcf92e8d7
-
Filesize
112KB
MD5780853cddeaee8de70f28a4b255a600b
SHA1ad7a5da33f7ad12946153c497e990720b09005ed
SHA2561055ff62de3dea7645c732583242adf4164bdcfb9dd37d9b35bbb9510d59b0a3
SHA512e422863112084bb8d11c682482e780cd63c2f20c8e3a93ed3b9efd1b04d53eb5d3c8081851ca89b74d66f3d9ab48eb5f6c74550484f46e7c6e460a8250c9b1d8
-
Filesize
28KB
MD590b57f3cee47181981ca476a3a81c079
SHA1d8e3709676d0212e01ddb4e896e1259f1e674cf8
SHA2569886262d0d94a9e59fd5b1a7b61413a9c4412173b625746c7bd96953e6787ac7
SHA5129b03f227fb022c92252db24e42eb45fd8b243ce2364caa913f12db75bd231f9a382abaabf4abadec4596096c227691a5855c69bdd936ebfc314c310013b1e2f5
-
Filesize
28KB
MD590b57f3cee47181981ca476a3a81c079
SHA1d8e3709676d0212e01ddb4e896e1259f1e674cf8
SHA2569886262d0d94a9e59fd5b1a7b61413a9c4412173b625746c7bd96953e6787ac7
SHA5129b03f227fb022c92252db24e42eb45fd8b243ce2364caa913f12db75bd231f9a382abaabf4abadec4596096c227691a5855c69bdd936ebfc314c310013b1e2f5
-
Filesize
71KB
MD5dc2b0f48d8f547d5ff7d67b371d850f0
SHA184d02ddbf478bf7cfe9ccb466362860ee18b3839
SHA2560434c46910f48821a0a442b510260a3faea9404d7e6a8edd2cf44cc7dfea3890
SHA5123470ae3db7053a7e606a221f97f8cadf58500a746daaa4c763d714fe99df026d1c7858aaaf6d34ec1bbaa5305f8eead00101b6a7ac6f4d457425d04bcf92e8d7
-
Filesize
2KB
MD5dd7a4110e2dc0760efdd47ee918c0deb
SHA15ed5efe128e521023e0caf4fff9af747522c8166
SHA256550ad8794d9ec26bc7e09225cb1cbe648ee7c1c2349aabec8172f08bdec26084
SHA512c928725e5f010d371727aadcc057da91378a0b24c66b2848217e9186dd319b6bf09c0859d7bf523ff1736fc41591eb25662a900fbe3977b63132a0c40dcd35dc
-
Filesize
2KB
MD5dd7a4110e2dc0760efdd47ee918c0deb
SHA15ed5efe128e521023e0caf4fff9af747522c8166
SHA256550ad8794d9ec26bc7e09225cb1cbe648ee7c1c2349aabec8172f08bdec26084
SHA512c928725e5f010d371727aadcc057da91378a0b24c66b2848217e9186dd319b6bf09c0859d7bf523ff1736fc41591eb25662a900fbe3977b63132a0c40dcd35dc
-
Filesize
2KB
MD5dd7a4110e2dc0760efdd47ee918c0deb
SHA15ed5efe128e521023e0caf4fff9af747522c8166
SHA256550ad8794d9ec26bc7e09225cb1cbe648ee7c1c2349aabec8172f08bdec26084
SHA512c928725e5f010d371727aadcc057da91378a0b24c66b2848217e9186dd319b6bf09c0859d7bf523ff1736fc41591eb25662a900fbe3977b63132a0c40dcd35dc