Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2023, 08:50
Static task
static1
General
-
Target
265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9.exe
-
Size
1.2MB
-
MD5
240e8b308b176254a0b32c320a010554
-
SHA1
0cac571b76654f7e34b07666dd5c68a515b561c4
-
SHA256
265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9
-
SHA512
169aa5546cd8ec1b530dd7073320f5eb8a6cb8d56d15bf7215e6c36273de2eec5d6d3ee289efa2dddea6b76647a1b80020b33590ab9fe4cd74083a66ec55f99a
-
SSDEEP
24576:vy47j+HIXJh39D5OQubjYABk0R5U+SgaFKA7Dt1okxs/r92acFsoznMau2:64kIXTKQu7F0xgOXt1oUsJc3znF
Malware Config
Extracted
redline
losk
185.161.248.150:4128
-
auth_value
c0a6c391e53d2d9cd27bb17d1d38ada3
Extracted
redline
diza
185.161.248.150:4128
-
auth_value
0d09b419c8bc967f91c68be4a17e92ee
Signatures
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection pr734002.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" pr734002.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" pr734002.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" pr734002.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" pr734002.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" pr734002.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation si378826.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation oneetx.exe Key value queried \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation qu663299.exe -
Executes dropped EXE 10 IoCs
pid Process 552 un955157.exe 2320 un694557.exe 2636 pr734002.exe 3868 qu663299.exe 1216 1.exe 4724 rk104852.exe 4064 si378826.exe 3672 oneetx.exe 1200 oneetx.exe 3160 oneetx.exe -
Loads dropped DLL 1 IoCs
pid Process 3412 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features pr734002.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0" pr734002.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce 265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un955157.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" un955157.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce un694557.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" un694557.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 27 IoCs
pid pid_target Process procid_target 1652 2636 WerFault.exe 85 3164 3868 WerFault.exe 91 3456 4064 WerFault.exe 98 3740 4064 WerFault.exe 98 2476 4064 WerFault.exe 98 3012 4064 WerFault.exe 98 2680 4064 WerFault.exe 98 3804 4064 WerFault.exe 98 3960 4064 WerFault.exe 98 456 4064 WerFault.exe 98 2860 4064 WerFault.exe 98 1188 4064 WerFault.exe 98 2528 3672 WerFault.exe 122 4784 3672 WerFault.exe 122 2640 3672 WerFault.exe 122 2216 3672 WerFault.exe 122 3224 3672 WerFault.exe 122 3620 3672 WerFault.exe 122 2076 3672 WerFault.exe 122 2720 3672 WerFault.exe 122 2244 3672 WerFault.exe 122 1452 3672 WerFault.exe 122 5080 3672 WerFault.exe 122 1432 3672 WerFault.exe 122 4388 3672 WerFault.exe 122 2368 3672 WerFault.exe 122 3928 3672 WerFault.exe 122 -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2420 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2636 pr734002.exe 2636 pr734002.exe 1216 1.exe 4724 rk104852.exe 4724 rk104852.exe 1216 1.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2636 pr734002.exe Token: SeDebugPrivilege 3868 qu663299.exe Token: SeDebugPrivilege 1216 1.exe Token: SeDebugPrivilege 4724 rk104852.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4064 si378826.