Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    30/10/2024, 15:31 UTC

General

  • Target

    fcb4721b5321a9032625f9f45864fea5d4559bc7e9ea7371b6701e2c22443e13N.exe

  • Size

    1.8MB

  • MD5

    c2364d50aced195860423b58c93b5170

  • SHA1

    eb0e31653cf9190cc6ed56c26198c9a80c801c85

  • SHA256

    fcb4721b5321a9032625f9f45864fea5d4559bc7e9ea7371b6701e2c22443e13

  • SHA512

    4bfbd391d49d528f57d54c340effa9236ba408bb5aa0143b16b54390d54db58a9685c2b6332ad2005f948ce310a551366651a08a4569c7965761800e8e2ed569

  • SSDEEP

    12288:5UzTnjuWv0jtUgQ8RSG6FaavfQ/DxU61MIt3dYA7W2FeDSIGVH/KIDgDgUeHbY1T:5HHjWHHaavUuiQDbGV6eH8tky

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 3 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fcb4721b5321a9032625f9f45864fea5d4559bc7e9ea7371b6701e2c22443e13N.exe
    "C:\Users\Admin\AppData\Local\Temp\fcb4721b5321a9032625f9f45864fea5d4559bc7e9ea7371b6701e2c22443e13N.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3044
    • C:\Users\Admin\AppData\Local\Temp\fcb4721b5321a9032625f9f45864fea5d4559bc7e9ea7371b6701e2c22443e13N.exe
      "C:\Users\Admin\AppData\Local\Temp\fcb4721b5321a9032625f9f45864fea5d4559bc7e9ea7371b6701e2c22443e13N.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2720
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2628
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1052
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2428
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2120
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2208
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1988
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1380
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:904
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1760
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1772
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:332
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3000
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2284
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2104
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:540
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1792
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2040
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2420
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2836
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3044
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2620
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1284
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2724
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2612
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:836
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1652
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1624
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2928
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2320
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2036
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2788
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2188
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2872
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:692
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2468
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:3004
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2432
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2236
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2160
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1168
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1020
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:700
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:976
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:612
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1552
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2916
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2940
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1060
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2176
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2088
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2984
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2540
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:548
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2092
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1236
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1924
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:1608
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2072
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2380
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            PID:2740
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2828
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3052
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2744
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2360
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
              PID:2796
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • System Location Discovery: System Language Discovery
              PID:2656
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
                PID:3060
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe SE
                5⤵
                  PID:1300
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:2688
                • \??\c:\windows\system\spoolsv.exe
                  c:\windows\system\spoolsv.exe SE
                  5⤵
                    PID:2352
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:2364
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:3032
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:2296
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                    • System Location Discovery: System Language Discovery
                    PID:1740
                  • \??\c:\windows\system\spoolsv.exe
                    c:\windows\system\spoolsv.exe SE
                    5⤵
                      PID:872
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:1428
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                      • System Location Discovery: System Language Discovery
                      PID:1564
                    • \??\c:\windows\system\spoolsv.exe
                      c:\windows\system\spoolsv.exe SE
                      5⤵
                        PID:780
                      • \??\c:\windows\system\spoolsv.exe
                        c:\windows\system\spoolsv.exe SE
                        5⤵
                          PID:672
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:2224
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                          • System Location Discovery: System Language Discovery
                          PID:2128
                        • \??\c:\windows\system\spoolsv.exe
                          c:\windows\system\spoolsv.exe SE
                          5⤵
                            PID:2148
                          • \??\c:\windows\system\spoolsv.exe
                            c:\windows\system\spoolsv.exe SE
                            5⤵
                              PID:2372
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                              • System Location Discovery: System Language Discovery
                              PID:1032
                            • \??\c:\windows\system\spoolsv.exe
                              c:\windows\system\spoolsv.exe SE
                              5⤵
                                PID:1752
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:1616
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                • System Location Discovery: System Language Discovery
                                PID:1356
                              • \??\c:\windows\system\spoolsv.exe
                                c:\windows\system\spoolsv.exe SE
                                5⤵
                                  PID:1800
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:704
                                • \??\c:\windows\system\spoolsv.exe
                                  c:\windows\system\spoolsv.exe SE
                                  5⤵
                                    PID:2324
                                  • \??\c:\windows\system\spoolsv.exe
                                    c:\windows\system\spoolsv.exe SE
                                    5⤵
                                      PID:1928
                                    • \??\c:\windows\system\spoolsv.exe
                                      c:\windows\system\spoolsv.exe SE
                                      5⤵
                                        PID:1808
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                        • System Location Discovery: System Language Discovery
                                        PID:1040
                                      • \??\c:\windows\system\spoolsv.exe
                                        c:\windows\system\spoolsv.exe SE
                                        5⤵
                                          PID:2304
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1660
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:3036
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:1972
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2884
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                          • System Location Discovery: System Language Discovery
                                          PID:2848
                                        • \??\c:\windows\system\spoolsv.exe
                                          c:\windows\system\spoolsv.exe SE
                                          5⤵
                                            PID:2108
                                          • \??\c:\windows\system\spoolsv.exe
                                            c:\windows\system\spoolsv.exe SE
                                            5⤵
                                              PID:1296
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2608
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:2808
                                            • \??\c:\windows\system\spoolsv.exe
                                              c:\windows\system\spoolsv.exe SE
                                              5⤵
                                                PID:928
                                              • \??\c:\windows\system\spoolsv.exe
                                                c:\windows\system\spoolsv.exe SE
                                                5⤵
                                                  PID:2948
                                                • \??\c:\windows\system\spoolsv.exe
                                                  c:\windows\system\spoolsv.exe SE
                                                  5⤵
                                                    PID:2100
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2952
                                                  • \??\c:\windows\system\spoolsv.exe
                                                    c:\windows\system\spoolsv.exe SE
                                                    5⤵
                                                      PID:1684
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1908
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2672
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1424
                                                    • \??\c:\windows\system\spoolsv.exe
                                                      c:\windows\system\spoolsv.exe SE
                                                      5⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:2496
                                                  • C:\Windows\SysWOW64\diskperf.exe
                                                    "C:\Windows\SysWOW64\diskperf.exe"
                                                    4⤵
                                                      PID:768
                                                • C:\Windows\SysWOW64\diskperf.exe
                                                  "C:\Windows\SysWOW64\diskperf.exe"
                                                  2⤵
                                                    PID:2908

