Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    29/12/2023, 18:22

General

  • Target

    005453fd6cf9cb6729231f920a3bb7d9.exe

  • Size

    625KB

  • MD5

    005453fd6cf9cb6729231f920a3bb7d9

  • SHA1

    def31d858156623f6bf41f6b7e1f3acdec810361

  • SHA256

    b457dd4a687c867a8d664eb9d1200e3a78f7dc48c96d4da5a5b8247954011b42

  • SHA512

    cf1e593f638e0c080caccbe8f14b2eeca8e22bcb01b95437171e22772d3c0ce70e8f979a891fa64f80e40ed123bc8a20329b9d1264be6b6670a8fe7012766003

  • SSDEEP

    12288:zgvDXFxC7b94xV+1XGoODYOqvG3YqBxGmZjLhxTQUZWqYqEsYh19zki6p:zgJS99ODn

Malware Config

Extracted

Family

redline

Botnet

31.08

C2

95.181.152.47:15089

Extracted

Family

redline

Botnet

�━�⠄਀έ�爊Ꭹ瀀≾�⠊G਀坲�Ṱ劍�━죐�⠄਀έ�⠊`਀㠨�漊Ģ؀爇Ꮉ

C2

ခ��潩̀ Ā縚"਀*〛¥�4ᄀ텳�ਊ猆ħ؀܋ㅲ⡰d਀㑲繰"਀䝯�Ἂ贤RĀ퀥ãЀḨ�猊਀ꥲ繰"਀䜨�爊W瀀贞RĀ퀥ÈЀḨ�猊਀怨�⠊8਀≯܆륲⡰⬀ረ�猫਀⑯܆漖Ħ؀漇Ô਀Ϟ�؀*�ခ��ꂚ̀ ĀȞⰨ⨆縚"਀*〛v�4ᄀ텳�ਊ猆ħ؀܋앲⡰d਀虲繰"਀䝯�Ἂ贉RĀ퀥´ЀḨ�猊਀㠨�漊Ģ؀爇Ꮉ瀀ᄨ�⠫⬀έ�漊Ĥ؀ᘇ♯܆푯��☃Þ⨆�ခ��煫̀ ĀȞⰨ⨆〓ƪ�5ᄀ佳ਆ༟岍�│ᐖ۾Å؀䭳ꈆᜥ︔옆�猆ɋ؀▢ᐘ۾Ç؀䭳ꈆᤥ︔젆�猆ɋ؀▢ᐚ۾É؀䭳ꈆᬥ︔쨆�猆ɋ؀▢ᐜ۾Ì؀䭳ꈆᴥ︔촆�猆ɋ؀▢ᐞ۾Î؀䭳ꈆἥᐉ۾Ï؀䭳ꈆἥᐊ۾Ð؀䭳ꈆἥᐋ۾Ñ؀䭳ꈆἥᐌ۾Ò؀䭳ꈆἥᐍ۾Ó؀䭳ꈆἥᐎ۾Ë؀䭳ꈆ픨�ᰆ岍�│ᐖ۾Ä؀䭳ꈆᜥ︔숆�猆ɋ؀▢ᐘ۾Á؀䭳ꈆᤥ︔쀆�猆ɋ؀▢ᐚ۾¿؀䭳ꈆᬥ︔쌆�猆ɋ؀⢢×؀猆Ÿ਀㉽⠄Ô؀︆倆猆ä਀ጨ�⠫⬀픨�⠆Ö؀︆儆猆ä਀ጨ�⠫⬀휨�⨆�〛ĩ�6ᄀ猄ǃ؀猥¢਀꙯┆ᥳ�漊Ʈ؀猥7਀끯┆ꍳ�漊ǂ؀猥£਀뙯┆ꑳ�漊Ʋ؀猥£਀쁯┆㝳�漊ƺ؀猥£਀뱯┆ꉳ�漊ƪ؀猥£਀빯┆ꍳ�漊ƴ؀猥£਀롯┆ꉳ�漊Ƥ؀猥¢਀ꡯ┆ꕳ�漊Ƭ؀̆⠄½؀⠄I؀ШІ䭱�⠂ú؀혨�ਆଖᜫ܆ಚȈЃ䱯�稄�܀堗܋踆㉩ˣ焄KȀは�ᜆخ꙳�稊̂⠄¾؀ᜦ�稆ᘦ�ऀ*�摁���æ� �ñ��Ā��æ� �ò��Ā����ġ�ġ��Ā����ġ�Ģ��Ā〓ė�!ᄀ̨ਆ؆կ⠆;਀࠭漆ȅ؀ԫŲ�潰Ȇ؀؆ݯ⠆;਀࠭漆ȇ؀ԫŲ�潰Ȉ؀؆९⠆;਀࠭漆ȉ؀ԫŲ�潰Ȋ؀؆୯⠆;਀࠭漆ȋ؀ԫŲ�潰Ȍ؀漂ƚ؀ⴥ☄⬖⠈§਀︖Ⰲș驯؆९漆¨਀ج⠖©਀漂Ɯ؀ⴥ☄⬖⠈§਀︖Ⰲș鱯؆կ漆¨਀ج⠖©਀؃կ⠆Ǽ؀؃ݯ⠆Ǹ؀؃९⠆Ƕ؀؃୯⠆Ȁ؀*〛3�6ᄀ퐨�ਆଖᜫ܆ಚȈЃ䱯�稄�܀堗܋踆㉩៣�稆ᘦ�ऀ*㐁��ᤋĀĀ�ᨋ̀Ā��⬫ĀĀ��ⰫԀĀҾꨨ�⠊«਀ന⠆`਀┨�爆ΰ瀀≾�漊G਀⨆ц갨�漊­਀Ȩ⨆҆긨�漊¯਀끯�⠊ǰ؀⠄Ĕ؀⨆〓 –���縄ĴЀ␭퀖QĀ넨�퀊"Ȁ넨�⠊²਀댨�耊ĴЀ㑾笄´਀㑾縄ijЀ〭爖՗瀀퀔"Ȁ넨�ᜊ蒍�━ᘖ⠔µ਀⢢¶਀뜨�耊ijЀ㍾笄¸਀㍾⠄Ā؀륯�漊º਀⨆ц묨�漊¼਀﨨⨆вꬨ�⠊Ǭ؀*�〛Î�"ᄀꕳ�ਊਨ漆½਀⬋ሏ⠁¾਀،漈¿਀Ē쀨�ⴊ�ሎ︁☖�漛 ਀⣜ċ؀뵯�ଊ༫Ē븨�ഊआ뽯�ሊ⠁À਀ໞĒ᛾&ᬀ੯��猆NJ؀ГБట劍�━꿐�⠄਀έ�漊Dž؀Б漗lj؀Бጨ漆LJ؀Б뽯�Ȋ漆7؀ᠥ࠳̂⠄Å؀㌙猆¦਀⩺�ᰁ�ⴜ฀��F戜฀��ʆన漆8؀ᠥ࠳̂⠄Æ؀㌙猆¦਀⩺ʆᄨ漆9؀ᠥ࠳̂⠄Ç؀㌙猆¦਀⩺ʶ༨┆Эᐦԫନ�漫4؀ᠥ࠳̂⠄È؀㌙猆¦਀⩺ʆศ漆=؀ᠥ࠳̂⠄É؀㌙猆¦਀⩺ʆረ漆:؀ᠥ࠳̂⠄Ê؀㌙猆¦਀⩺Φ蹯ⰆȠĨ漆1؀ᠥ࠳̂⠄Ë؀㌙猆¦਀⩺〓9�#ᄀ漃Ɛ؀〬贗3Ȁᘥ魳�ꈆ耨�ਆ؂䅯�┆㌘ȈЃ차�ᤆس꙳�稊*�〓M�$ᄀ漃Ɔ؀䐬ᥳ�ਊ̆鹯⠆؀쉯�؊漃Ơ؀ന�漆Â਀؂㉯�┆㌘ȈЃ촨�ᤆس꙳�稊븪漃ƈ؀☬̂顯⠆‚؀㽯�┆㌘ȈЃ츨�ᤆس꙳�稊ꘪ漃Ɗ؀‬⠂ ؀㙯�┆㌘ȈЃ켨�ᤆس꙳�稊*〓¦�%ᄀ漃ƌ؀騹�猀‘؀؊漃ƞ؀遯�ἆ贌3Ȁᘥ蝳�ꈆᜥ詳�ꈆᠥ鑳�ꈆᤥꁳ�ꈆᨥꍳ�ꈆᬥ꙳�ꈆᰥ걳�ꈆᴥ꽳�ꈆḥ뉳�ꈆἥ猉†؀▢ਟ赳�ꈆἥ؋⢢€؀ȋ漇3؀ᠥ࠳̂⠄Ð؀㌙猆¦਀⩺ϖ陯ⰆȬ鸨�┆Эᐦԫన�漫5؀ᠥ࠳̂⠄Ñ؀㌙猆¦਀⩺Ϟ鑯ⰆȮ贗3Ȁᘥꭳ�ꈆ耨�漆@؀ᠥ࠳̂⠄Ò؀㌙猆¦਀⩺〓I���漃ƒ؀䀬⠂؀㭯�☆ᜂ㎍�│猖·؀⢢€؀㱯�☆ᜂ㎍�│猖º؀⢢€؀㹯�☆ᨪ੾�⨄Ȟ઀�⨄縚 