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2036 wrote to memory of 552 2036 265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9.exe 83 PID 2036 wrote to memory of 552 2036 265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9.exe 83 PID 2036 wrote to memory of 552 2036 265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9.exe 83 PID 552 wrote to memory of 2320 552 un955157.exe 84 PID 552 wrote to memory of 2320 552 un955157.exe 84 PID 552 wrote to memory of 2320 552 un955157.exe 84 PID 2320 wrote to memory of 2636 2320 un694557.exe 85 PID 2320 wrote to memory of 2636 2320 un694557.exe 85 PID 2320 wrote to memory of 2636 2320 un694557.exe 85 PID 2320 wrote to memory of 3868 2320 un694557.exe 91 PID 2320 wrote to memory of 3868 2320 un694557.exe 91 PID 2320 wrote to memory of 3868 2320 un694557.exe 91 PID 3868 wrote to memory of 1216 3868 qu663299.exe 92 PID 3868 wrote to memory of 1216 3868 qu663299.exe 92 PID 3868 wrote to memory of 1216 3868 qu663299.exe 92 PID 552 wrote to memory of 4724 552 un955157.exe 95 PID 552 wrote to memory of 4724 552 un955157.exe 95 PID 552 wrote to memory of 4724 552 un955157.exe 95 PID 2036 wrote to memory of 4064 2036 265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9.exe 98 PID 2036 wrote to memory of 4064 2036 265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9.exe 98 PID 2036 wrote to memory of 4064 2036 265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9.exe 98 PID 4064 wrote to memory of 3672 4064 si378826.exe 122 PID 4064 wrote to memory of 3672 4064 si378826.exe 122 PID 4064 wrote to memory of 3672 4064 si378826.exe 122 PID 3672 wrote to memory of 2420 3672 oneetx.exe 137 PID 3672 wrote to memory of 2420 3672 oneetx.exe 137 PID 3672 wrote to memory of 2420 3672 oneetx.exe 137 PID 3672 wrote to memory of 3412 3672 oneetx.exe 152 PID 3672 wrote to memory of 3412 3672 oneetx.exe 152 PID 3672 wrote to memory of 3412 3672 oneetx.exe 152
Processes
-
C:\Users\Admin\AppData\Local\Temp\265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9.exe"C:\Users\Admin\AppData\Local\Temp\265b6b6fbf0d82cc52d75bd070af669244aa2ce407e58acbfb08b855bf9ed4a9.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un955157.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\un955157.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un694557.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\un694557.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr734002.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\pr734002.exe4⤵
- Modifies Windows Defender Real-time Protection settings
- Executes dropped EXE
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2636 -s 10805⤵
- Program crash
PID:1652
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu663299.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\qu663299.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3868 -
C:\Windows\Temp\1.exe"C:\Windows\Temp\1.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3868 -s 13765⤵
- Program crash
PID:3164
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk104852.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\rk104852.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4724
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si378826.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\si378826.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 6963⤵
- Program crash
PID:3456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 7803⤵
- Program crash
PID:3740
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 8603⤵
- Program crash
PID:2476
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 9523⤵
- Program crash
PID:3012
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 9523⤵
- Program crash
PID:2680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 8643⤵
- Program crash
PID:3804
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 12643⤵
- Program crash