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  c2364d50aced195860423b58c93b5170

                                                  SHA1

                                                  eb0e31653cf9190cc6ed56c26198c9a80c801c85

                                                  SHA256

                                                  fcb4721b5321a9032625f9f45864fea5d4559bc7e9ea7371b6701e2c22443e13

                                                  SHA512

                                                  4bfbd391d49d528f57d54c340effa9236ba408bb5aa0143b16b54390d54db58a9685c2b6332ad2005f948ce310a551366651a08a4569c7965761800e8e2ed569

                                                • C:\Windows\system\explorer.exe

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  b68e2e2bce8c752585339bb3a17887c1

                                                  SHA1

                                                  7331943a46b6b58df91a03bef84a5fcd77aae850

                                                  SHA256

                                                  c585d6ffc3a7ca11c1c06e900899a2e41501bcc3d569fc38f164168db37bd741

                                                  SHA512

                                                  35306b24164db455e5c2fad4cc717f842d0dd8cc6dbe267310221274b91692b27bab296c87d33247156de017aa0fd8c298e80e6dac7ba65a4c99e2c9caa9cd93

                                                • \Windows\system\spoolsv.exe

                                                  Filesize

                                                  1.8MB

                                                  MD5

                                                  aeb05a2ab30570296c73a8d8c22bb236

                                                  SHA1

                                                  aa1e841f884032aae5b9cfd6aa3541b4a1c3dee8

                                                  SHA256

                                                  99525d6137256b36dd54c8ae9f42394f6d97069a1b3ff1587aac3134e89cc5a8

                                                  SHA512

                                                  2c367e6e904869e8cc8cc54b6f0a92814b7d717f67f8bacc272e15822da54226fc56fb55eab8ab06f565a0939a7ac45b2dd792136c8e2732125507b23c55fdeb

                                                • memory/332-176-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/540-258-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/836-346-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/836-312-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/904-142-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-319-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-211-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-175-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-686-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-177-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-320-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-311-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-345-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-344-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-313-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-296-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-186-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-290-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-288-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-279-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-352-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-354-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-164-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-83-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-259-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-98-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-110-0x0000000000400000-0x000000000043E000-memory.dmp

                                                  Filesize

                                                  248KB

                                                • memory/1052-108-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-249-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-229-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-151-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-129-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-128-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-140-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-228-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-153-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-335-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-207-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1052-196-0x0000000002EC0000-0x0000000002FD4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1284-289-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1380-131-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1380-174-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1624-393-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1624-328-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1652-361-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1652-322-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1760-198-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1760-155-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1772-165-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1772-206-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1792-231-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1988-154-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/1988-119-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2036-353-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2036-624-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2040-278-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2104-210-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2104-247-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2120-139-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2120-100-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2208-143-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2284-197-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2320-343-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2420-250-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2420-287-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2428-127-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2612-342-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2612-304-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2620-281-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2620-321-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2628-46-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2628-75-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2628-47-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2628-50-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2720-4-0x0000000000400000-0x000000000043E000-memory.dmp

                                                  Filesize

                                                  248KB

                                                • memory/2720-43-0x0000000002FB0000-0x00000000030C4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2720-8-0x0000000000400000-0x000000000043E000-memory.dmp

                                                  Filesize

                                                  248KB

                                                • memory/2720-49-0x0000000000400000-0x000000000043E000-memory.dmp

                                                  Filesize

                                                  248KB

                                                • memory/2720-17-0x0000000000400000-0x000000000043E000-memory.dmp

                                                  Filesize

                                                  248KB

                                                • memory/2720-44-0x0000000002FB0000-0x00000000030C4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2720-7-0x0000000000400000-0x000000000043E000-memory.dmp

                                                  Filesize

                                                  248KB

                                                • memory/2720-21-0x0000000000400000-0x000000000043E000-memory.dmp

                                                  Filesize

                                                  248KB

                                                • memory/2724-298-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2724-334-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2788-655-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2788-360-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2836-297-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2836-261-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/2908-22-0x0000000000400000-0x0000000000412000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/2908-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/2908-26-0x0000000000400000-0x0000000000412000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/2908-31-0x0000000000400000-0x0000000000412000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/2908-28-0x0000000000400000-0x0000000000412000-memory.dmp

                                                  Filesize

                                                  72KB

                                                • memory/2928-336-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/3000-187-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/3000-227-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/3044-1-0x0000000000220000-0x0000000000221000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/3044-0-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/3044-2-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/3044-3-0x0000000000220000-0x0000000000221000-memory.dmp

                                                  Filesize

                                                  4KB

                                                • memory/3044-310-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/3044-270-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/3044-16-0x00000000020A0000-0x00000000021B4000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                • memory/3044-30-0x0000000000400000-0x0000000000514000-memory.dmp

                                                  Filesize

                                                  1.1MB

                                                We care about your privacy.

                                                This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.