Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
131s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
10/02/2025, 22:35
Static task
static1
Behavioral task
behavioral1
Sample
73e4969db4253f9aeb2cbc7462376fb7e26cc4bb5bd23b82e2af0eaaf5ae66a8.dll
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral2
Sample
73e4969db4253f9aeb2cbc7462376fb7e26cc4bb5bd23b82e2af0eaaf5ae66a8.dll
Resource
win10v2004-20250207-en
windows10-2004-x64
General
-
Target
73e4969db4253f9aeb2cbc7462376fb7e26cc4bb5bd23b82e2af0eaaf5ae66a8.dll
-
Size
2.3MB
-
MD5
74cf47683051f44e6fb55ac9360c717e
-
SHA1
93b1ab0a9e70a546c4b89dcb20a158dfc90b1421
-
SHA256
73e4969db4253f9aeb2cbc7462376fb7e26cc4bb5bd23b82e2af0eaaf5ae66a8
-
SHA512
8425057a65e7f7e39956b8b245bdcaf2d2e827664ee34693cd055ac92f37d1b4f285bac3acc3be9df67d99b1ab8edd4602d7b7bc80ba9eecc2979b8ab37cbb72
-
SSDEEP
49152:aRJVY7Gs7IvXK6eBTC28d97NSkkBL3HgogWmv:aRJAIHXSkkBbHgoHmv
Malware Config
Extracted
qakbot
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Extracted
qakbot
403.10
obama150
1640256791
96.21.251.127:2222
70.51.134.181:2222
69.14.172.24:443
186.64.87.213:443
94.62.161.77:995
103.139.242.30:990
114.79.148.170:443
217.164.247.241:2222
178.153.86.181:443
136.232.34.70:443
37.210.226.125:61202
173.21.10.71:2222
31.219.154.176:32101
140.82.49.12:443
32.221.229.7:443
24.152.219.253:995
106.51.48.170:50001
114.38.161.124:995
96.37.113.36:993
190.39.205.165:443
45.9.20.200:2211
105.198.236.99:995
70.163.1.219:443
103.139.242.30:995
24.95.61.62:443
136.143.11.232:443
31.215.215.152:1194
103.143.8.71:6881
102.65.38.67:443
31.215.70.105:443
86.97.9.221:443
83.110.91.18:2222
63.153.187.104:443
74.15.2.252:2222
217.165.123.47:61200
41.228.22.180:443
24.53.49.240:443
149.135.101.20:443
94.200.181.154:995
67.209.195.198:443
209.210.95.228:32100
96.80.109.57:995
80.14.196.176:2222
38.70.253.226:2222
24.222.20.254:443
103.142.10.177:443
217.128.93.27:2222
103.157.122.130:21
24.178.196.158:2222
182.191.92.203:995
76.169.147.192:32103
78.180.66.163:995
89.41.8.168:443
190.73.3.148:2222
79.173.195.234:443
120.150.218.241:995
182.56.56.249:443
121.175.104.13:32100
76.25.142.196:443
79.167.192.206:995
59.6.7.83:61200
71.74.12.34:443
83.110.98.231:995
89.137.52.44:443
114.143.92.41:61202
67.165.206.193:993
94.60.254.81:443
23.233.146.92:443
73.151.236.31:443
187.162.59.232:995
72.252.201.34:995
50.237.134.22:995
201.172.31.95:80
100.1.119.41:443
40.134.247.125:995
109.12.111.14:443
89.101.97.139:443
24.55.112.61:443
93.48.80.198:995
75.188.35.168:443
83.199.144.45:2222
92.154.9.41:50002
111.125.245.116:995
39.49.105.128:995
82.152.39.39:443
105.106.30.144:443
31.35.28.29:443
103.139.242.30:22
218.101.110.3:995
182.176.180.73:443
121.175.104.13:443
65.100.174.110:8443
79.160.207.214:443
70.224.68.92:443
173.25.166.81:443
176.205.152.44:443
108.4.67.252:443
189.174.46.65:995
187.189.86.168:443
176.24.150.197:443
86.98.52.117:443
200.54.14.34:80
103.139.242.30:443
103.139.242.30:465
103.139.242.30:993
78.101.89.174:2222
78.101.89.174:443
73.5.119.219:443
74.5.148.57:443
68.186.192.69:443
50.33.112.74:995
70.93.80.154:995
75.169.58.229:32100
63.143.92.99:995
217.39.100.89:443
46.9.77.245:995
173.71.147.134:995
75.110.250.187:443
194.36.28.238:443
65.100.174.110:443
82.78.212.133:443
83.110.107.123:443
59.88.168.108:443
65.128.74.102:443
68.204.7.158:443
78.101.82.198:995
80.6.192.58:443
41.97.234.150:995
114.79.145.28:443
188.54.96.91:443
50.238.6.36:443
217.165.11.65:61200
103.143.8.71:995
2.178.67.97:61202
86.198.237.51:2222
88.253.171.236:995
187.172.146.123:443
92.167.4.71:2222
189.30.244.252:995
194.36.28.26:443
84.199.230.66:443
14.96.67.177:443
182.56.57.23:995
87.70.118.51:443
93.48.58.123:2222
-
salt
jHxastDcds)oMc=jvh7wdUhxcsdt2
Signatures
-
Qakbot family
-
