Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
08/06/2024, 20:07
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe
Resource
win7-20240508-en
General
-
Target
2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe
-
Size
10.1MB
-
MD5
334e8d84ca45749879312c751ae88ab3
-
SHA1
be93f412d63842f6d573e610e8819f1563fe1a8d
-
SHA256
6acc7eb046aeef6f49040284e9fbf59637c5bc074bd56f22106f67d07a7686b7
-
SHA512
3aa0db5677201ab179dc6cf57628cf01e90696bc8d33224f2ae743b50af49e3eb9f5edf2f5fed0789cbefd26c9c033b58e6bae1b5e2a372b83196d06434a9261
-
SSDEEP
196608:Zdad4T0xcsSB5orrcbSsi0s/lmPJ7N3VvXWrqufezvq:vadCoXrlAJ7N3pXW2uGzy
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 2468 lite_installer.exe 1344 seederexe.exe 4132 sender.exe -
Loads dropped DLL 13 IoCs
pid Process 1724 MsiExec.exe 1724 MsiExec.exe 1724 MsiExec.exe 1724 MsiExec.exe 1724 MsiExec.exe 1724 MsiExec.exe 1724 MsiExec.exe 1724 MsiExec.exe 1724 MsiExec.exe 1724 MsiExec.exe 1724 MsiExec.exe 1724 MsiExec.exe 1344 seederexe.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Blocklisted process makes network request 1 IoCs
flow pid Process 6 1960 msiexec.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\K: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\L: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\Z: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\E: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\H: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\W: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\Y: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\B: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\X: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\M: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\P: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\Q: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\R: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\I: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\O: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\S: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\T: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe File opened (read-only) \??\N: 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe -
Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\Installer\f761d41.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2128.tmp msiexec.exe File created C:\Windows\Installer\f761d42.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI234F.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2290.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2270.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI22B1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI25FF.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI263E.tmp msiexec.exe File created C:\Windows\Installer\f761d41.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI205B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI20E8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI22F0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI23BD.tmp msiexec.exe File opened for modification C:\Windows\Installer\f761d42.ipi msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\Main seederexe.exe Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Internet Explorer\SearchScopes seederexe.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Set value (data) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe 1960 msiexec.exe 1960 msiexec.exe 2468 lite_installer.exe 2468 lite_installer.exe 2468 lite_installer.exe 2468 lite_installer.exe 1344 seederexe.exe 4132 sender.exe 4132 sender.