ЀḪ耂 ЀḪ⠂Ü؀*〛j�7ᄀ⠂c਀ἂ贖aĀ퀥ěЀḨ�紊 Ѐṳਆ؂漃ė؀�紊Ѐ૞Ⰶ؆੯��Ȃဟ⠘à؀ཽ�Ȅἂᨸ�紆 Ѐἂ橤��⨆�ခ�$㠔਀��〛[�8ᄀਕ笂Ѐ榎夗ᘋ⬌Ȭၻ�ࠄ澚æ਀㩯�Њ�漊:਀�ⴊࠄ⬊ࠈ堗ࠌㄇې㌕ᐄ�Ȑ؃��ആמᐦ�ऀ*ခ���呔Ԁ Ā〛I�ᄀȃቻ�踄㉩ᐄ�и笂Ѐ較9Ȁ⥻�踄⽩ȕቻ�̄㦏�笂)Ѐ騄īਔ৞爦ᄘ瀀�؀*�ခ���㸾ऀ ĀȦቻ�踄⩩�〛Ѳ�9ᄀ笂Ѐ訃ᾑ䀍ϖ�̂ᥩᡘ�ᜆ奪੭ଖ笂Ѐ∬笂Ѐ榎ȋቼ�Ȅቻ�踄٩᝘⡘⬀ห؂堗㦍�紂Ѐఖ簸Ȁ椃堞᠈塚⠘à؀̍搟⹪ऄ堃ȍ椉�ጆȄ椉Б�☆ंБ४塙樗楘�ጆȅᄉ樄変᝘塪ᅩ⠅â؀दԑ४᝙塪ፘȆؑ⡩á؀ܓܑࠓᄂ椆ܑ�ጆᐉਓܑؑ奪樗ፘᘋఓ숸�ሀᄊᜌ⡘⬀ࠑ堗ഓᄂ⠍á؀ࠓ਑఑㞏�Ȃ഑ࠑ�紆%Ѐ਑఑㞏�ᄂᄊ輌7Ȁ╻�ἄ樉䌱਑఑㞏�笂%Ѐ�Ⰶᄗᄊ輌7Ȁ╻�ἄ樍ᡙ孪⸫਑఑㞏�笂%Ѐట奪樘⭛ȗ౻�ᄄᄊ輌7Ȁ╻�퐄溑⑽�ᄄᄋᄈ复塪樗ፘᄋᜌፘᄌᄋ㼉U￿਑ሹȀቻ�܄堈㦏�ᄂ踊赩QĀ⥽�ᘄณ጖㠏Ǟ�਑༑㞏�笂%Ѐट㹪Ŵ�਑༑㞏�笂%Ѐ�㨆Ą�笂 Ѐ樗嬳笂Ѐࠇ轘9Ȁ⥻�ᄄἏ贌RĀ퀥ĐЀḨ�猊਀渨�Ȋ๻�ᄄᄆ堉ฑ塪ᅩᄊ輏7Ȁ⑻�椄�ꈊㄸȀൻ�᠄㍪Ʉቻ�܄堈㦏�笂)Ѐ༑用�Ȋ๻�ᄄᄆ堉ฑ塪ᅩᄊ輏7Ȁ⑻�椄�ꈊ�Ȁൻ�ᤄ䁪Ö�笂Ѐࠇ轘9Ȁ⥻�ᄄ⠏ê਀笂Ѐؑऑᅘ樎楘਑༑㞏�笂$Ѐ潩é਀㢢’�笂Ѐࠇ轘9Ȁ⥻�ᄄἏ贌RĀ퀥ĐЀḨ�猊਀渨�Ȋ๻�ᄄᄆ堉ฑ塪ᅩᄊ輏7Ȁ⑻�椄�ꈊ㨫笂Ѐࠇ轘9Ȁ⥻�ᄄȏؑऑᅘ樎楘਑༑㞏�笂$Ѐ⡩à؀�ꈊฑ਑༑㞏�笂$Ѐ塩ณ༑堗༓༑਑榎夗ᔾ￾ࣿ堗ࠌ㸆ﱽ￿縫笂Ѐ訃ᮑ爳̂標楘⠘à؀樗浙ဓ጖⬑ȸ椃టᅘ᠑塚⠘à؀፭Ȓ̂ሑ塮ᩩ�ᜆ奪笂Ѐ⡚Ý؀ᄦᜑፘᄑᄑㄐ˂̂樞楘⠚à؀樗əཻ�娄��☆጗�☆጖�ᄀ⨓�᱁�����ѩ�ѩ�� Ā〛ю�:ᄀ笂Ѐ퐃ઑᬆമἆ㬍—�ⴸȀ椃堙⠘à؀樗浙ᘋГ堫̂Ὡ堌Б娘ᡘ�洆ԓἃ橤ᬳȂԑ⠚à؀樗əཻ�娄��⬆ȝ̂ԑ塮ᩩ�ᜆ奪笂Ѐ⡚Þ؀Б堗ГБㄇʣ̂ṩᩘ�ᜆ奪笂Ѐ⡚Þ؀鬸Ȁ椃堙⠘à؀樗ౙഖ笂Ѐ⌬笂Ѐ榎ȍᅼ�Ȅᅻ�踄ࡩ塩堗ᜨ�⬫ȑᜈ塪誺㢍�紂Ѐ樖ؓ㴸Ȁ椃堞ؑᡩ塚⠘à؀ܓἃ橤خܑ堃ܓᄂ椇�ጆȈܑᅩ⠈â؀Ȧܑࠑᅪ备᝘塪⡩á؀ओᄂᄇ樈ܑ塙樗楘ऑ�☆ܑऑᅪ备樗塘ਓᄂ椊�ጆᄋጋȌ਑ᅩ⠋â؀ഓ贛ˆĀณ጖⬏ᅪᜌፘȐထ�ጆᄌᄎȏထ఑�鼆ฑ༑ฑ༑ᾖ樉⠱ฑ༑⢖ã؀ฬฑ༑ᾖ樍ᡙ孪ᰫฑ༑ᾖ樌ᡙ孪ห笂 Ѐฑ༑풖溑ᆟᜏፘᄏᨏ鄱笂 Ѐ樗മ笂 Ѐ樘��Ȁൻ�ᜄ㍪ɑᅻ�ऄؑ塩㢏�ἂ贌RĀ퀥ĐЀḨ�猊਀渨�Ȋ๻�ᄄᄊ堍ฑ阖楘ฑ