Windows security bypass 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\Microsoft\Lgigyhyovyo = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Roaming\Microsoft\Ewiqwegnpj = "0" reg.exe -
Loads dropped DLL 1 IoCs
pid Process 1164 regsvr32.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Modifies data under HKEY_USERS 10 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Llllwetvo\62c9bc6a = e96aa26f6c0fec71c29744333847f20db659a22113076deaea2d0a2ba9f1cc366d0b1e3ddbc56c86734e0d7fa346cd2ec311c1967fa2268e00b124c75ef70df8580bc9ef2b17b8126626f84de8ecd75d65d969b4b7994bcd explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Llllwetvo\55174c58 = 3b522aff72c391c567a6220c6e70abdd72db49dad74ddfb4 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Llllwetvo\90a364b7 = f05f03417a05cf49238dcad7ebd6dbbf33ea05428e2832300491ec9e77d8f07dd115d66a82c9f72414515e5c73e6a72118696e76d249c882271f0f160f5096586e273f461d5dd7d5c3c22c1bb19265bbf951a8bf3bc09e6e explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Llllwetvo\62c9bc6a = e96ab56f6c0fd9ce5a80693e4e2c4ffbafff2b501a4711f9339906e3a578c12f61435be1e8f443853ca0f99675e5ac7023f9146d8b3ceecdfc6c0a425e7a68f129af48739ebdd4ec86517a3894f5d1c5503bf83485c67fd9a63b65f87d34ae516771e38ba9d4fadd52af8732b5 explorer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Llllwetvo explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Llllwetvo\57566c24 = 4d862dda91c26ff458b5978979fcbfdca81ffc5eed29a35d270dfd00f5bdff3c730126a300a05cb28865e386abe80983179d702d04cf6c9cfaf5302f5f1e63da63e5ad03ad9d72116e60051aceb02c50fec84b70ec89ed49409d3474dfcd408218cdee153d1f390594a950004b70481b7e4625e08aa626366ce3359d43c7cf13ade4f12241e97fb50a9367babd591eb795e4640551ad1fa3cd8883cec21d6fcf6d99069d96fd297826c439dcb17bcd764e80dc461731cc78fdbb564bc7e903 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Llllwetvo\edab2b3d = 6815e0af2be5b808b282b7248a74949197bbaa explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Llllwetvo\281f03d2 = 971d6aed420829b8c2212cd2d53d4e5cdb648e3df3a8ece827fc09f08dca55891565262d7671c9f2dfac9e10843521a6fd5193c1f966af7d29080261b27bbab80477284e5b26eb246ac4fdde500caa39845cbe12cb139c3ec0fcfd630ba6 explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Llllwetvo\efea0b41 = e7b6265d95a663192b64083835ad8b9d62f9bc9862b5aa399592bf779bdf1a3e19450126c6d77e0e997217b8d39abeac8a8eb25b23aeb78bf18748a48cc26c25e10a explorer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Llllwetvo\1d80d39c = f6ddcb602cf96dbeaca90c07547f5a0ec14f4055 explorer.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2904 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 1228 regsvr32.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2780 taskmgr.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1228 regsvr32.exe 1164 regsvr32.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2780 taskmgr.exe Token: 33 940 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 940 AUDIODG.EXE Token: 33 940 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 940 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe 2780 taskmgr.exe -
Suspicious use of WriteProcessMemory 43 IoCs
description pid Process procid_target PID 2268 wrote to memory of 1228 2268 regsvr32.exe 30 PID 2268 wrote to memory of 1228 2268 regsvr32.exe 30 PID 2268 wrote to memory of 1228 2268 regsvr32.exe 30 PID 2268 wrote to memory of 1228 2268 regsvr32.exe 30 PID 2268 wrote to memory of 1228 2268 regsvr32.exe 30 PID 2268 wrote to memory of 1228 2268 regsvr32.exe 30 PID 2268 wrote to memory of 1228 2268 regsvr32.exe 30 PID 1228 wrote to memory of 2912 1228 regsvr32.exe 31 PID 1228 wrote to memory of 2912 1228 regsvr32.exe 31 PID 1228 wrote to memory of 2912 1228 regsvr32.exe 31 PID 1228 wrote to memory of 2912 1228 regsvr32.exe 31 PID 1228 wrote to memory of 2912 