PID:3960
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 13523⤵
- Program crash
PID:456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 13443⤵
- Program crash
PID:2860
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4064 -s 12723⤵
- Program crash
PID:1188
-
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 6924⤵
- Program crash
PID:2528
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 8364⤵
- Program crash
PID:4784
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 9084⤵
- Program crash
PID:2640
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 10524⤵
- Program crash
PID:2216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 10724⤵
- Program crash
PID:3224
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 10724⤵
- Program crash
PID:3620
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 11404⤵
- Program crash
PID:2076
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN oneetx.exe /TR "C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe" /F4⤵
- Creates scheduled task(s)
PID:2420
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 10004⤵
- Program crash
PID:2720
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 7684⤵
- Program crash
PID:2244
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 12884⤵
- Program crash
PID:1452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 13444⤵
- Program crash
PID:5080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 11644⤵
- Program crash
PID:1432
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 16124⤵
- Program crash
PID:4388
-
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Roaming\006700e5a2ab05\clip64.dll, Main4⤵
- Loads dropped DLL
PID:3412
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 14004⤵
- Program crash
PID:2368
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3672 -s 16284⤵
- Program crash
PID:3928
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2636 -ip 26361⤵PID:692
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 3868 -ip 38681⤵PID:1360
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4064 -ip 40641⤵PID:4608
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4064 -ip 40641⤵PID:3176
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4064 -ip 40641⤵PID:2460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4064 -ip 40641⤵PID:4388
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4064 -ip 40641⤵PID:216
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4064 -ip 40641⤵PID:1100
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4064 -ip 40641⤵PID:1796
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4064 -ip 40641⤵PID:4156
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 4064 -ip 40641⤵PID:2332
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4064 -ip 40641⤵PID:1184
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3672 -ip 36721⤵PID:2852
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3672 -ip 36721⤵PID:4884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3672 -ip 36721⤵PID:1580
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3672 -ip 36721⤵PID:3800
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3672 -ip 36721⤵PID:1160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3672 -ip 36721⤵PID:3744
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3672 -ip 36721⤵PID:2104
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3672 -ip 36721⤵PID:4788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3672 -ip 36721⤵PID:2320
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3672 -ip 36721⤵PID:64
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3672 -ip 36721⤵PID:548
