Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25-04-2024 06:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe
Resource
win7-20240220-en
windows7-x64
11 signatures
150 seconds
General
-
Target
cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe
-
Size
577KB
-
MD5
cd0da8079d030260e29eb9bc8dbe4f34
-
SHA1
0e5f49eb2a9a598947488406233dfaa7decb4729
-
SHA256
cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b
-
SHA512
f1c872e107ff95b920a4c6f4b3ae005e4ee4d8acb89f95ae371a8d7d829c857845dc7eb29cd3dad10770e1b292f2852b43e728972bcfc29004ccd762a9c66f38
-
SSDEEP
6144:Sf46tGdye419E7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQC:+3NbI7a3iwbihym2g7XO3LWUQfh4Co
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Logo1_.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\_desktop.ini Logo1_.exe -
Executes dropped EXE 2 IoCs
pid Process 2860 Logo1_.exe 228 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: Logo1_.exe File opened (read-only) \??\Z: Logo1_.exe File opened (read-only) \??\Y: Logo1_.exe File opened (read-only) \??\V: Logo1_.exe File opened (read-only) \??\Q: Logo1_.exe File opened (read-only) \??\L: Logo1_.exe File opened (read-only) \??\T: Logo1_.exe File opened (read-only) \??\M: Logo1_.exe File opened (read-only) \??\J: Logo1_.exe File opened (read-only) \??\G: Logo1_.exe File opened (read-only) \??\U: Logo1_.exe File opened (read-only) \??\S: Logo1_.exe File opened (read-only) \??\P: Logo1_.exe File opened (read-only) \??\K: Logo1_.exe File opened (read-only) \??\H: Logo1_.exe File opened (read-only) \??\E: Logo1_.exe File opened (read-only) \??\X: Logo1_.exe File opened (read-only) \??\W: Logo1_.exe File opened (read-only) \??\R: Logo1_.exe File opened (read-only) \??\O: Logo1_.exe File opened (read-only) \??\N: Logo1_.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia\MPP\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sl-sl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\_desktop.ini Logo1_.exe File created C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\pt-br\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\ar-ae\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sk-sk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\he-il\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SPRING\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft.NET\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ko-kr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ko-kr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\pt-br\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ja\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\uk-UA\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fi-fi\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\EBWebView\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagement\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\ms\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zh_CN\LC_MESSAGES\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account-select\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\da-dk\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe Logo1_.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe Logo1_.exe File created C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example1.Diagnostics\Diagnostics\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\files\dev\cef\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\pl-pl\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\zh-cn\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\ink\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Microsoft.NET\RedistList\_desktop.ini Logo1_.exe File created C:\Program Files\Mozilla Firefox\defaults\_desktop.ini Logo1_.exe File created C:\Program Files\VideoLAN\VLC\locale\or_IN\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\fr-fr\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\en-ae\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Common Files\Adobe\Reader\DC\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\nl-nl\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\_desktop.ini Logo1_.exe File created C:\Program Files\dotnet\host\fxr\_desktop.ini Logo1_.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\pages-app\js\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example2.Diagnostics\1.0.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\Modules\Example3.Diagnostics\1.1.1\Diagnostics\Simple\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\fr-fr\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Adobe\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\css\_desktop.ini Logo1_.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ca-es\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\SupplementalDictionaries\en_GB\_desktop.ini Logo1_.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\_desktop.ini Logo1_.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\rundl132.exe cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe File created C:\Windows\Logo1_.exe cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe File opened for modification C:\Windows\rundl132.exe Logo1_.exe File created C:\Windows\Dll.dll Logo1_.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe 2860 Logo1_.