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeIncreaseQuotaPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeSecurityPrivilege 1960 msiexec.exe Token: SeCreateTokenPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeAssignPrimaryTokenPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeLockMemoryPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeIncreaseQuotaPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeMachineAccountPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeTcbPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeSecurityPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeTakeOwnershipPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeLoadDriverPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeSystemProfilePrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeSystemtimePrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeProfSingleProcessPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeIncBasePriorityPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeCreatePagefilePrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeCreatePermanentPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeBackupPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeRestorePrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeShutdownPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeDebugPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeAuditPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeSystemEnvironmentPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeChangeNotifyPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeRemoteShutdownPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeUndockPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeSyncAgentPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeEnableDelegationPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeManageVolumePrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeImpersonatePrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeCreateGlobalPrivilege 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe Token: SeRestorePrivilege 1960 msiexec.exe Token: SeTakeOwnershipPrivilege 1960 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe 2412 2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1960 wrote to memory of 1724 1960 msiexec.exe 29 PID 1960 wrote to memory of 1724 1960 msiexec.exe 29 PID 1960 wrote to memory of 1724 1960 msiexec.exe 29 PID 1960 wrote to memory of 1724 1960 msiexec.exe 29 PID 1960 wrote to memory of 1724 1960 msiexec.exe 29 PID 1960 wrote to memory of 1724 1960 msiexec.exe 29 PID 1960 wrote to memory of 1724 1960 msiexec.exe 29 PID 1724 wrote to memory of 2468 1724 MsiExec.exe 30 PID 1724 wrote to memory of 2468 1724 MsiExec.exe 30 PID 1724 wrote to memory of 2468 1724 MsiExec.exe 30 PID 1724 wrote to memory of 2468 1724 MsiExec.exe 30 PID 1724 wrote to memory of 2468 1724 MsiExec.exe 30 PID 1724 wrote to memory of 2468 1724 MsiExec.exe 30 PID 1724 wrote to memory of 2468 1724 MsiExec.exe 30 PID 1724 wrote to memory of 1344 1724 MsiExec.exe 31 PID 1724 wrote to memory of 1344 1724 MsiExec.exe 31 PID 1724 wrote to memory of 1344 1724 MsiExec.exe 31 PID 1724 wrote to memory of 1344 1724 MsiExec.exe 31 PID 1344 wrote to memory of 4132 1344 seederexe.exe 32 PID 1344 wrote to memory of 4132 1344 seederexe.exe 32 PID 1344 wrote to memory of 4132 1344 seederexe.exe 32 PID 1344 wrote to memory of 4132 1344 seederexe.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-08_334e8d84ca45749879312c751ae88ab3_magniber.exe"1⤵
- Enumerates connected drives
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2412
