Analysis
-
max time kernel
171s -
max time network
164s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30-04-2023 21:49
Static task
static1
Behavioral task
behavioral1
Sample
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe
Resource
win7-20230220-en
General
-
Target
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe
-
Size
3.0MB
-
MD5
4b32941cd92e048e6a2d16c6069edf62
-
SHA1
5d167b4588575ffbc7a06cd9fa22552dced38951
-
SHA256
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d
-
SHA512
8b5c75642960991648fd18fb2c5421f8d082f0982a4b5950dd091547dc53943fccb287a404593fbb08282188c3c94d75e05c28f1a58f83a5b6559f34a516442e
-
SSDEEP
98304:6fFbrdnYUGkQqOSlBk1G4QBeKW0wnpTX5OIX:6fFbhBMqOxFgW3nRr
Malware Config
Extracted
aurora
94.142.138.215:8081
Signatures
-
Detects any file with a triage score of 10 4 IoCs
This file has been assigned a triage score of 10, indicating a high likelihood of malicious behavior.
Processes:
resource yara_rule behavioral1/memory/1216-55-0x00000000010B0000-0x00000000018D2000-memory.dmp triage_score_10 behavioral1/memory/1216-57-0x00000000010B0000-0x00000000018D2000-memory.dmp triage_score_10 behavioral1/memory/1216-58-0x00000000010B0000-0x00000000018D2000-memory.dmp triage_score_10 behavioral1/memory/1216-59-0x00000000010B0000-0x00000000018D2000-memory.dmp triage_score_10 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exepid process 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepid process 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe 916 powershell.exe 1524 powershell.exe 668 powershell.exe 1672 powershell.exe 1108 powershell.exe 1140 powershell.exe 1624 powershell.exe 1248 powershell.exe 2044 powershell.exe 1980 powershell.exe 1848 powershell.exe 1844 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WMIC.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 336 WMIC.exe Token: SeSecurityPrivilege 336 WMIC.exe Token: SeTakeOwnershipPrivilege 336 WMIC.exe Token: SeLoadDriverPrivilege 336 WMIC.exe Token: SeSystemProfilePrivilege 336 WMIC.exe Token: SeSystemtimePrivilege 336 WMIC.exe Token: SeProfSingleProcessPrivilege 336 WMIC.exe Token: SeIncBasePriorityPrivilege 336 WMIC.exe Token: SeCreatePagefilePrivilege 336 WMIC.exe Token: SeBackupPrivilege 336 WMIC.exe Token: SeRestorePrivilege 336 WMIC.exe Token: SeShutdownPrivilege 336 WMIC.exe Token: SeDebugPrivilege 336 WMIC.exe Token: SeSystemEnvironmentPrivilege 336 WMIC.exe Token: SeRemoteShutdownPrivilege 336 WMIC.exe Token: SeUndockPrivilege 336 WMIC.exe Token: SeManageVolumePrivilege 336 WMIC.exe Token: 33 336 WMIC.exe Token: 34 336 WMIC.exe Token: 35 336 WMIC.exe Token: SeIncreaseQuotaPrivilege 336 WMIC.exe Token: SeSecurityPrivilege 336 WMIC.exe Token: SeTakeOwnershipPrivilege 336 WMIC.exe Token: SeLoadDriverPrivilege 336 WMIC.exe Token: SeSystemProfilePrivilege 336 WMIC.exe Token: SeSystemtimePrivilege 336 WMIC.exe Token: SeProfSingleProcessPrivilege 336 WMIC.exe Token: SeIncBasePriorityPrivilege 336 WMIC.exe Token: SeCreatePagefilePrivilege 336 WMIC.exe Token: SeBackupPrivilege 336 WMIC.exe Token: SeRestorePrivilege 336 WMIC.exe Token: SeShutdownPrivilege 336 WMIC.exe Token: SeDebugPrivilege 336 WMIC.exe Token: SeSystemEnvironmentPrivilege 336 WMIC.exe Token: SeRemoteShutdownPrivilege 336 WMIC.exe Token: SeUndockPrivilege 336 WMIC.exe Token: SeManageVolumePrivilege 336 WMIC.exe Token: 33 336 WMIC.exe Token: 34 336 WMIC.exe Token: 35 336 WMIC.exe Token: SeIncreaseQuotaPrivilege 840 wmic.exe Token: SeSecurityPrivilege 840 wmic.exe Token: SeTakeOwnershipPrivilege 840 wmic.exe Token: SeLoadDriverPrivilege 840 wmic.exe Token: SeSystemProfilePrivilege 840 wmic.exe Token: SeSystemtimePrivilege 840 wmic.exe Token: SeProfSingleProcessPrivilege 840 wmic.exe Token: SeIncBasePriorityPrivilege 840 wmic.exe Token: SeCreatePagefilePrivilege 840 wmic.exe Token: SeBackupPrivilege 840 wmic.exe Token: SeRestorePrivilege 840 wmic.exe Token: SeShutdownPrivilege 840 wmic.exe Token: SeDebugPrivilege 840 wmic.exe Token: SeSystemEnvironmentPrivilege 840 wmic.exe Token: SeRemoteShutdownPrivilege 840 wmic.exe Token: SeUndockPrivilege 840 wmic.exe Token: SeManageVolumePrivilege 840 wmic.exe Token: 33 840 wmic.exe Token: 34 840 wmic.exe Token: 35 840 wmic.exe Token: SeIncreaseQuotaPrivilege 840 wmic.exe Token: SeSecurityPrivilege 840 wmic.exe Token: SeTakeOwnershipPrivilege 840 wmic.exe Token: SeLoadDriverPrivilege 840 wmic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1216 wrote to memory of 1328 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1328 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1328 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1328 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1328 wrote to memory of 336 1328 cmd.exe WMIC.exe PID 1328 wrote to memory of 336 1328 cmd.exe WMIC.exe PID 1328 wrote to memory of 336 1328 cmd.exe WMIC.exe PID 1328 wrote