Overview
overview
10Static
static
10windows.zip
windows11-21h2-x64
8windows/cf...ch.vbs
windows11-21h2-x64
3windows/idc/ida.js
windows11-21h2-x64
3windows/li...le.dll
windows11-21h2-x64
8windows/libclang.dll
windows11-21h2-x64
8windows/libdwarf.dll
windows11-21h2-x64
8windows/li...le.dll
windows11-21h2-x64
8windows/libz3.dll
windows11-21h2-x64
8windows/lo...if.dll
windows11-21h2-x64
3windows/lo...ga.dll
windows11-21h2-x64
3windows/lo...of.dll
windows11-21h2-x64
3windows/lo...ut.dll
windows11-21h2-x64
8windows/lo...tar.py
windows11-21h2-x64
3windows/lo...ip.dll
windows11-21h2-x64
8windows/lo...ldr.py
windows11-21h2-x64
8windows/lo...age.py
windows11-21h2-x64
8windows/lo...rc.dll
windows11-21h2-x64
8windows/lo...ff.dll
windows11-21h2-x64
8windows/lo...x_m.py
windows11-21h2-x64
3windows/lo...ex.dll
windows11-21h2-x64
8windows/lo...os.dll
windows11-21h2-x64
3windows/lo...lod.py
windows11-21h2-x64
3windows/lo...mp.dll
windows11-21h2-x64
8windows/lo...lf.dll
windows11-21h2-x64
8windows/lo...oc.dll
windows11-21h2-x64
windows/lo...esp.py
windows11-21h2-x64
3windows/lo...ad.dll
windows11-21h2-x64
8windows/lo...os.dll
windows11-21h2-x64
8windows/lo...ex.dll
windows11-21h2-x64
8windows/lo...om.dll
windows11-21h2-x64
windows/lo...mf.dll
windows11-21h2-x64
3windows/lo...dr.dll
windows11-21h2-x64
8Analysis
-
max time kernel
836s -
max time network
862s -
platform
windows11-21h2_x64 -
resource
win11-20250207-en -
resource tags
arch:x64arch:x86image:win11-20250207-enlocale:en-usos:windows11-21h2-x64system -
submitted
09/02/2025, 15:25
Behavioral task
behavioral1
Sample
windows.zip
Resource
win11-20250207-en
Behavioral task
behavioral2
Sample
windows/cfg/gdb_arch.vbs
Resource
win11-20250207-en
Behavioral task
behavioral3
Sample
windows/idc/ida.js
Resource
win11-20250207-en
Behavioral task
behavioral4
Sample
windows/libSwiftDemangle.dll
Resource
win11-20250207-en
Behavioral task
behavioral5
Sample
windows/libclang.dll
Resource
win11-20250207-en
Behavioral task
behavioral6
Sample
windows/libdwarf.dll
Resource
win11-20250207-en
Behavioral task
behavioral7
Sample
windows/librustdemangle.dll
Resource
win11-20250207-en
Behavioral task
behavioral8
Sample
windows/libz3.dll
Resource
win11-20250207-en
Behavioral task
behavioral9
Sample
windows/loaders/aif.dll
Resource
win11-20250207-en
Behavioral task
behavioral10
Sample
windows/loaders/amiga.dll
Resource
win11-20250207-en
Behavioral task
behavioral11
Sample
windows/loaders/aof.dll
Resource
win11-20250207-en
Behavioral task
behavioral12
Sample
windows/loaders/aout.dll
Resource
win11-20250207-en
Behavioral task
behavioral13
Sample
windows/loaders/archldr_tar.py
Resource
win11-20250207-en
Behavioral task
behavioral14
Sample
windows/loaders/archldr_zip.dll
Resource
win11-20250207-en
Behavioral task
behavioral15
Sample
windows/loaders/bfltldr.py
Resource
win11-20250207-en
Behavioral task
behavioral16
Sample
windows/loaders/bios_image.py
Resource
win11-20250207-en
Behavioral task
behavioral17
Sample
windows/loaders/bochsrc.dll
Resource
win11-20250207-en
Behavioral task
behavioral18
Sample
windows/loaders/coff.dll
Resource
win11-20250207-en
Behavioral task
behavioral19
Sample
windows/loaders/cortex_m.py
Resource
win11-20250207-en
Behavioral task
behavioral20
Sample
windows/loaders/dex.dll
Resource
win11-20250207-en
Behavioral task
behavioral21
Sample
windows/loaders/dos.dll
Resource
win11-20250207-en
Behavioral task
behavioral22
Sample
windows/loaders/dsp_lod.py
Resource
win11-20250207-en
Behavioral task
behavioral23
Sample
windows/loaders/dump.dll
Resource
win11-20250207-en
Behavioral task
behavioral24
Sample
windows/loaders/elf.dll
Resource
win11-20250207-en
Behavioral task
behavioral25
Sample
windows/loaders/epoc.dll
Resource
win11-20250207-en
Behavioral task
behavioral26
Sample
windows/loaders/esp.py
Resource
win11-20250207-en
Behavioral task
behavioral27
Sample
windows/loaders/expload.dll
Resource
