Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
193s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09/04/2024, 15:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
CyberSpike-Setup-V1.2.8.msi
Resource
win7-20240221-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral2
Sample
CyberSpike-Setup-V1.2.8.msi
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
300 seconds
General
-
Target
CyberSpike-Setup-V1.2.8.msi
-
Size
70.7MB
-
MD5
a1f44ab3a671c97af4be10ea09eac393
-
SHA1
d226a85cfa5b744e94e52abc9341173287c4104a
-
SHA256
ac14ef2a4ee7b383bad45efa5030034394876013c7258d179e5f1657eeff39bd
-
SHA512
092b3f17b3f75d402979535b10042eb29ad113eb3246c70f23f945d63da60cbaf2f117d6228543baa0c4fb5bdc3f80972ad88817a4bb2cc877e8007e71efa2e8
-
SSDEEP
1572864:sUJZMWWS8KaAkws3GmoAcHIhHEc2PsoNWL1eDj+0QV2qS/MdMC9NRNl5NS:h745AkwsFNEDnNIeH+LV2FsMCXN
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\W: msiexec.exe -
Drops file in Program Files directory 47 IoCs
description ioc Process File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\ProcessManager.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Stub\Load.exe msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Mimikatz.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\FileManager.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\System.Management.Automation.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Stub\Client.exe.config msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Keylogger.exe.config msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\HotPlugins\密码欺骗.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\RemoteCamera.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Options.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Extra.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Stub\Client.exe msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Regedit.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Logger.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\HotPlugins\AV杀手(驱动).dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Stub\Load.exe.config msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\CyberSpike.exe msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\HttpServerLib.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\SystemInfo.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\RunPlug_NET.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Microsoft.Management.Infrastructure.Native.dll msiexec.exe File opened for modification C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\System.Management.Automation.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\HotPlugins\虚拟化互斥.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Microsoft.Management.Infrastructure.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Fun.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\SendMemory.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Chat.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\RunPlug.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Information.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\CyberSpike.exe.config msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Miscellaneous.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Keylogger.exe msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Audio.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\x64\SQLite.Interop.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\NetworkManager.exe.config msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\browser.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\x86\SQLite.Interop.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Discord.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\ReverseProxy.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Netstat.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\MessagePackLib.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\SendFile.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\NetworkManager.exe msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Stub\Client.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\FileSearcher.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\RemoteDesktop.dll msiexec.exe File created C:\Program Files (x86)\CyberSpike Studio\CyberSpike\Plugins\Recovery.dll msiexec.exe -
Drops file in Windows directory 12 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\f764c1d.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI4CE9.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4C8A.tmp msiexec.exe File created C:\Windows\Installer\f764c1e.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI4D96.tmp msiexec.exe File created C:\Windows\Installer\f764c21.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\f764c1d.msi msiexec.exe File opened for modification C:\Windows\Installer\f764c1e.ipi msiexec.exe -
Loads dropped DLL 4 IoCs