to memory of 336 1328 cmd.exe WMIC.exe PID 1216 wrote to memory of 840 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe wmic.exe PID 1216 wrote to memory of 840 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe wmic.exe PID 1216 wrote to memory of 840 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe wmic.exe PID 1216 wrote to memory of 840 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe wmic.exe PID 1216 wrote to memory of 1000 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1000 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1000 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1000 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1000 wrote to memory of 1276 1000 cmd.exe WMIC.exe PID 1000 wrote to memory of 1276 1000 cmd.exe WMIC.exe PID 1000 wrote to memory of 1276 1000 cmd.exe WMIC.exe PID 1000 wrote to memory of 1276 1000 cmd.exe WMIC.exe PID 1216 wrote to memory of 1580 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1580 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1580 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1580 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1580 wrote to memory of 1896 1580 cmd.exe WMIC.exe PID 1580 wrote to memory of 1896 1580 cmd.exe WMIC.exe PID 1580 wrote to memory of 1896 1580 cmd.exe WMIC.exe PID 1580 wrote to memory of 1896 1580 cmd.exe WMIC.exe PID 1216 wrote to memory of 1604 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1604 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1604 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1216 wrote to memory of 1604 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe cmd.exe PID 1604 wrote to memory of 788 1604 cmd.exe systeminfo.exe PID 1604 wrote to memory of 788 1604 cmd.exe systeminfo.exe PID 1604 wrote to memory of 788 1604 cmd.exe systeminfo.exe PID 1604 wrote to memory of 788 1604 cmd.exe systeminfo.exe PID 1216 wrote to memory of 916 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 916 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 916 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 916 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1524 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1524 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1524 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1524 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 668 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 668 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 668 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 668 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1672 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1672 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1672 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1672 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1108 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1108 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1108 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1108 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1140 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1140 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1140 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1140 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1624 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1624 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1624 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe PID 1216 wrote to memory of 1624 1216 a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe"C:\Users\Admin\AppData\Local\Temp\a1dc10eaa3d8eb09dfcb58123a48484639301d86165a8e3c76747cc04a2bf67d.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c "wmic csproduct get uuid"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic csproduct get uuid3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exewmic os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic path win32_VideoController get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C "wmic cpu get name"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic cpu get name3⤵
-
C:\Windows\SysWOW64\cmd.execmd "/c " systeminfo2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo3⤵
- Gathers system information
