dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d

Analysis

max time kernel
102s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01/01/2024, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
Size

26KB
MD5

f5041293575c09a72717639c8f9f4830
SHA1

b42d5154949e4e6cb6a80eb23653b3b410e86fc1
SHA256

dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d
SHA512

364b7c634d1651ea3881a314eb6e83994c9fcaaa4985335b50ce43da70b8357cb02d8c8992bb88e5f45dde34f5a287576b7fee3fae2b771e30fd048a5ee31d51
SSDEEP

768:tb1ODKAaDMG8H92RwZNQSwcfymNBg+g61GoGwXnKx:HfgLdQAQfcfymNG+Kx

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\X:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\T:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\S:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\L:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\K:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\J:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\I:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\U:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\R:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\O:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\G:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\Z:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\V:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\Q:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\E:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\Y:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\W:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\P:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\N:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened (read-only)	\??\M:	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jsadebugd.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\DVD Maker\en-US\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\7-Zip\Lang\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\DVD Maker\it-IT\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmiregistry.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\7-Zip\Lang\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\_platform_specific\win_x64\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\applet\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\javap.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\include\win32\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\default_apps\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\DVD Maker\de-DE\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\cmm\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\jmc.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\DVD Maker\en-US\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\DVD Maker\fr-FR\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Extensions\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Indiana\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\_desktop.ini	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\rundl132.exe	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 2056	1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe	28
PID 1488 wrote to memory of 2056	1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe	28
PID 1488 wrote to memory of 2056	1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe	28
PID 1488 wrote to memory of 2056	1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe	28
PID 2056 wrote to memory of 2668	2056	net.exe	30
PID 2056 wrote to memory of 2668	2056	net.exe	30
PID 2056 wrote to memory of 2668	2056	net.exe	30
PID 2056 wrote to memory of 2668	2056	net.exe	30
PID 1488 wrote to memory of 1252	1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe	12
PID 1488 wrote to memory of 1252	1488	dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe	12

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1252
- C:\Users\Admin\AppData\Local\Temp\dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe
  "C:\Users\Admin\AppData\Local\Temp\dcdab50960b0892057ac59e8ea946c30a2e4ec4b881f8d6ecc8d869c91d7bf8d.exe"
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\SysWOW64\net.exe
    net stop "Kingsoft AntiVirus Service"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
      4⤵
      PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe

Filesize
13KB

MD5
789220d59a1acb9e5d1478ce21538c91

SHA1
6a1ae74b5ea7480c0fd8f3321744fae6313e7916

SHA256
0e6c4b1582e8201f051e8f257246cda17bfa8b60c40985eba7940ba2add2b0e0

SHA512
f0d31facefbdbf439d7d8805abb9805d43e7f3ce289af44baf8b955598dc152ba4481e69a5e4e8591aa912ab29bea3c28255a23612e281fe51cde51fd24a572c

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
218KB

MD5
fce783b9733e6d0cf0b333128c8bb0b7

SHA1
264434318ce54deeba2c23d81430920b354d544c

SHA256
3f3e448501bcef9b7004fa1446e6d4b094dab43fae7ad961fc542df5267890c4

SHA512
187f96b689f9c0182ca3fb53a5451efe2efd91c6231634c0d6739137a70a603d96075a5996f455864fc8757e8a86e1223c748438bc190f495525eedf427b85f8

Download Submit
C:\ProgramData\Package Cache\{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}\vcredist_x64.exe

Filesize
82KB

MD5
e4cb153acc9ca6c1c87fcb000a271ecb

SHA1
9a4aca2b10c2e77f2be22b0a8b2c5d0908a02582

SHA256
7ba121b2064eb4c75a67b97db838b6874192d9fb61b55387696fefe30aae4c4a

SHA512
8258327ff3bd968a84a788baebdbae75cd4b598fa0853af75bfac959a22bb1f49ce159a7aa5f383d19aa5d39c3c06e6a11ffc95d0c7b7986c3e21098411aa4af

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-928733405-3780110381-2966456290-1000\_desktop.ini

Filesize
8B

MD5
6b797c0366c2ec714ca2989daf0254d4

SHA1
b59a115d157050eb74929670d9f566df66f3d823

SHA256
d63bfce395f8546df44b15e24a240ececabb89b6932cc8317ca02fe64972fa2e

SHA512
3205080a6fcf42e6ee4c4229af097de16133649325755e0c3c876fe03068848e47bcba20934bd42f474e08d1535bbed35f3bd995c73e661be363fdcfe6719bde

Download Submit
memory/1252-5-0x0000000002950000-0x0000000002951000-memory.dmp

Filesize
4KB

Download
memory/1488-66-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-0-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-72-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-20-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-165-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-1825-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-14-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-3285-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1488-7-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download