pid Process 2036 MsiExec.exe 2036 MsiExec.exe 1008 MsiExec.exe 1008 MsiExec.exe -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2144 msiexec.exe 2144 msiexec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1956 msiexec.exe Token: SeIncreaseQuotaPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 2144 msiexec.exe Token: SeTakeOwnershipPrivilege 2144 msiexec.exe Token: SeSecurityPrivilege 2144 msiexec.exe Token: SeCreateTokenPrivilege 1956 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1956 msiexec.exe Token: SeLockMemoryPrivilege 1956 msiexec.exe Token: SeIncreaseQuotaPrivilege 1956 msiexec.exe Token: SeMachineAccountPrivilege 1956 msiexec.exe Token: SeTcbPrivilege 1956 msiexec.exe Token: SeSecurityPrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeLoadDriverPrivilege 1956 msiexec.exe Token: SeSystemProfilePrivilege 1956 msiexec.exe Token: SeSystemtimePrivilege 1956 msiexec.exe Token: SeProfSingleProcessPrivilege 1956 msiexec.exe Token: SeIncBasePriorityPrivilege 1956 msiexec.exe Token: SeCreatePagefilePrivilege 1956 msiexec.exe Token: SeCreatePermanentPrivilege 1956 msiexec.exe Token: SeBackupPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeShutdownPrivilege 1956 msiexec.exe Token: SeDebugPrivilege 1956 msiexec.exe Token: SeAuditPrivilege 1956 msiexec.exe Token: SeSystemEnvironmentPrivilege 1956 msiexec.exe Token: SeChangeNotifyPrivilege 1956 msiexec.exe Token: SeRemoteShutdownPrivilege 1956 msiexec.exe Token: SeUndockPrivilege 1956 msiexec.exe Token: SeSyncAgentPrivilege 1956 msiexec.exe Token: SeEnableDelegationPrivilege 1956 msiexec.exe Token: SeManageVolumePrivilege 1956 msiexec.exe Token: SeImpersonatePrivilege 1956 msiexec.exe Token: SeCreateGlobalPrivilege 1956 msiexec.exe Token: SeCreateTokenPrivilege 1956 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1956 msiexec.exe Token: SeLockMemoryPrivilege 1956 msiexec.exe Token: SeIncreaseQuotaPrivilege 1956 msiexec.exe Token: SeMachineAccountPrivilege 1956 msiexec.exe Token: SeTcbPrivilege 1956 msiexec.exe Token: SeSecurityPrivilege 1956 msiexec.exe Token: SeTakeOwnershipPrivilege 1956 msiexec.exe Token: SeLoadDriverPrivilege 1956 msiexec.exe Token: SeSystemProfilePrivilege 1956 msiexec.exe Token: SeSystemtimePrivilege 1956 msiexec.exe Token: SeProfSingleProcessPrivilege 1956 msiexec.exe Token: SeIncBasePriorityPrivilege 1956 msiexec.exe Token: SeCreatePagefilePrivilege 1956 msiexec.exe Token: SeCreatePermanentPrivilege 1956 msiexec.exe Token: SeBackupPrivilege 1956 msiexec.exe Token: SeRestorePrivilege 1956 msiexec.exe Token: SeShutdownPrivilege 1956 msiexec.exe Token: SeDebugPrivilege 1956 msiexec.exe Token: SeAuditPrivilege 1956 msiexec.exe Token: SeSystemEnvironmentPrivilege 1956 msiexec.exe Token: SeChangeNotifyPrivilege 1956 msiexec.exe Token: SeRemoteShutdownPrivilege 1956 msiexec.exe Token: SeUndockPrivilege 1956 msiexec.exe Token: SeSyncAgentPrivilege 1956 msiexec.exe Token: SeEnableDelegationPrivilege 1956 msiexec.exe Token: SeManageVolumePrivilege 1956 msiexec.exe Token: SeImpersonatePrivilege 1956 msiexec.exe Token: SeCreateGlobalPrivilege 1956 msiexec.exe Token: SeCreateTokenPrivilege 1956 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1956 msiexec.exe 1956 msiexec.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2036 2144 msiexec.exe 29 PID 2144 wrote to memory of 2036 2144 msiexec.exe 29 PID 2144 wrote to memory of 2036 2144 msiexec.exe 29 PID 2144 wrote to memory of 2036 2144 msiexec.exe 29 PID 2144 wrote to memory of 2036 2144 msiexec.exe 29 PID 2144 wrote to memory of 2036 2144 msiexec.exe 29 PID 2144 wrote to memory of 2036 2144 msiexec.exe 29 PID 2144 wrote to memory of 1008 2144 msiexec.exe 33 PID 2144 wrote to memory of 1008 2144 msiexec.exe 33 PID 2144 wrote to memory of 1008 2144 msiexec.exe 33 PID 2144 wrote to memory of 1008 2144 msiexec.exe 33 PID 2144 wrote to memory of 1008 2144 msiexec.exe 33 PID 2144 wrote to memory of 1008 2144 msiexec.exe 33 PID 2144 wrote to memory of 1008 2144 msiexec.exe 33 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\CyberSpike-Setup-V1.2.8.msi1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1956
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 85E132D04D5CB9DC5F59DBB6B84200C9 C2⤵
- Loads dropped DLL
PID:2036
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 9652C2F417DBC047275E08C718A88CB62⤵
- Loads dropped DLL
PID:1008
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:2592
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005A8" "0000000000000574"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
32KB
MD5c11cd1113d3d22ae7aba91854c49bf2e
SHA1f8f74dff649eebb7741ed0801ac77efbea491d64
SHA256eeb714b0647802cb0dfbb444dd0ed6f02046bfe8e85821e69b3e5343f0fabd9b
SHA512b350fd97a45fcb83bc1009df471a456181b5a292ddce18365fb8049b4b8a61b7a8e7f353a66e2b86a642880ae88033d1797b5243ff97f1d0606c47a18af94005
-
Filesize
6.1MB
MD54e83c528d307d3b5da2aed5abbe3ffe8
SHA12e84ceccecb30378f84be898711f15b4e157e045
SHA2560208b783efaf3854f07a31f9bcbb46f9afcd80b12e2ddb8001a9faeccfc2d0f0
SHA512378f75db718891fd214776d7d5a2bad0c493dcf5c4413308554d2fe3283170aef55de1ff4bdbc0d417e5bef4f6acd3370c48bb33c37f360a606baeff12e6f72a
-
Filesize
285KB
MD5b77a2a2768b9cc78a71bbffb9812b978
SHA1b70e27eb446fe1c3bc8ea03dabbee2739a782e04
SHA256f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
SHA512a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
-
C:\Users\Admin\AppData\Roaming\Microsoft\Installer\{003B9766-E418-4C8D-9945-7D37225CAD95}\_57A0FCAA677BC563120477.exe
Filesize66KB
MD504525535dd0b6a0206afe4fb3fa5c829
SHA1c4829cca26792a27811980bdb1223b924b6e90b0
SHA256bac4051d19a839ada5493c61aad6809fa585c9165da1067053bc5932efead0b7
SHA512f8417d3f873119a2f7578c79988f293e44c6778c9d7037f875e3f1460a376ae2a964b92a8102ebc28f0d9beab1a4a785756db59955d236fb362ba40310deba6f
-
Filesize
70.7MB
MD5a1f44ab3a671c97af4be10ea09eac393
SHA1d226a85cfa5b744e94e52abc9341173287c4104a
SHA256ac14ef2a4ee7b383bad45efa5030034394876013c7258d179e5f1657eeff39bd
SHA512092b3f17b3f75d402979535b10042eb29ad113eb3246c70f23f945d63da60cbaf2f117d6228543baa0c4fb5bdc3f80972ad88817a4bb2cc877e8007e71efa2e8