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\XVlBzgbaiC\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History\" \"C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHc\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\tcuAxhxKQFDaFpL\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFf\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\RsWxPLDnJObCsNV\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\lgTeMaPEZQ\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\leQYhYzRyWJjPjz\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\pfRFEgmota\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\FetHsbZRjxAwnwe\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\krBEmfdzdc\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State\" \"C:\Users\Admin\AppData\Local\Temp\EkXBAkjQZLCtTMt\""2⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "" "copy \"C:\Users\Admin\AppData\Local\Microsoft\Windows\History\" \"C:\Users\Admin\AppData\Local\Temp\TCoaNatyyi\""2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\EkXBAkjQZLCtTMtFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\FetHsbZRjxAwnweFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\MRAjWwhTHcFilesize
148KB
MD590a1d4b55edf36fa8b4cc6974ed7d4c4
SHA1aba1b8d0e05421e7df5982899f626211c3c4b5c1
SHA2567cf3e9e8619904e72ea6608cc43e9b6c9f8aa2af02476f60c2b3daf33075981c
SHA512ea0838be754e1258c230111900c5937d2b0788f90bbf7c5f82b2ceda7868e50afb86c301f313267eaa912778da45755560b5434885521bf915967a7863922ae2
-
C:\Users\Admin\AppData\Local\Temp\RsWxPLDnJObCsNVFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\SjFbcXoEFfFilesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\krBEmfdzdcFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\krBEmfdzdcFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\leQYhYzRyWJjPjzFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Local\Temp\lgTeMaPEZQFilesize
20KB
MD5c9ff7748d8fcef4cf84a5501e996a641
SHA102867e5010f62f97ebb0cfb32cb3ede9449fe0c9
SHA2564d3f3194cb1133437aa69bb880c8cbb55ddf06ff61a88ca6c3f1bbfbfd35d988
SHA512d36054499869a8f56ac8547ccd5455f1252c24e17d2b185955390b32da7e2a732ace4e0f30f9493fcc61425a2e31ed623465f998f41af69423ee0e3ed1483a73
-
C:\Users\Admin\AppData\Local\Temp\pfRFEgmotaFilesize
92KB
MD5747ae56c4c143d35c9f4deb890d470c3
SHA11bbe23d6c5eeb56f8a3ea5459bbd00cb825dc22a
SHA256e847489244a60ca420a700898a700fc01002a84aed20b1af9d4ffde6b0a3214e
SHA512f492b8d634c02d680e906f3827b53b41d69905ad59eda7c419f1f8af33a795f6330d1d88243eeab0365a1f25cf524070231ce4720034a4d0cf85a8acf5b05395
-
C:\Users\Admin\AppData\Local\Temp\tcuAxhxKQFDaFpLFilesize
71KB
MD56a3c2fe239e67cd5804a699b9aa54b07
SHA1018091f0c903173dec18cd10e0e00889f0717d67
SHA256160b3bbb5a6845c2bc01355921c466e8b3ecc05de44888e5a4b27962898d7168
SHA512aaf0f6171b6e4f6b143369a074357bac219e7efa56b6bee77988baa9264d76231b0c3df6922d2b2c95a1acf9901b81bcc76f783284fc5be02a789199d4dcbe37
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\49E312Y670JE5P3VB11H.tempFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD55be6bd0a4a6077973e89091677875745
SHA1c3b9f53b3cb7df2e7dcf305ad4d24e9cb5e9664e
SHA25682dea0d94db738fa5f554c7ef8d1cb86b66342a1dcaae374ff9c527bfe59c424
SHA512d90e8f3a24e75a76c4091c2ce6f011556b68b9ac8f8a6d60ffe3709982d861ecfafc1d88229c0bf86a93509cb040412e9688321cfb197a411798b831ad93c6b5
-
memory/668-85-0x0000000002820000-0x0000000002860000-memory.dmpFilesize
256KB
-
memory/668-86-0x0000000002820000-0x0000000002860000-memory.dmpFilesize
256KB
-
memory/916-69-0x0000000002720000-0x0000000002760000-memory.dmpFilesize
256KB
-
memory/916-68-0x0000000002720000-0x0000000002760000-memory.dmpFilesize
256KB
-
memory/1216-60-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-84-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-63-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-62-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-116-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-61-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-65-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-123-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-164-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-56-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-59-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-54-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-58-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-64-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-148-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-57-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1216-55-0x00000000010B0000-0x00000000018D2000-memory.dmpFilesize
8.1MB
-
memory/1248-125-0x00000000027A0000-0x00000000027E0000-memory.dmpFilesize
256KB
-
memory/1248-124-0x00000000027A0000-0x00000000027E0000-memory.dmpFilesize
256KB
-
memory/1524-75-0x0000000002700000-0x0000000002740000-memory.dmpFilesize
256KB
-
memory/1524-76-0x0000000002700000-0x0000000002740000-memory.dmpFilesize
256KB
-
memory/1844-158-0x0000000002750000-0x0000000002790000-memory.dmpFilesize
256KB
-
memory/1844-159-0x0000000002750000-0x0000000002790000-memory.dmpFilesize
256KB
-
memory/1844-160-0x0000000002750000-0x0000000002790000-memory.dmpFilesize
256KB
-
memory/1848-149-0x00000000026E0000-0x0000000002720000-memory.dmpFilesize
256KB
-
memory/1848-150-0x00000000026E0000-0x0000000002720000-memory.dmpFilesize
256KB
-
memory/1980-140-0x00000000025B0000-0x00000000025F0000-memory.dmpFilesize
256KB