Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
1027f824a80e...71.exe
windows7-x64
1027f824a80e...71.exe
windows10-2004-x64
102c4115951e...47.exe
windows7-x64
102c4115951e...47.exe
windows10-2004-x64
10500c00d4d7...0a.exe
windows7-x64
1500c00d4d7...0a.exe
windows10-2004-x64
373592f050e...1c.exe
windows7-x64
1073592f050e...1c.exe
windows10-2004-x64
10b086986db5...76.exe
windows7-x64
10b086986db5...76.exe
windows10-2004-x64
10b99dab26a9...fc.exe
windows7-x64
10b99dab26a9...fc.exe
windows10-2004-x64
10c9fc6dc8c8...e6.exe
windows7-x64
10c9fc6dc8c8...e6.exe
windows10-2004-x64
10caf5832156...ad.exe
windows7-x64
10caf5832156...ad.exe
windows10-2004-x64
10cf18bda81a...a2.exe
windows7-x64
10cf18bda81a...a2.exe
windows10-2004-x64
10d1f1126921...3e.exe
windows7-x64
10d1f1126921...3e.exe
windows10-2004-x64
10e329eaa5c0...cd.exe
windows7-x64
10e329eaa5c0...cd.exe
windows10-2004-x64
10eba45a34e3...0b.exe
windows7-x64
10eba45a34e3...0b.exe
windows10-2004-x64
10Analysis
-
max time kernel
6s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20250217-en -
resource tags
arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2025, 02:28
Behavioral task
behavioral1
Sample
27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
27f824a80ebdad6b53d01f487ecb17616c0a2a9d9700ca3be3b1c1a24cdc1f71.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral3
Sample
2c4115951e3a55fe85cf0ebb6fcf5e65ccbebfa0774a3f15db7856b74e8e6647.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
2c4115951e3a55fe85cf0ebb6fcf5e65ccbebfa0774a3f15db7856b74e8e6647.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral5
Sample
500c00d4d789bb18252fd5f3fe5ce41ae7afc1175dfeb0eb9553636c2c15450a.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
500c00d4d789bb18252fd5f3fe5ce41ae7afc1175dfeb0eb9553636c2c15450a.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral7
Sample
73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe
Resource
win7-20250207-en
Behavioral task
behavioral8
Sample
73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral9
Sample
b086986db5990b434fbf33a030d727d4a5316c5cc154ebf0c1b9433833670176.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
b086986db5990b434fbf33a030d727d4a5316c5cc154ebf0c1b9433833670176.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral11
Sample
b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Resource
win7-20241010-en
Behavioral task
behavioral12
Sample
b99dab26a9787a8361f75905fa34de2fc05e19f6d5d70bd70f045e0bab05f4fc.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral13
Sample
c9fc6dc8c8dbff7eff9a199440ef52348cf2d410da5d6940d3648d6fa1f568e6.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
c9fc6dc8c8dbff7eff9a199440ef52348cf2d410da5d6940d3648d6fa1f568e6.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral15
Sample
caf5832156e063db5f23ccdb510600cefc45d65281d57771f19637daf7f3d7ad.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
caf5832156e063db5f23ccdb510600cefc45d65281d57771f19637daf7f3d7ad.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral17
Sample
cf18bda81a0c95a61a47ece2c1fd879e86e3f1fbd64f3e291fee2d5ca96171a2.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
cf18bda81a0c95a61a47ece2c1fd879e86e3f1fbd64f3e291fee2d5ca96171a2.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral19
Sample
d1f112692188b7a7cd36cafc7751da401af6d5e6ff73a89ea988c553d00bd93e.exe
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
d1f112692188b7a7cd36cafc7751da401af6d5e6ff73a89ea988c553d00bd93e.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral21
Sample
e329eaa5c013df43ea579571a5ae4d65f8cfd04809aeeb219551c80d6ff42bcd.exe
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
e329eaa5c013df43ea579571a5ae4d65f8cfd04809aeeb219551c80d6ff42bcd.exe
Resource
win10v2004-20250217-en
Behavioral task
behavioral23
Sample
eba45a34e3dfa65dd307af9f5c018bf48aeb4a08fac42ca2899f9334b34e870b.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
eba45a34e3dfa65dd307af9f5c018bf48aeb4a08fac42ca2899f9334b34e870b.exe
Resource
win10v2004-20250217-en
General
-
Target
73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe
-
Size
2.0MB
-
MD5
3c63ad1e2e8970c53fbf2be431c7fc36
-
SHA1
87391866f4a2661eb0cb027a9cfeb2d3a7335eca
-
SHA256
73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c
-
SHA512
2aea8b499ace63d12fbd49d92ddb49fcbc9da162116343254d6ff47b2a151c0558afff25a7b5a5f58af3602dfab5890d9fa45554da8eb0d6bab806a334bf7521
-
SSDEEP
24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYW:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YE
Malware Config
Extracted
azorult
http://0x21.in:8000/_az/
Extracted
quasar
1.3.0.0
EbayProfiles
5.8.88.191:443
sockartek.icu:443
QSR_MUTEX_0kBRNrRz5TDLEQouI0
-
encryption_key