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:1200
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3672 -ip 36721⤵PID:2884
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3672 -ip 36721⤵PID:4964
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3672 -ip 36721⤵PID:4084
-
C:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exeC:\Users\Admin\AppData\Local\Temp\595f021478\oneetx.exe1⤵
- Executes dropped EXE
PID:3160
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3672 -ip 36721⤵PID:4116
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
395KB
MD50787f03bc6958d41b5acf62a2d544f79
SHA1cc339a314f2a2a811921c34d91c924e81459b0af
SHA2560fd0a98c75c59b0d157b46c7867bb69e956d69cec5e7f9d0b2ac67e4ab9776c2
SHA512939d7d091c8d93d0a8b4c75628a51e6ea34d791c6bf04c9e96e869d80d45bf5ddd66fcb53e072694467789df7fd2e4edeb7357d4d57ad16cc29681415efe0694
-
Filesize
395KB
MD50787f03bc6958d41b5acf62a2d544f79
SHA1cc339a314f2a2a811921c34d91c924e81459b0af
SHA2560fd0a98c75c59b0d157b46c7867bb69e956d69cec5e7f9d0b2ac67e4ab9776c2
SHA512939d7d091c8d93d0a8b4c75628a51e6ea34d791c6bf04c9e96e869d80d45bf5ddd66fcb53e072694467789df7fd2e4edeb7357d4d57ad16cc29681415efe0694
-
Filesize
395KB
MD50787f03bc6958d41b5acf62a2d544f79
SHA1cc339a314f2a2a811921c34d91c924e81459b0af
SHA2560fd0a98c75c59b0d157b46c7867bb69e956d69cec5e7f9d0b2ac67e4ab9776c2
SHA512939d7d091c8d93d0a8b4c75628a51e6ea34d791c6bf04c9e96e869d80d45bf5ddd66fcb53e072694467789df7fd2e4edeb7357d4d57ad16cc29681415efe0694
-
Filesize
395KB
MD50787f03bc6958d41b5acf62a2d544f79
SHA1cc339a314f2a2a811921c34d91c924e81459b0af
SHA2560fd0a98c75c59b0d157b46c7867bb69e956d69cec5e7f9d0b2ac67e4ab9776c2
SHA512939d7d091c8d93d0a8b4c75628a51e6ea34d791c6bf04c9e96e869d80d45bf5ddd66fcb53e072694467789df7fd2e4edeb7357d4d57ad16cc29681415efe0694
-
Filesize
395KB
MD50787f03bc6958d41b5acf62a2d544f79
SHA1cc339a314f2a2a811921c34d91c924e81459b0af
SHA2560fd0a98c75c59b0d157b46c7867bb69e956d69cec5e7f9d0b2ac67e4ab9776c2
SHA512939d7d091c8d93d0a8b4c75628a51e6ea34d791c6bf04c9e96e869d80d45bf5ddd66fcb53e072694467789df7fd2e4edeb7357d4d57ad16cc29681415efe0694
-
Filesize
395KB
MD50787f03bc6958d41b5acf62a2d544f79
SHA1cc339a314f2a2a811921c34d91c924e81459b0af
SHA2560fd0a98c75c59b0d157b46c7867bb69e956d69cec5e7f9d0b2ac67e4ab9776c2
SHA512939d7d091c8d93d0a8b4c75628a51e6ea34d791c6bf04c9e96e869d80d45bf5ddd66fcb53e072694467789df7fd2e4edeb7357d4d57ad16cc29681415efe0694
-
Filesize
395KB
MD50787f03bc6958d41b5acf62a2d544f79
SHA1cc339a314f2a2a811921c34d91c924e81459b0af
SHA2560fd0a98c75c59b0d157b46c7867bb69e956d69cec5e7f9d0b2ac67e4ab9776c2
SHA512939d7d091c8d93d0a8b4c75628a51e6ea34d791c6bf04c9e96e869d80d45bf5ddd66fcb53e072694467789df7fd2e4edeb7357d4d57ad16cc29681415efe0694
-
Filesize
862KB
MD579abb1aec309a87df391b253ecebebd0
SHA13699ad0496249efbd623f6e93e45ab1eac6f9b33
SHA25626fe6cef078fc4a3dc95e7ac1406a0d34bbec654eed22fbf507f045ab84e29bc
SHA512f634c8fde0bae652367d49e283260d9fed06975b491062cc292be7c0c1d994f2d4c859e90beb4063613158ebe358e63d5837d9d5e1db9e74dfdb17267162abf1
-
Filesize
862KB
MD579abb1aec309a87df391b253ecebebd0
SHA13699ad0496249efbd623f6e93e45ab1eac6f9b33
SHA25626fe6cef078fc4a3dc95e7ac1406a0d34bbec654eed22fbf507f045ab84e29bc
SHA512f634c8fde0bae652367d49e283260d9fed06975b491062cc292be7c0c1d994f2d4c859e90beb4063613158ebe358e63d5837d9d5e1db9e74dfdb17267162abf1
-
Filesize
168KB
MD5543bebe646e48065e8a81aa31e0fe437
SHA1fbc40c7a69b265f599b390154466c9b226f1330d
SHA2563505967e9415f6112e59e8fcb1a7ac63029d3fafa02cf0ff127fa6b170d1b917
SHA512bc2eac15ba4085b98466ad2cde78d600738b776e693fc8a40ffa15cf5621cf45ad13c0d2c2dd9c12669783e4aa2f80a74058bbebc22002043aeb8fa4e40e5dd5
-
Filesize
168KB
MD5543bebe646e48065e8a81aa31e0fe437