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A7C986C1ADF8FC3CDF03A5A4CB7456162⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\Temp\0A4380EF-8D79-416E-A5B7-B96473784AD0\lite_installer.exe"C:\Users\Admin\AppData\Local\Temp\0A4380EF-8D79-416E-A5B7-B96473784AD0\lite_installer.exe" --use-user-default-locale --silent --cumtom-welcome-page=https://browser.yandex.ru/promo/welcome_com/5/3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2468
-
-
C:\Users\Admin\AppData\Local\Temp\DE3E87C6-F1F8-463B-8A24-AA842EAFA284\seederexe.exe"C:\Users\Admin\AppData\Local\Temp\DE3E87C6-F1F8-463B-8A24-AA842EAFA284\seederexe.exe" "--yqs=" "--yhp=" "--ilight=" "--oem=" "--nopin=n" "--pin_custom=n" "--pin_desktop=n" "--pin_taskbar=y" "--locale=us" "--browser=" "--browser_default=" "--loglevel=trace" "--ess=" "--clids=C:\Users\Admin\AppData\Local\Temp\clids-yasearch.xml" "--sender=C:\Users\Admin\AppData\Local\Temp\3407065A-9269-4BD0-B9FB-636029EF0123\sender.exe" "--is_elevated=yes" "--ui_level=5" "--good_token=x" "--no_opera=n"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Users\Admin\AppData\Local\Temp\3407065A-9269-4BD0-B9FB-636029EF0123\sender.exeC:\Users\Admin\AppData\Local\Temp\3407065A-9269-4BD0-B9FB-636029EF0123\sender.exe --send "/status.xml?clid=3762839&uuid=ae40f731-C824-4D23-80B5-EC51C428f9e7&vnt=Windows 7x64&file-no=6%0A15%0A25%0A45%0A57%0A59%0A111%0A125%0A129%0A"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4132
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
575B
MD5c22da0256e10b754ef131989aef35670
SHA1955fc88a69b4608ba72eadb4ebfc5a0b4b375798
SHA256da46696ad996fbe5030f3c0d820aadab608a91de6d35686194084084c888c31a
SHA512b95828087f57129b22182b5485fbd7a7968cd19b5a96e076e3075ae1609fbb69e7a55400b268c56a8ef1fbcfc7b096735745c6f3306a0fd2dedeab25ccba0282
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD55398652103348c1b30cfb2167f556d8d
SHA1e02188e7c3fe976d65a04fccbcd4f550275832cd
SHA256ce884b127c423086517ca9edc7501ffe9d33fd32e093b5cd87956b35589afe34
SHA512439f729ed4e257d582c7be1287122853a6aec8e795b66d896bbeff57a3507df8e60144b32d7a2687f77d0ddc3123a7f560bc38016e12285ba50441388e591d55
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
41.3MB
MD51d6cfd7db58008d1b44328c5a3a4220c
SHA18e8304bfd7a73b9ae8415b6cbd273e612868a2b2
SHA256915e46dcc29d6fee123c4b8e88d846ac95ffd4a6f4eb956dc882d305ee1b8256
SHA5124c17160aa83abeff897462f981226902dd6694817ad95f246511fc63c637bdffa0989a3db00c4309fa673a13b4993c509df538ddad482d1be8b4058749ee93f2
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
34KB
MD57328e816181f138f94cc1d4e890e85ca
SHA12afa28f288f61557b53d8334a22007e99141665a
SHA2562cc81c91df50a3bbb095ef63bfca31a2742fe1d3d4fd9fc19f3209d005644493
SHA512250c338ce2388fb1590703a33a77ca040119e7c9a753aaf18ec4b09c022bb835f5d541e4dbd495c138390760c0870faec1bc8cee4c3bcd555464910d0ed86c7d
-
Filesize
531B
MD537470bcda88e95eae6575f55958b001d
SHA186f83f019368c45b6a3fedde9e74682a09f5606b
SHA256873d795374ca541d246c584f0ab086a027c9242c9cd77cef2407e7bbf46e352c
SHA5125099ff27ee9d817976868d120bb7e92b6d650d12c4e1a0f5fbaf236e64830a271c326cbf3f70c5675e667894fb7dfef46d17a182e5619ab4fa795e70be56cbfc
-
C:\Users\Admin\AppData\Local\Temp\[email protected]
Filesize2KB
MD5e8b9799439990ff85d7338125796b06b
SHA1e57fa8d1c65863d5e61b0b98aeb044aaf612a40d
SHA256ce8f1cbe0c8d682ad7b2f2d0bb99c2179bf4ca37c69f8cb5ee1fb6c082a92813
SHA512c6cc050c017a9b7b686b726ecbd77b1b1bfe22dbfdf0dbfaf8d201e8d0ef4f35bb9bf698920d131353f549f84f5fb2ea1585e6f76b39cc33684bb6f91c43ef02
-
Filesize
2.5MB
MD5fefc3d677388386c29d8720c15b9db3f
SHA1370f1f40ae5c652d87b3b8f42e67d827af2b1754