win11-20250207-en
Behavioral task
behavioral28
Sample
windows/loaders/geos.dll
Resource
win11-20250207-en
Behavioral task
behavioral29
Sample
windows/loaders/hex.dll
Resource
win11-20250207-en
Behavioral task
behavioral30
Sample
windows/loaders/hpsom.dll
Resource
win11-20250207-en
Behavioral task
behavioral31
Sample
windows/loaders/intelomf.dll
Resource
win11-20250207-en
Behavioral task
behavioral32
Sample
windows/loaders/javaldr.dll
Resource
win11-20250207-en
General
-
Target
windows/loaders/aout.dll
-
Size
19KB
-
MD5
3489c18ccd4269416025162ebcf04b2f
-
SHA1
f6ccf40a4c9f0f5f46bd5c2c1debee015165909b
-
SHA256
ff59003c7dcfa6985f9791bdb6ce96b1e719d4bfc6980470fbbe24c770c91921
-
SHA512
012195af6584796ff84cce26a23670b4ec3ddac213c38f3c79ae276f0c63a5e8c8e609fea38abdb868037681b58bbe5c25373dd39f578fe8e4063428e4f1ec6e
-
SSDEEP
384:uOAMU+f+cceprjdKPRNIO1EhzQULIW8bA+9L6pYmoBrHV/9A:1BzpnKNsLIVx9aJoP6
Malware Config
Signatures
-
Downloads MZ/PE file 4 IoCs
flow pid Process 8 1412 Process not Found 22 1412 Process not Found 15 132 Process not Found 25 132 Process not Found -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MicrosoftEdgeUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wermgr.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1664 MicrosoftEdgeUpdate.exe 4316 MicrosoftEdgeUpdate.exe -
Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision wermgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wermgr.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\windows\loaders\aout.dll,#11⤵PID:1732
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzVCN0VFMjItNDA3NS00OEQ5LUI3RkEtNjc3M0M1QjJEQTQ5fSIgdXNlcmlkPSJ7NzREMTVFNTYtQzZFNS00Q0Q1LUJBNDItOURCQjE5MzdDQzNCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTIxN0I4MDMtRDM0MS00REU4LUIyQkMtQUZEREM4Qjk3MDhBfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjEiIGluc3RhbGxkYXRldGltZT0iMTczODk1NzQxMiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNDMwMDQxNTY3MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjU1MTA1MDMzNTgiLz48L2FwcD48L3JlcXVlc3Q-1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:1664
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzVCN0VFMjItNDA3NS00OEQ5LUI3RkEtNjc3M0M1QjJEQTQ5fSIgdXNlcmlkPSJ7NzREMTVFNTYtQzZFNS00Q0Q1LUJBNDItOURCQjE5MzdDQzNCfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9InszNDcxMkU0MC0wOUNDLTQ2MzctQjczNS1ENDUwMTVBNEUyQTV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iMiIgcGh5c21lbW9yeT0iNCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjIyMDAwLjQ5MyIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTk1LjQzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMSIgY29ob3J0PSJycmZAMC40MSI-PHVwZGF0ZWNoZWNrLz48cGluZyByPSIyIiByZD0iNjYxMiIgcGluZ19mcmVzaG5lc3M9InsxMkJDQjIyRC1DOTI1LTRCOTgtOTQ1OC0yMTk5QzgzRjNDNEJ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0iezU2RUIxOEY4LUIwMDgtNENCRC1CNkQyLThDOTdGRTdFOTA2Mn0iIHZlcnNpb249IjkwLjAuODE4LjY2IiBuZXh0dmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgaW5zdGFsbGFnZT0iMSIgaXNfcGlubmVkX3N5c3RlbT0idHJ1ZSIgbGFzdF9sYXVuY2hfY291bnQ9IjEiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMzgzNDMzNDEyOTk4NzEzMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNTU1MTkxMDI2MiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1NTUyMDY1ODA4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTg5MjM3ODU2OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5NzIwMjI4JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVNWa3lDb3NnS3R3V3RnbWZiY2trUENJTnRWQ1VUakJkRWRacUR2OXVyaXlXRE84SmliQk0lMmZPUGxmZWRDOXYxZE4lMmJFTjdVTUtLNGxsaE5xYnFkek9wQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDEyODY2IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTg5MjM3ODU2OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3Mzk3MjAyMjgmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9U1ZreUNvc2dLdHdXdGdtZmJja2tQQ0lOdFZDVVRqQmRFZFpxRHY5dXJpeVdETzhKaWJCTSUyZk9QbGZlZEM5djFkTiUyYkVON1VNS0s0bGxoTnFicWR6T3BBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iNjcxMDE4IiB0b3RhbD0iMTc3MTgwMjE2IiBkb3dubG9hZF90aW1lX21zPSI2NjA3OCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAxMjg5NCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTE4OTIzNzg1NjkiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9Indpbmh0dHAiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5NzIwMjI4JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVNWa3lDb3NnS3R3V3RnbWZiY2trUENJTnRWQ1VUakJkRWRacUR2OXVyaXlXRE84SmliQk0lMmZPUGxmZWRDOXYxZE4lMmJFTjdVTUtLNGxsaE5xYnFkek9wQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IjIuMTkuMTE3Ljk5IiBjZG5fY2lkPSIyIiBjZG5fY2NjPSJHQiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjIzMTQ0MjMiIHRvdGFsPSIxNzcxODAyMTYiIGRvd25sb2FkX3RpbWVfbXM9IjUxNTc4Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTg5MjM3ODU2OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzA3NDAwMzZhLTRlMTgtNDU2ZC05NmZhLWQxZDljNGNhNDY3Nj9QMT0xNzM5NzIwMjI4JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PVNWa3lDb3NnS3R3V3RnbWZiY2trUENJTnRWQ1VUakJkRWRacUR2OXVyaXlXRE84SmliQk0lMmZPUGxmZWRDOXYxZE4lMmJFTjdVTUtLNGxsaE5xYnFkek9wQSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjAiIHRvdGFsPSIwIiBkb3dubG9hZF90aW1lX21zPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDEyODk0IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTg5MjM3ODU2OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3Mzk3MjAyMjgmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9U1ZreUNvc2dLdHdXdGdtZmJja2tQQ0lOdFZDVVRqQmRFZFpxRHY5dXJpeVdETzhKaWJCTSUyZk9QbGZlZEM5djFkTiUyYkVON1VNS0s0bGxoTnFicWR6T3BBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iNDIzNzYwNyIgdG90YWw9IjE3NzE4MDIxNiIgZG93bmxvYWRfdGltZV9tcz0iMzk5NTMxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDEyODk0IiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMTg5MjM3ODU2OSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0id2luaHR0cCIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvMDc0MDAzNmEtNGUxOC00NTZkLTk2ZmEtZDFkOWM0Y2E0Njc2P1AxPTE3Mzk3MjAyMjgmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9U1ZreUNvc2dLdHdXdGdtZmJja2tQQ0lOdFZDVVRqQmRFZFpxRHY5dXJpeVdETzhKaWJCTSUyZk9QbGZlZEM5djFkTiUyYkVON1VNS0s0bGxoTnFicWR6T3BBJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iMi4xOS4xMTcuOTkiIGNkbl9jaWQ9IjIiIGNkbl9jY2M9IkdCIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTU2MzYxMzY3IiB0b3RhbD0iMTc3MTgwMjE2IiBkb3dubG9hZF90aW1lX21zPSI2OTc2NiIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIwIiBlcnJvcmNvZGU9Ii0yMTQ3MDIzODM4IiBleHRyYWNvZGUxPSIyNjg0MzU0NjMiIHN5c3RlbV91cHRpbWVfdGlja3M9IjExODkyNTM0NDcxIiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMTk2OSIgZG93bmxvYWRfdGltZV9tcz0iNjM0MDQ3IiB0b3RhbD0iMTc3MTgwMjE2IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIvPjxwaW5nIGFjdGl2ZT0iMSIgYT0iMiIgcj0iMiIgYWQ9IjY2MTIiIHJkPSI2NjEyIiBwaW5nX2ZyZXNobmVzcz0ie0FBMjY2NTFGLTUzQ0ItNDA1Ri1BNUNFLTREREZENTc5RjI3OH0iLz48L2FwcD48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iMTMyLjAuMjk1Ny4xNDAiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBjb2hvcnQ9InJyZkAwLjA3IiB1cGRhdGVfY291bnQ9IjEiPjx1cGRhdGVjaGVjay8-PHBpbmcgcj0iMiIgcmQ9IjY2MTIiIHBpbmdfZnJlc2huZXNzPSJ7Mjk1M0UyNjctRUJCNy00RDQ4LUIyMzctQjE0MTg2MThCNTVFfSIvPjwvYXBwPjwvcmVxdWVzdD41⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:4316
-
C:\Windows\SysWOW64\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "4764" "1064" "968" "1068" "0" "0" "0" "0" "0" "0" "0" "0"1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
PID:5084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
688KB
MD51e4b19d01de8b25259dd91ef66d0242f
SHA10257dd44e4a68822da113a4aa60c783e9ec3256e
SHA2560233cdfc1f13b10a4e77b141d53f63fc6eb8ae312b74fd445f00d25c6ed21095
SHA51235c663a72ec16c52389a2d68aee03ac5672c0d0be4bb04f4b373cd14d0fab1853cbf2e0ba279fb4874ddcaf2b5123a36214bdb452e413062f6f8cbf8fea2b7b1