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 716 wrote to memory of 2472 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 85 PID 716 wrote to memory of 2472 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 85 PID 716 wrote to memory of 2472 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 85 PID 2472 wrote to memory of 3596 2472 net.exe 87 PID 2472 wrote to memory of 3596 2472 net.exe 87 PID 2472 wrote to memory of 3596 2472 net.exe 87 PID 716 wrote to memory of 2500 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 92 PID 716 wrote to memory of 2500 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 92 PID 716 wrote to memory of 2500 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 92 PID 716 wrote to memory of 2860 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 93 PID 716 wrote to memory of 2860 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 93 PID 716 wrote to memory of 2860 716 cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe 93 PID 2860 wrote to memory of 4928 2860 Logo1_.exe 95 PID 2860 wrote to memory of 4928 2860 Logo1_.exe 95 PID 2860 wrote to memory of 4928 2860 Logo1_.exe 95 PID 4928 wrote to memory of 4716 4928 net.exe 97 PID 4928 wrote to memory of 4716 4928 net.exe 97 PID 4928 wrote to memory of 4716 4928 net.exe 97 PID 2500 wrote to memory of 228 2500 cmd.exe 98 PID 2500 wrote to memory of 228 2500 cmd.exe 98 PID 2860 wrote to memory of 2460 2860 Logo1_.exe 99 PID 2860 wrote to memory of 2460 2860 Logo1_.exe 99 PID 2860 wrote to memory of 2460 2860 Logo1_.exe 99 PID 2460 wrote to memory of 4828 2460 net.exe 101 PID 2460 wrote to memory of 4828 2460 net.exe 101 PID 2460 wrote to memory of 4828 2460 net.exe 101 PID 2860 wrote to memory of 3504 2860 Logo1_.exe 57 PID 2860 wrote to memory of 3504 2860 Logo1_.exe 57
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3504
-
C:\Users\Admin\AppData\Local\Temp\cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe"C:\Users\Admin\AppData\Local\Temp\cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe"2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"3⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"4⤵PID:3596
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a398E.bat3⤵
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Users\Admin\AppData\Local\Temp\cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe"C:\Users\Admin\AppData\Local\Temp\cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe"4⤵
- Executes dropped EXE
PID:228
-
-
-
C:\Windows\Logo1_.exeC:\Windows\Logo1_.exe3⤵
- Drops file in Drivers directory
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2860 -
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4716
-
-
-
C:\Windows\SysWOW64\net.exenet stop "Kingsoft AntiVirus Service"4⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"5⤵PID:4828
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
258KB
MD582db094480878229391119e2daa623da
SHA1e51a3eeef5a340d4854f95d321a0f7bbf2bb151b
SHA2568e5056345931b7919fa3b3b7d46b10e8ec8e4188ffa6da28a62325061ea139a6
SHA512cc4d27f0d7618e07cf4496b7f6ec554a557a8c9944986a383ce003c78963013101a1f7449632cdf8669dd17269a743ab49250a46eed8f78dfc7db363d8eecee3
-
Filesize
577KB
MD5cd0da8079d030260e29eb9bc8dbe4f34
SHA10e5f49eb2a9a598947488406233dfaa7decb4729
SHA256cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b
SHA512f1c872e107ff95b920a4c6f4b3ae005e4ee4d8acb89f95ae371a8d7d829c857845dc7eb29cd3dad10770e1b292f2852b43e728972bcfc29004ccd762a9c66f38
-
C:\ProgramData\Package Cache\{63880b41-04fc-4f9b-92c4-4455c255eb8c}\windowsdesktop-runtime-8.0.2-win-x64.exe
Filesize644KB
MD551c1eb02821359551eae62ff451ccbb4
SHA1917e11eb8a26a033a330a9cee5c5207d0da1109a
SHA2569afbb3fd781ea931d8bc856c768fe7af7e440e9f7a29950b5dca44593f0ef04f
SHA512062f0c32d3d9b46fc670512a818c88919bcc90a2f7f5bd4910f917a96c42527fd6c28117c366cb66cd6bfa3ec64f5a43aadcaa4bdad01c8d45eb2bfe2c85f5ee
-
Filesize
722B
MD5a36cd2cb7298de598000644e7dffbdbb
SHA100b9f009645856c44cb7c3105a91474523dabcc3
SHA256d7248eb833762aa02ae160be1a1ffddf4e4d2f822c003179bb1b41cf0083448f
SHA5121d62556dec0f069ea9d1015c7942a45bb810498d9e179fba54ff8a8011a3f42e54f3c5acf026b0d883dd93fe2ced787ad88e7f3025a01108373fc5e0c328c2aa
-
C:\Users\Admin\AppData\Local\Temp\cf5203aaf7334124db34e06d07bc8774ccb27e3dc727b664f4b831c821812a2b.exe.exe
Filesize544KB
MD59a1dd1d96481d61934dcc2d568971d06
SHA1f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA2568cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
SHA5127ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
-
Filesize
33KB
MD5beb8ef622f9b59e1fbe24c77c2a4d0c2
SHA11d1560dd34ca71ecf721711b91b81cc3ceff0469
SHA256a13c71d4050c4b76a86757d3d3dec5a0f3d5ebf1de2979a5d5b74fcd60f23ed1
SHA512e06c0219fbe6df369a21aae4b16b6f14a261b5416bf6543b096382f8fa80a3a60b5f2793b3c818238a345a960ae315c288e3d378e83fef05817ba2ef58843532
-
Filesize
842B
MD56f4adf207ef402d9ef40c6aa52ffd245
SHA14b05b495619c643f02e278dede8f5b1392555a57
SHA256d9704dab05e988be3e5e7b7c020bb9814906d11bb9c31ad80d4ed1316f6bc94e
SHA512a6306bd200a26ea78192ae5b00cc49cfab3fba025fe7233709a4e62db0f9ed60030dce22b34afe57aad86a098c9a8c44e080cedc43227cb87ef4690baec35b47
-
Filesize
9B
MD57ef570b2b21e58fd906ef1a980d64425
SHA118502489f652e74f8972bbfa100d5c163d719ab7
SHA256c3ce1b9216b58ac7d9ed3b93e5e3a1d6a2473b53b5bc1f008a621def49517055
SHA512e1175d861a79d62b85cd18661375f1c956dcc97e958765dc225f3aa4b0f0100ca9e17b9c61f5e18fc2a96e5167c0563f60645033aff1be1ec2f372c1b9a8b35f