SHA25674d5e8d3cd8d659d8df8e6f306832dfc252e1a6e676bb60334e31b5943deb4fb
SHA512b462ca1ffb0798bedc39c945daa75ff73e0efbb1c6dfdb262e6b2936158933f514f0b4169e811069df11aaeaebd39c826ce0caf9f6eb6d77de249fca6abe39fe
-
Filesize
510B
MD529b2508cbcc5c53473692223f2345faf
SHA1130cab9a60de6c94746b5555d03533d9a517241c
SHA256b54cd785c0543a209c61de0316205d5d5f1fde919a39ae1c499dd2c8683c8d74
SHA512f927d54026a02e3c000c1740ff2c9a9dd1d01784f76223fff9df1dd49756a24b8582822cf784052b6d1961b727dda5099a639d334cd705476c21d5d5f36b6823
-
Filesize
9.8MB
MD594ac28782eb45847b7896e291958d910
SHA1c3499d84b8069a911074521e62e14a5a8664259d
SHA2567bc661c74be100515adbd700878cf44fec41b33838ab5bcf223062d984b5ab73
SHA512c7f49a8e904fdb4f4ad1fc0631551b89b1f0e8286f82b960baec61b5ff2336c072c4788ace0c38f0a208b21b520907ff8f180c011d0dc64e92a56e051dac511e
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\uu0g08su.Admin\places.sqlite-20240608200750.420800.backup
Filesize68KB
MD5314cb7ffb31e3cc676847e03108378ba
SHA13667d2ade77624e79d9efa08a2f1d33104ac6343
SHA256b6d278384a3684409a2a86f03e4f52869818ce7dd8b5779876960353f7d35dc1
SHA512dc795fa35ea214843a781ee2b2ef551b91b6841a799bef2c6fb1907d90f6c114071a951ebb7b2b30e81d52b594d447a26ab12ddb57c331e854577d11e5febef5
-
Filesize
1KB
MD53adec702d4472e3252ca8b58af62247c
SHA135d1d2f90b80dca80ad398f411c93fe8aef07435
SHA2562b167248e8136c4d45c2c46e2bff6fb5e5137dd4dfdccde998599be2df2e9335
SHA5127562e093d16ee6305c1bb143a3f5d60dafe8b5de74952709abc68a0c353b65416bf78b1fa1a6720331615898848c1464a7758c5dfe78f8098f77fbfa924784c0
-
Filesize
313B
MD5af006f1bcc57b11c3478be8babc036a8
SHA1c3bb4fa8c905565ca6a1f218e39fe7494910891e
SHA256ed6a32e11cc99728771989b01f5ae813de80c46a59d3dc68c23a4671a343cb8c
SHA5123d20689b0f39b414349c505be607e6bfc1f33ac401cf62a32f36f7114e4a486552f3e74661e90db29402bb85866944e9f8f31baba9605aa0c6def621511a26af
-
Filesize
36B
MD5bac4a25137c532de32448140a55b9994
SHA1d135936bcb881d8e525d37883e71e3117183363f
SHA2560bbe65bda54543337aaa844c6e54d4e093b622f18d6b19c3a149bc375c4b6a20
SHA51290e0b3a78cb88a5d926810ae1bd51a1ce4158f081c73ddc44512d8507cba57b8f75821197e96fec86390e1435e5c7d46293db1e6804e96c2167cd47a3e6aeb8c
-
Filesize
181KB
MD50c80a997d37d930e7317d6dac8bb7ae1
SHA1018f13dfa43e103801a69a20b1fab0d609ace8a5
SHA256a5dd2f97c6787c335b7807ff9b6966877e9dd811f9e26326837a7d2bd224de86
SHA512fe1caef6d727344c60df52380a6e4ab90ae1a8eb5f96d6054eced1b7734357ce080d944fa518cf1366e14c4c0bd9a41db679738a860800430034a75bb90e51a5
-
Filesize
189KB
MD5e6fd0e66cf3bfd3cc04a05647c3c7c54
SHA16a1b7f1a45fb578de6492af7e2fede15c866739f
SHA256669cc0aae068ced3154acaecb0c692c4c5e61bc2ca95b40395a3399e75fcb9b2
SHA512fc8613f31acaf6155852d3ad6130fc3b76674b463dcdcfcd08a3b367dfd9e5b991e3f0a26994bcaf42f9e863a46a81e2520e77b1d99f703bcb08800bdca4efcb
-
Filesize
419KB
MD5aafdfaa7a989ddb216510fc9ae5b877f
SHA141cf94692968a7d511b6051b7fe2b15c784770cb
SHA256688d0b782437ccfae2944281ade651a2da063f222e80b3510789dbdce8b00fdc
SHA5126e2b76ff6df79c6de6887cf739848d05c894fbd70dc9371fff95e6ccd9938d695c46516cb18ec8edd01e78cad1a6029a3d633895f7ddba4db4bf9cd39271bd44
-
Filesize
260KB
MD5f1a8f60c018647902e70cf3869e1563f
SHA13caf9c51dfd75206d944d4c536f5f5ff8e225ae9
SHA25636022c6ecb3426791e6edee9074a3861fe5b660d98f2b2b7c13b80fe11a75577
SHA512c02dfd6276ad136283230cdf07d30ec2090562e6c60d6c0d4ac3110013780fcafd76e13931be53b924a35cf473d0f5ace2f6b5c3f1f70ce66b40338e53d38d1e
-
Filesize
8.6MB
MD5225ba20fa3edd13c9c72f600ff90e6cb
SHA15f1a9baa85c2afe29619e7cc848036d9174701e4
SHA25635585d12899435e13e186490fcf1d270adbe3c74a1e0578b3d9314858bf2d797
SHA51297e699cffe28d3c3611570d341ccbc1a0f0eec233c377c70e0e20d4ed3b956b6fe200a007f7e601a5724e733c97eaddc39d308b9af58d45f7598f10038d94ab3