1228 regsvr32.exe 31 PID 1228 wrote to memory of 2912 1228 regsvr32.exe 31 PID 2912 wrote to memory of 2904 2912 explorer.exe 32 PID 2912 wrote to memory of 2904 2912 explorer.exe 32 PID 2912 wrote to memory of 2904 2912 explorer.exe 32 PID 2912 wrote to memory of 2904 2912 explorer.exe 32 PID 1664 wrote to memory of 2040 1664 taskeng.exe 37 PID 1664 wrote to memory of 2040 1664 taskeng.exe 37 PID 1664 wrote to memory of 2040 1664 taskeng.exe 37 PID 1664 wrote to memory of 2040 1664 taskeng.exe 37 PID 1664 wrote to memory of 2040 1664 taskeng.exe 37 PID 2040 wrote to memory of 1164 2040 regsvr32.exe 38 PID 2040 wrote to memory of 1164 2040 regsvr32.exe 38 PID 2040 wrote to memory of 1164 2040 regsvr32.exe 38 PID 2040 wrote to memory of 1164 2040 regsvr32.exe 38 PID 2040 wrote to memory of 1164 2040 regsvr32.exe 38 PID 2040 wrote to memory of 1164 2040 regsvr32.exe 38 PID 2040 wrote to memory of 1164 2040 regsvr32.exe 38 PID 1164 wrote to memory of 2500 1164 regsvr32.exe 39 PID 1164 wrote to memory of 2500 1164 regsvr32.exe 39 PID 1164 wrote to memory of 2500 1164 regsvr32.exe 39 PID 1164 wrote to memory of 2500 1164 regsvr32.exe 39 PID 1164 wrote to memory of 2500 1164 regsvr32.exe 39 PID 1164 wrote to memory of 2500 1164 regsvr32.exe 39 PID 2500 wrote to memory of 2856 2500 explorer.exe 40 PID 2500 wrote to memory of 2856 2500 explorer.exe 40 PID 2500 wrote to memory of 2856 2500 explorer.exe 40 PID 2500 wrote to memory of 2856 2500 explorer.exe 40 PID 2500 wrote to memory of 2280 2500 explorer.exe 42 PID 2500 wrote to memory of 2280 2500 explorer.exe 42 PID 2500 wrote to memory of 2280 2500 explorer.exe 42 PID 2500 wrote to memory of 2280 2500 explorer.exe 42
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\73e4969db4253f9aeb2cbc7462376fb7e26cc4bb5bd23b82e2af0eaaf5ae66a8.dll1⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\73e4969db4253f9aeb2cbc7462376fb7e26cc4bb5bd23b82e2af0eaaf5ae66a8.dll2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Create /RU "NT AUTHORITY\SYSTEM" /tn brtbqzt /tr "regsvr32.exe -s \"C:\Users\Admin\AppData\Local\Temp\73e4969db4253f9aeb2cbc7462376fb7e26cc4bb5bd23b82e2af0eaaf5ae66a8.dll\"" /SC ONCE /Z /ST 22:39 /ET 22:514⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2904
-
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2780
-
C:\Windows\system32\taskeng.exetaskeng.exe {FF887E99-A915-4578-AA37-BC59180E8BE7} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\system32\regsvr32.exeregsvr32.exe -s "C:\Users\Admin\AppData\Local\Temp\73e4969db4253f9aeb2cbc7462376fb7e26cc4bb5bd23b82e2af0eaaf5ae66a8.dll"2⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\regsvr32.exe-s "C:\Users\Admin\AppData\Local\Temp\73e4969db4253f9aeb2cbc7462376fb7e26cc4bb5bd23b82e2af0eaaf5ae66a8.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe4⤵
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2500 -
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\ProgramData\Microsoft\Lgigyhyovyo" /d "0"5⤵
- Windows security bypass
PID:2856
-
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /t REG_DWORD /v "C:\Users\Admin\AppData\Roaming\Microsoft\Ewiqwegnpj" /d "0"5⤵
- Windows security bypass
PID:2280
-
-
-
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2104
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4481⤵
- Suspicious use of AdjustPrivilegeToken
PID:940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\73e4969db4253f9aeb2cbc7462376fb7e26cc4bb5bd23b82e2af0eaaf5ae66a8.dll
Filesize2.3MB
MD574cf47683051f44e6fb55ac9360c717e
SHA193b1ab0a9e70a546c4b89dcb20a158dfc90b1421
SHA25673e4969db4253f9aeb2cbc7462376fb7e26cc4bb5bd23b82e2af0eaaf5ae66a8
SHA5128425057a65e7f7e39956b8b245bdcaf2d2e827664ee34693cd055ac92f37d1b4f285bac3acc3be9df67d99b1ab8edd4602d7b7bc80ba9eecc2979b8ab37cbb72