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 12 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 18 IoCs
  • Suspicious use of SetThreadContext 22 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
    "C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1732
    • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
      C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
      2⤵
        PID:2220
      • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
        C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
        2⤵
          PID:2184
        • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
          C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
          2⤵
            PID:1748
          • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
            C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
            2⤵
              PID:1564
            • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
              C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
              2⤵
                PID:2856
              • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                2⤵
                  PID:2440
                • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                  C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                  2⤵
                    PID:2724
                  • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                    C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                    2⤵
                      PID:2600
                    • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                      C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                      2⤵
                        PID:2372
                      • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                        C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                        2⤵
                          PID:1348
                        • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                          C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                          2⤵
                            PID:2992
                          • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                            C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                            2⤵
                              PID:1312
                            • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                              C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                              2⤵
                                PID:1880
                              • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                2⤵
                                  PID:1884
                                • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                  C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                  2⤵
                                    PID:1628
                                  • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                    C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                    2⤵
                                      PID:1152
                                    • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                      C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                      2⤵
                                        PID:1804
                                      • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                        C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                        2⤵
                                          PID:1056
                                        • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                          C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                          2⤵
                                            PID:2320
                                          • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                            C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                            2⤵
                                              PID:1948
                                            • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                              C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                              2⤵
                                                PID:532
                                              • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                2⤵
                                                  PID:444
                                                • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                  C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                  2⤵
                                                    PID:836
                                                  • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                    C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                    2⤵
                                                      PID:2796
                                                    • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                      C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                      2⤵
                                                        PID:1084
                                                      • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                        C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                        2⤵
                                                          PID:760
                                                        • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                          C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                          2⤵
                                                            PID:2276
                                                          • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                            C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                            2⤵
                                                              PID:1684
                                                            • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                              C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                              2⤵
                                                                PID:2168
                                                              • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                2⤵
                                                                  PID:2840
                                                                • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                  C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                  2⤵
                                                                    PID:2776
                                                                  • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                    C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                    2⤵
                                                                      PID:2692
                                                                    • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                      C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                      2⤵
                                                                        PID:3016
                                                                      • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                        C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                        2⤵
                                                                          PID:1852
                                                                        • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                          C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                          2⤵
                                                                            PID:1876
                                                                          • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                            C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                            2⤵
                                                                              PID:1496
                                                                            • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                              C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                              2⤵
                                                                                PID:952
                                                                              • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                2⤵
                                                                                  PID:1052
                                                                                • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                  C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                  2⤵
                                                                                    PID:2296
                                                                                  • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                    C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                    2⤵
                                                                                      PID:2412
                                                                                    • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                      C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                      2⤵
                                                                                        PID:1812
                                                                                      • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                        C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                        2⤵
                                                                                          PID:1992
                                                                                        • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                          C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                          2⤵
                                                                                            PID:1404
                                                                                          • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                            C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                            2⤵
                                                                                              PID:2796
                                                                                            • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                              C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                              2⤵
                                                                                                PID:1200
                                                                                              • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                                C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                                2⤵
                                                                                                  PID:2984
                                                                                                • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                                  C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                                  2⤵
                                                                                                    PID:1184
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                                    C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                                    2⤵
                                                                                                      PID:936
                                                                                                    • C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                                      C:\Users\Admin\AppData\Local\Temp\005453fd6cf9cb6729231f920a3bb7d9.exe
                                                                                                      2⤵
                                                                                                        PID:2116

