Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 12:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe
-
Size
56KB
-
MD5
086481522ddd73d2511991cb48f92078
-
SHA1
69faca9c790519234f3b6509b0528531175319f4
-
SHA256
c53eff8e80c2e3ab0d228a3905e846200869fb57d83e10eee0b4f08d167ce397
-
SHA512
8bb0681980701bb9ae02cb606ef0bb5e7d862beb4313994a81ceddeaaf97843d992c33c4b700ad4c844deae99d6854d930c515b3eb4013bdecf9c7c93eb402f3
-
SSDEEP
1536:OHK+ZHaTXNZOxpZTy1IsTTm84rzr1YM9FoIv3:OHpRaT+plyGsTTl61HPv3
Score
9/10
Malware Config
Signatures
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
resource yara_rule behavioral2/memory/2976-98-0x0000000002480000-0x00000000026AB000-memory.dmp INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000900000002313b-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe -
resource yara_rule behavioral2/memory/2976-5-0x0000000075000000-0x0000000075007000-memory.dmp upx behavioral2/files/0x000900000002313b-2.dat upx behavioral2/memory/2976-97-0x0000000075000000-0x0000000075007000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\kggyb = "C:\\Windows\\system32\\zxlhdrhtymfn.exe" faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\zxlhdrhtymfn.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Windows\SysWOW64\zxlhdrhtymfn.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Windows\SysWOW64\qwer.dll faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\qbkcxc.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\qshlb.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\bolwzi.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\Stationery\unovzsoxblmj.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\incb.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\yorlooolmd.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\TagAlbumDefinitions\brar.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Common.View.UWP\Strings\tr-TR\zxswpqtkwqvug.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\xbqrzglyjl.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\th-TH\ypqvccbvmobo.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\VideoLAN\VLC\plugins\kmlmyq.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\AppxMetadata\sbouywguaoz.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\qagqobqjs.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\fi-FI\pcchfb.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\bqxejbtlhjz.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\zh-Hans\qbvngrui.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\pl-PL\eejlcy.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\vqxejuntzc.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\zzrst.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\HWRCustomization\jvljwmokppqsq.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ru\qlwjjeifk.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\VC\ywecgpcxw.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Car\LTR\contrast-black\dypcjntlm.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\ywdva.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\font\giiutbbmvqoe.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\gsnzbsxte.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ja\ttvpc.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\obvyfryfa.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\ko\kgbklzjgwtoly.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\sxoczmiyorh.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-black\mircttsmtxiq.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\es-MX\czmkphgpmxhtz.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\kcurh.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\OpenSSL64.DllA\tzmjx.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\khfqjz.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert\ijvpxzcxdyymo.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\de\lwdghdeptuhuw.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\VideoLAN\VLC\locale\or\awgewpi.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\zbiwaw.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\ar-SA\ngzdsinxuvmti.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\nl-NL\bpnewotzxsye.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\fbmtvdncmem.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\bckfwqbu.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\VideoLAN\VLC\lua\meta\art\mwnorwaa.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\lkvicqkmzlgx.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.1813.0_neutral_~_8wekyb3d8bbwe\npdjpvpiz.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Transit\contrast-white\thhc.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\it-IT\ncha.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\iujtsex.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\rvvcl.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\bghxsf.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\de\hotiaxhphtg.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hans\fkxed.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\en-GB\uqnf.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\ko\rwcgj.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\bg-BG\mwbmflpx.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\jttxmjx.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Web Server Extensions\16\BIN\qffjoswma.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_neutral_split.scale-125_8wekyb3d8bbwe\microsoft.system.package.metadata\lulrgs.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\da-DK\qazqk.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\cyexidkf.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\pnewcnsxxrqy.exe faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\bsawshduyzw.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe File created C:\Program Files\Microsoft Office\root\Office16\Library\kcdrnw.zip faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe 2976 faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe"C:\Users\Admin\AppData\Local\Temp\faf25f11e3858dc03740926be99dd233021a86132d562a48d79c830598b7a858.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:2976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5086481522ddd73d2511991cb48f92078
SHA169faca9c790519234f3b6509b0528531175319f4
SHA256c53eff8e80c2e3ab0d228a3905e846200869fb57d83e10eee0b4f08d167ce397
SHA5128bb0681980701bb9ae02cb606ef0bb5e7d862beb4313994a81ceddeaaf97843d992c33c4b700ad4c844deae99d6854d930c515b3eb4013bdecf9c7c93eb402f3
-
Filesize
8KB
MD5da48a048a2767c21bff388f681a58853
SHA133f19a2a90a88c0a5ec7ccf8cfe79316d89dbfd5
SHA2565003d4c24b0f55520e6cd2c3894a60a73d505ff55cd9f495eef40245c4027ad7
SHA512faa1b76740b5b3db6f98143916960d25efd0fcd1f190b566e5d97143b95e75ce8ecaa6a1c13f377d6a1900bbc3b6eee055bac19ec9767ef82a75f03acd0e06cf