Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 01:43
Behavioral task
behavioral1
Sample
4a2ddc9b32143ae5772e14f2d5308210.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
4a2ddc9b32143ae5772e14f2d5308210.exe
Resource
win10v2004-20231215-en
General
-
Target
4a2ddc9b32143ae5772e14f2d5308210.exe
-
Size
68KB
-
MD5
4a2ddc9b32143ae5772e14f2d5308210
-
SHA1
899aadc58311ddb1e947a1dbe72e2bd98ff48b59
-
SHA256
a53f8afa4f54cc77bb794afbeedcbac8b2c788dcaa46cf9a94affa137311bc2d
-
SHA512
e1c506f39fefb7d4564daf92d17875c6819ab3a7abdcda8e65828d08fc40df0abddf97b77e33f09571c6954480c59c9dd20829dfbff3454e45580783243b564d
-
SSDEEP
1536:TQk6VhqGK/IJHtv6gO1qkkJSnZjS1giN762oRfd3q19xZ2H:/6H9K/YHtvOqkkgn9iT+qc
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
flow pid Process 96 2656 rundll32.exe -
Executes dropped EXE 1 IoCs
pid Process 3092 cpa_1.exe -
Loads dropped DLL 3 IoCs
pid Process 3952 regsvr32.exe 2656 rundll32.exe 4824 regsvr32.exe -
resource yara_rule behavioral2/memory/4820-0-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4820-7-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral2/memory/4820-22-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Installs/modifies Browser Helper Object 2 TTPs 1 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6E28339B-7A2A-47B6-AEB2-46BA53782379} regsvr32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 rundll32.exe -
Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\taoba_1.dll 4a2ddc9b32143ae5772e14f2d5308210.exe File created C:\Windows\SysWOW64\cpa_1.exe 4a2ddc9b32143ae5772e14f2d5308210.exe File created C:\Windows\SysWOW64\ccy154.dll 4a2ddc9b32143ae5772e14f2d5308210.exe File created C:\Windows\SysWOW64\dllcache\ccy154.dll 4a2ddc9b32143ae5772e14f2d5308210.exe File created C:\Windows\SysWOW64\ydile.dll 4a2ddc9b32143ae5772e14f2d5308210.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\TypeLib\ = "{CE673B02-973C-4268-A819-DA005C782B5D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ydile.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ = "IATlMy" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\InprocServer32\ = "C:\\Windows\\SysWow64\\ydile.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\ProgID\ = "BhoPlugin.EyeOnIE.1" regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\TypeLib\ = "{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\ = "testAtl 1.0 Type Library" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\ = "EyeOnIE Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\ProxyStubClsid32 Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45} regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\ = "EyeOnIE Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\ = "IEyeOnIE" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\FLAGS\ = "0" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\FLAGS Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\0 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\TypeLib\ = "{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE\CurVer\ = "BhoPlugin.EyeOnIE.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy\CurVer\ = "TestAtl.ATlMy.1" regsvr32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TestAtl.ATlMy.1 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040} Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\0\win32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\ = "IEyeOnIE" Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\ = "ATlMy Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\ProgID\ = "TestAtl.ATlMy.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1\ = "EyeOnIE Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2D5957F-6D1A-44CE-BFBA-D448EAAB8781}\1.0\ = "BhoPlugin 1.0 Type Library" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\ProxyStubClsid32 Process not Found Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ = "IATlMy" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4CF9A0D2-ED75-40CB-98C0-36DF6A30E040}\TypeLib\Version = "1.0" Process not Found Key created \REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CE673B02-973C-4268-A819-DA005C782B5D}\1.0\HELPDIR regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\VersionIndependentProgID\ = "BhoPlugin.EyeOnIE" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5CC5892-346B-4F19-B304-307DD1EF1A45}\TypeLib\ = "{CE673B02-973C-4268-A819-DA005C782B5D}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\BhoPlugin.EyeOnIE.1\CLSID\ = "{6E28339B-7A2A-47B6-AEB2-46BA53782379}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E28339B-7A2A-47B6-AEB2-46BA53782379}\TypeLib regsvr32.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2692 explorer.exe -
Suspicious behavior: EnumeratesProcesses 44 IoCs
pid Process 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 2656 rundll32.exe 2656 rundll32.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe 3092 cpa_1.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 3092 cpa_1.exe 2692 explorer.exe 2692 explorer.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4820 wrote to memory of 3952 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 92 PID 4820 wrote to memory of 3952 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 92 PID 4820 wrote to memory of 3952 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 92 PID 4820 wrote to memory of 2656 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 93 PID 4820 wrote to memory of 2656 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 93 PID 4820 wrote to memory of 2656 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 93 PID 4820 wrote to memory of 4824 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 103 PID 4820 wrote to memory of 4824 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 103 PID 4820 wrote to memory of 4824 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 103 PID 4820 wrote to memory of 3092 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 105 PID 4820 wrote to memory of 3092 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 105 PID 4820 wrote to memory of 3092 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 105 PID 3092 wrote to memory of 632 3092 cpa_1.exe 104 PID 3092 wrote to memory of 632 3092 cpa_1.exe 104 PID 3092 wrote to memory of 632 3092 cpa_1.exe 104 PID 4820 wrote to memory of 916 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 112 PID 4820 wrote to memory of 916 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 112 PID 4820 wrote to memory of 916 4820 4a2ddc9b32143ae5772e14f2d5308210.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a2ddc9b32143ae5772e14f2d5308210.exe"C:\Users\Admin\AppData\Local\Temp\4a2ddc9b32143ae5772e14f2d5308210.exe"1⤵
- Drops file in System32 directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4820 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\System32\ydile.dll2⤵
- Loads dropped DLL
- Modifies registry class
PID:3952
-
-
C:\Windows\SysWOW64\rundll32.exerundll32 ccy154.dll , InstallMyDll2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: EnumeratesProcesses
PID:2656
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /s C:\Windows\System32\taoba_1.dll2⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies registry class
PID:4824
-
-
C:\Windows\SysWOW64\cpa_1.exeC:\Windows\System32\cpa_1.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3092
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 375519961O57540.bat2⤵PID:916
-
-
C:\Windows\SysWOW64\explorer.exeexplorer1⤵PID:632
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2692
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵PID:3664
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120KB
MD5510f9a4c16b9141d29b7b723e0c15a21
SHA16162d7d76a6bcaf90d0e6f97eb8cf8558f264773
SHA25615882f2024d91dcd9e95f6ae901868e8c862efb05855b5546d5c6ab0ba6a0cff
SHA512c079327b0f8465cd94b4795f0c577504956306f84b4dd5cd9135c8f3ae61b6735ed2641dd767b44c97943cf0a97a0f71f99844eeddd7ae4c742b0e2f5f742d1f
-
Filesize
48KB
MD5538f79a36ca7a9f38a87f1a218df638d
SHA131fcd9c21011b8cb02f9320e1f58ca0ec00b0110
SHA2563a20bb541e1ea1c0917ee77a4280baa563099209ee4a3f7c148edeab1cd813ea
SHA512b4c58defc4fe57197c4dcd675bf15471c725ca5871f5faaeaf520c668efd1ea87a34efe11c78925e36d0839ccb3607b1639c55b1844d8c73e971bd0d0584e86c