                                                                                                    Network

                                                                                                    MITRE ATT&CK Matrix

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    • memory/532-117-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/532-119-0x0000000004890000-0x00000000048D0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/532-147-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/532-159-0x0000000004890000-0x00000000048D0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/760-161-0x0000000004C10000-0x0000000004C50000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/760-192-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/760-160-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/836-175-0x00000000048B0000-0x00000000048F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/836-133-0x00000000048B0000-0x00000000048F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/836-131-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/836-162-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/952-260-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1084-146-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1084-188-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1084-191-0x00000000009F0000-0x0000000000A30000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/1152-116-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/1152-104-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1152-77-0x0000000004AA0000-0x0000000004AE0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/1152-75-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1564-27-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1564-28-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/1564-60-0x0000000004DA0000-0x0000000004DE0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/1564-57-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1684-189-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1684-190-0x0000000004C20000-0x0000000004C60000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/1684-220-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1732-1-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1732-2-0x0000000004A50000-0x0000000004A90000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/1732-0-0x00000000001A0000-0x0000000000242000-memory.dmp

                                                                                                      Filesize

                                                                                                      648KB

                                                                                                    • memory/1732-29-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1732-30-0x0000000004A50000-0x0000000004A90000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/1804-118-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1804-89-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1804-90-0x00000000005B0000-0x00000000005F0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/1876-245-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/1876-246-0x0000000004DB0000-0x0000000004DF0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2220-6-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/2220-42-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2220-5-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/2220-45-0x0000000004AF0000-0x0000000004B30000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2220-3-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/2220-4-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/2220-15-0x0000000004AF0000-0x0000000004B30000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2220-7-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                                                                      Filesize

                                                                                                      4KB

                                                                                                    • memory/2220-14-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2220-13-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/2220-11-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/2220-9-0x0000000000400000-0x0000000000422000-memory.dmp

                                                                                                      Filesize

                                                                                                      136KB

                                                                                                    • memory/2276-176-0x00000000046E0000-0x0000000004720000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2276-205-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2276-174-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2320-134-0x00000000048D0000-0x0000000004910000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2320-102-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2320-132-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2320-103-0x00000000048D0000-0x0000000004910000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2372-76-0x0000000004D70000-0x0000000004DB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2372-58-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2372-74-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2372-59-0x0000000004D70000-0x0000000004DB0000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2692-247-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2692-259-0x0000000004A40000-0x0000000004A80000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2692-218-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2692-219-0x0000000004A40000-0x0000000004A80000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2724-43-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2724-44-0x0000000004E00000-0x0000000004E40000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2724-62-0x0000000004E00000-0x0000000004E40000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2724-61-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2776-233-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/2776-206-0x00000000043E0000-0x0000000004420000-memory.dmp

                                                                                                      Filesize

                                                                                                      256KB

                                                                                                    • memory/2776-204-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/3016-232-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB

                                                                                                    • memory/3016-261-0x0000000074570000-0x0000000074C5E000-memory.dmp

                                                                                                      Filesize

                                                                                                      6.9MB