SHA1fbc40c7a69b265f599b390154466c9b226f1330d
SHA2563505967e9415f6112e59e8fcb1a7ac63029d3fafa02cf0ff127fa6b170d1b917
SHA512bc2eac15ba4085b98466ad2cde78d600738b776e693fc8a40ffa15cf5621cf45ad13c0d2c2dd9c12669783e4aa2f80a74058bbebc22002043aeb8fa4e40e5dd5
-
Filesize
709KB
MD5c7a4fce19db04bf3d87ac8fcb413cca9
SHA146b634b05cd12d6a8bc3df58ace81429ba0bd38b
SHA256a032b6fd100b56d9f750e50dc99db8dea7da31afb63c652d5eb19431741a8c85
SHA512c2c4b0e8658980ff613e7e81bca8a2e13ab9d52d7751876edf4bfb8fceef88ee29c12a181ccadb2336b3927ab410c4a599064783b7fee37e83803273e62e8572
-
Filesize
709KB
MD5c7a4fce19db04bf3d87ac8fcb413cca9
SHA146b634b05cd12d6a8bc3df58ace81429ba0bd38b
SHA256a032b6fd100b56d9f750e50dc99db8dea7da31afb63c652d5eb19431741a8c85
SHA512c2c4b0e8658980ff613e7e81bca8a2e13ab9d52d7751876edf4bfb8fceef88ee29c12a181ccadb2336b3927ab410c4a599064783b7fee37e83803273e62e8572
-
Filesize
402KB
MD51d203485bce670085db7fb942d21906b
SHA172cfc95f08197e7ffac960e3284b67a2d7849d54
SHA256bc49c97bed0f0cb4a764c1bcf578316838e38a242a08883879c878a5b97b3c27
SHA512288b212a8fcf158ddb1d9e633ac84b0181fd00ac35621c5e49ab7febdc33c785b6d3f770c16211af2ce2a8c6b1d26f09db65e69e5747525b02843d180cf8afce
-
Filesize
402KB
MD51d203485bce670085db7fb942d21906b
SHA172cfc95f08197e7ffac960e3284b67a2d7849d54
SHA256bc49c97bed0f0cb4a764c1bcf578316838e38a242a08883879c878a5b97b3c27
SHA512288b212a8fcf158ddb1d9e633ac84b0181fd00ac35621c5e49ab7febdc33c785b6d3f770c16211af2ce2a8c6b1d26f09db65e69e5747525b02843d180cf8afce
-
Filesize
587KB
MD500e123ad27eba16828b8f3699403af8c
SHA121d153c676888262470abf9308a366f91518257e
SHA256f2e58b2abf66ceaf22ebeee384ac1368427b32689146c57b2ce95249321d45f3
SHA51235826cc4570f5bb08859879d07641d4b779b487970cac2e21d3050f9aa378e1597a48314150cb8537c7878c7b14cba3099599628cbed0651c5e1aabd88382e11
-
Filesize
587KB
MD500e123ad27eba16828b8f3699403af8c
SHA121d153c676888262470abf9308a366f91518257e
SHA256f2e58b2abf66ceaf22ebeee384ac1368427b32689146c57b2ce95249321d45f3
SHA51235826cc4570f5bb08859879d07641d4b779b487970cac2e21d3050f9aa378e1597a48314150cb8537c7878c7b14cba3099599628cbed0651c5e1aabd88382e11
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
89KB
MD5ee69aeae2f96208fc3b11dfb70e07161
SHA15f877b7ca02c4d476f2641bcee9ef5f3a4ab3cf6
SHA25613ce132c49ab6673a4da35eb9ff11d71f1451ad1351417e99cf41db8d2f474d9
SHA51294373fb87b58db0bc0462f1b356897b0919615fe5d8f3ec47f1370b6599261562f7b27e8b0faf46f9cba5fdbabceb67c65557c816bd472d72baa1071d8ee5c6f
-
Filesize
162B
MD51b7c22a214949975556626d7217e9a39
SHA1d01c97e2944166ed23e47e4a62ff471ab8fa031f
SHA256340c8464c2007ce3f80682e15dfafa4180b641d53c14201b929906b7b0284d87
SHA512ba64847cf1d4157d50abe4f4a1e5c1996fe387c5808e2f758c7fb3213bfefe1f3712d343f0c30a16819749840954654a70611d2250fd0f7b032429db7afd2cc5
-
Filesize
168KB
MD59769c25c4a15b0c8af084316d51ab586
SHA1d9df15e4232d136ece8bc89354036adfdc3ec069
SHA25606b517e81040b5c3fc27adb0c5cfbc05b6082a88d3e6087bb2f3f8e941e22913
SHA512cffddfb5283ccae2615dd131eee23a137d9a79270295caa865d6f1cf8fa6650ed74106d41566b2d29f7dad39450e3a1feb46b9c568c4a71ba3329606fdea65a8
-
Filesize
168KB
MD59769c25c4a15b0c8af084316d51ab586
SHA1d9df15e4232d136ece8bc89354036adfdc3ec069
SHA25606b517e81040b5c3fc27adb0c5cfbc05b6082a88d3e6087bb2f3f8e941e22913
SHA512cffddfb5283ccae2615dd131eee23a137d9a79270295caa865d6f1cf8fa6650ed74106d41566b2d29f7dad39450e3a1feb46b9c568c4a71ba3329606fdea65a8
-
Filesize
168KB
MD59769c25c4a15b0c8af084316d51ab586
SHA1d9df15e4232d136ece8bc89354036adfdc3ec069
SHA25606b517e81040b5c3fc27adb0c5cfbc05b6082a88d3e6087bb2f3f8e941e22913
SHA512cffddfb5283ccae2615dd131eee23a137d9a79270295caa865d6f1cf8fa6650ed74106d41566b2d29f7dad39450e3a1feb46b9c568c4a71ba3329606fdea65a8