MWhG6wsClMX8aJM2CVXT
-
install_name
winsock.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
win defender run
-
subdirectory
SubDir
Signatures
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Azorult family
-
description flow ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 16 ip-api.com Process not Found 39 api.ipify.org Process not Found -
Quasar family
-
Quasar payload 3 IoCs
resource yara_rule behavioral8/files/0x000b000000023bbb-12.dat family_quasar behavioral8/memory/4520-29-0x0000000000EE0000-0x0000000000F3E000-memory.dmp family_quasar behavioral8/files/0x000b000000023c59-45.dat family_quasar -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-100612193-3312047696-905266872-1000\Control Panel\International\Geo\Nation 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe -
Executes dropped EXE 3 IoCs
pid Process 4272 vnc.exe 4520 windef.exe 2412 winsock.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\o: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\s: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\x: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\h: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\j: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\q: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\r: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\u: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\w: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\b: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\e: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\i: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\l: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\n: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\p: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\t: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\a: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\k: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\m: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\v: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\y: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe File opened (read-only) \??\z: 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 39 api.ipify.org 16 ip-api.com -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral8/files/0x000b000000023c59-45.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5320 set thread context of 5620 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
pid pid_target Process procid_target 1564 4272 WerFault.exe 87 5664 3224 WerFault.exe 114 5972 2412 WerFault.exe 100 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vnc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language windef.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winsock.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 5952 PING.EXE -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5952 PING.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5524 schtasks.exe 3932 schtasks.exe 2748 schtasks.exe 3280 schtasks.exe 3268 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4520 windef.exe Token: SeDebugPrivilege 2412 winsock.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 5320 wrote to memory of 4272 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 87 PID 5320 wrote to memory of 4272 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 87 PID 5320 wrote to memory of 4272 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 87 PID 4272 wrote to memory of 452 4272 vnc.exe 89 PID 4272 wrote to memory of 452 4272 vnc.exe 89 PID 5320 wrote to memory of 4520 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 90 PID 5320 wrote to memory of 4520 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 90 PID 5320 wrote to memory of 4520 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 90 PID 4272 wrote to memory of 452 4272 vnc.exe 89 PID 5320 wrote to memory of 5620 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 92 PID 5320 wrote to memory of 5620 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 92 PID 5320 wrote to memory of 5620 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 92 PID 5320 wrote to memory of 5620 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 92 PID 5320 wrote to memory of 5620 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 92 PID 5320 wrote to memory of 3268 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 94 PID 5320 wrote to memory of 3268 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 94 PID 5320 wrote to memory of 3268 5320 73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe 94 PID 4520 wrote to memory of 5524 4520 windef.exe 98 PID 4520 wrote to memory of 5524 4520 windef.exe 98 PID 4520 wrote to memory of 5524 4520 windef.exe 98 PID 4520 wrote to memory of 2412 4520 windef.exe 100 PID 4520 wrote to memory of 2412 4520 windef.exe 100 PID 4520 wrote to memory of 2412 4520 windef.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe"C:\Users\Admin\AppData\Local\Temp\73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe"1⤵
- Quasar RAT
- Checks computer location settings
- Enumerates connected drives
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:452
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4272 -s 5523⤵
- Program crash
PID:1564
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\windef.exe" /rl HIGHEST /f3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5524
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2412 -
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f4⤵
- Scheduled Task/Job: Scheduled Task
PID:3932
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\hE4FVbehwszu.bat" "4⤵PID:4740
-
C:\Windows\SysWOW64\chcp.comchcp 650015⤵PID:5216
-
-
C:\Windows\SysWOW64\PING.EXEping -n 10 localhost5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:5952
-
-
C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe"5⤵PID:1964
-
C:\Windows\SysWOW64\schtasks.exe"schtasks" /create /tn "win defender run" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\winsock.exe" /rl HIGHEST /f6⤵
- Scheduled Task/Job: Scheduled Task
PID:3280
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2412 -s 20204⤵
- Program crash
PID:5972
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe"C:\Users\Admin\AppData\Local\Temp\73592f050eb0d6d8621fed9a739c491029c7975f257a9ceba4c6f2f211c7831c.exe"2⤵
- System Location Discovery: System Language Discovery
PID:5620
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4272 -ip 42721⤵PID:2212
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exeC:\Users\Admin\btpanui\SystemPropertiesPerformance.exe1⤵PID:4604
-
C:\Users\Admin\AppData\Local\Temp\vnc.exe"C:\Users\Admin\AppData\Local\Temp\vnc.exe"2⤵PID:3224
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k3⤵PID:2552
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3224 -s 5203⤵
- Program crash
PID:5664
-
-
-
C:\Users\Admin\AppData\Local\Temp\windef.exe"C:\Users\Admin\AppData\Local\Temp\windef.exe"2⤵PID:5532
-
-
C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe"2⤵PID:4048
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn RtkAudioService64 /tr "C:\Users\Admin\btpanui\SystemPropertiesPerformance.exe" /sc minute /mo 1 /F2⤵
- Scheduled Task/Job: Scheduled Task
PID:2748
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 3224 -ip 32241⤵PID:2824
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2412 -ip 24121⤵PID:3544
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:2312
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵PID:3996
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD510eab9c2684febb5327b6976f2047587
SHA1a12ed54146a7f5c4c580416aecb899549712449e
SHA256f49dbd55029bfbc15134f7c6a4f967d6c39142c63f2e8f1f8c78fab108a2c928
SHA5127e5fd90fffae723bd0c662a90e0730b507805f072771ee673d1d8c262dbf60c8a03ba5fe088f699a97c2e886380de158b2ccd59ee62e3d012dd6dd14ea9d0e50
-
Filesize
208B
MD5bf9d0ee0061887b9bc752299eee6bc40
SHA13760f36ff25a5acda5303a3ca931a28de1f4d478
SHA256ba5717fd18eae803ca55a7e36e5d06071d28fbd80666095d41c0bb1493fc2410
SHA51240b4c3ccecda74caa7ecae347817db907015eab86b5a092b19f16a3e30b7bafb40bc3a79fffb924af52ff6429dd633538e0d1e56c7ca1880ceac00043d25914d
-
Filesize
405KB
MD5b8ba87ee4c3fc085a2fed0d839aadce1
SHA1b3a2e3256406330e8b1779199bb2b9865122d766
SHA2564e8a99cd33c9e5c747a3ce8f1a3e17824846f4a8f7cb0631aebd0815db2ce3a4
SHA5127a775a12cd5bcd182d64be0d31f800b456ca6d1b531189cea9c72e1940871cfe92ccd005938f67bfa4784ae44c54b3a7ea29a5bb59766e98c78bf53b680f2ab2
-
Filesize
349KB
MD5b4a202e03d4135484d0e730173abcc72
SHA101b30014545ea526c15a60931d676f9392ea0c70
SHA2567050608d53f80269df951d00883ed79815c060ce7678a76b5c3f6a2a985beea9
SHA512632a035a3b722ea29b02aad1f0da3df5bdc38abc7e6617223790955c6c0830f1070b528680416d5c63ea5e846074cdad87f06c21c35a77b1ccc4edc089d8b1fb
-
Filesize
224B
MD53536f459342bf02c4b10fa4d0464283b
SHA13ef60b38e089ede43c9d2468f1aa2ea042b95e84
SHA256a217dea7b1bc75eebb4caa5a6e781d1df3c7b3a3be5e8051fdc220f34af4de06
SHA512677aeddc3c8c269d472e74f8e15f9c4924e739f0306edef1adf939acf5549448e479715bf84ba0ea23292361ed181970b7dc00ec63520ce65d3a4660df03082f
-
Filesize
2.0MB
MD593663488a41b6c34a283fcee40721fad
SHA1da232b7411ae1f38b1152ff098286c54190163bd
SHA2564534eb06846d074686ce3fe1d18b4173fe30adab26211407576a15c2c3723c22
SHA51237b76b7a206926791488cc3a610669b35901e70cb5f92375f06bb5751dedaea72caf39c60d10979aadf03057b1c9329a6a3cd9262ac69ce9864e409aeebfede6