875c1d415ffde3210ff70471ba63a4c97da58094941a2aff72e1f8d21ee93b06

Analysis

max time kernel
118s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MikeStore.exe
Size 8.3MB
Sample240306-sljl7sbb28
SHA256 875c1d415ffde3210ff70471ba63a4c97da58094941a2aff72e1f8d21ee93b06
MD5 49b93b5b2fafa2a9c518c6c6ec39ea55
SHA1 25702ef6e37b2ca8ccc94a208bfc964345a53d2a
SHA512 75050ef17fae7a5f41808c69953255c7fd1bcf9f25adbe98541186e9ddb1483adffab43f0fb5c0f288176fccd8dc9183e0611d2df20a5225dafce875767b0ceb
SSDEEP 196608:E3BVBVB4B9bHH9SQOUXXHTmf31A+7KPdpa0DGiCUurF5OF:0//+9LH9nOUHzx+YpayJCOF
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery exploit

Malware Config

Signatures

Possible privilege escalation attempt 4 IoCs

exploit

pid	Process
2196	takeown.exe
4656	icacls.exe
1504	takeown.exe
1096	icacls.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	MikeStore.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2196	takeown.exe
4656	icacls.exe
1504	takeown.exe
1096	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 4 IoCs

evasion

pid	Process
2184	taskkill.exe
2244	taskkill.exe
436	taskkill.exe
3940	taskkill.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold2 = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold1 = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseSpeed = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseSpeed = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseSpeed = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold1 = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold1 = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold2 = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseSpeed = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold1 = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold2 = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold2 = "0"	regedit.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold1 = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold2 = "0"	regedit.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold1 = "0"	regedit.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseSpeed = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseSpeed = "0"	regedit.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseSpeed = "0"	regedit.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold1 = "0"	regedit.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse	regedit.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold2 = "0"	regedit.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Control Panel\Mouse\MouseThreshold2 = "0"	regedit.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	MikeStore.exe

Runs .reg file with regedit 49 IoCs

pid	Process
2100	regedit.exe
3600	regedit.exe
2092	regedit.exe
1828	regedit.exe
4092	regedit.exe
2356	regedit.exe
4452	regedit.exe
3744	regedit.exe
3780	regedit.exe
3776	regedit.exe
3276	regedit.exe
3800	regedit.exe
2416	regedit.exe
468	regedit.exe
3312	regedit.exe
2440	regedit.exe
3556	regedit.exe
2192	regedit.exe
4656	regedit.exe
3724	regedit.exe
3096	regedit.exe
432	regedit.exe
3516	regedit.exe
1604	regedit.exe
3672	regedit.exe
2780	regedit.exe
4424	regedit.exe
4356	regedit.exe
2012	regedit.exe
3832	regedit.exe
2364	regedit.exe
388	regedit.exe
2112	regedit.exe
3808	regedit.exe
4940	regedit.exe
1992	regedit.exe
3096	regedit.exe
2696	regedit.exe
3868	regedit.exe
2340	regedit.exe
1952	regedit.exe
2672	regedit.exe
4188	regedit.exe
4288	regedit.exe
1288	regedit.exe
2952	regedit.exe
2728	regedit.exe
4876	regedit.exe
3724	regedit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1528	MikeStore.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1528	MikeStore.exe
Token: SeDebugPrivilege	2184	taskkill.exe
Token: SeDebugPrivilege	2244	taskkill.exe
Token: SeDebugPrivilege	436	taskkill.exe
Token: SeDebugPrivilege	3940	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 1756	1528	MikeStore.exe	106
PID 1528 wrote to memory of 1756	1528	MikeStore.exe	106
PID 1528 wrote to memory of 1756	1528	MikeStore.exe	106
PID 1528 wrote to memory of 436	1528	MikeStore.exe	108
PID 1528 wrote to memory of 436	1528	MikeStore.exe	108
PID 1528 wrote to memory of 436	1528	MikeStore.exe	108
PID 436 wrote to memory of 2184	436	cmd.exe	110
PID 436 wrote to memory of 2184	436	cmd.exe	110
PID 436 wrote to memory of 2184	436	cmd.exe	110
PID 436 wrote to memory of 2244	436	cmd.exe	111
PID 436 wrote to memory of 2244	436	cmd.exe	111
PID 436 wrote to memory of 2244	436	cmd.exe	111
PID 436 wrote to memory of 2196	436	cmd.exe	112
PID 436 wrote to memory of 2196	436	cmd.exe	112
PID 436 wrote to memory of 2196	436	cmd.exe	112
PID 436 wrote to memory of 4656	436	cmd.exe	113
PID 436 wrote to memory of 4656	436	cmd.exe	113
PID 436 wrote to memory of 4656	436	cmd.exe	113
PID 1528 wrote to memory of 3520	1528	MikeStore.exe	114
PID 1528 wrote to memory of 3520	1528	MikeStore.exe	114
PID 1528 wrote to memory of 3520	1528	MikeStore.exe	114
PID 1528 wrote to memory of 2964	1528	MikeStore.exe	116
PID 1528 wrote to memory of 2964	1528	MikeStore.exe	116
PID 1528 wrote to memory of 2964	1528	MikeStore.exe	116
PID 1528 wrote to memory of 756	1528	MikeStore.exe	118
PID 1528 wrote to memory of 756	1528	MikeStore.exe	118
PID 1528 wrote to memory of 756	1528	MikeStore.exe	118
PID 1528 wrote to memory of 3700	1528	MikeStore.exe	120
PID 1528 wrote to memory of 3700	1528	MikeStore.exe	120
PID 1528 wrote to memory of 3700	1528	MikeStore.exe	120
PID 3700 wrote to memory of 4444	3700	cmd.exe	122
PID 3700 wrote to memory of 4444	3700	cmd.exe	122
PID 3700 wrote to memory of 4444	3700	cmd.exe	122
PID 1528 wrote to memory of 3312	1528	MikeStore.exe	123
PID 1528 wrote to memory of 3312	1528	MikeStore.exe	123
PID 1528 wrote to memory of 3312	1528	MikeStore.exe	123
PID 1528 wrote to memory of 2196	1528	MikeStore.exe	125
PID 1528 wrote to memory of 2196	1528	MikeStore.exe	125
PID 1528 wrote to memory of 2196	1528	MikeStore.exe	125
PID 2196 wrote to memory of 436	2196	cmd.exe	127
PID 2196 wrote to memory of 436	2196	cmd.exe	127
PID 2196 wrote to memory of 436	2196	cmd.exe	127
PID 2196 wrote to memory of 3940	2196	cmd.exe	128
PID 2196 wrote to memory of 3940	2196	cmd.exe	128
PID 2196 wrote to memory of 3940	2196	cmd.exe	128
PID 2196 wrote to memory of 1504	2196	cmd.exe	129
PID 2196 wrote to memory of 1504	2196	cmd.exe	129
PID 2196 wrote to memory of 1504	2196	cmd.exe	129
PID 2196 wrote to memory of 1096	2196	cmd.exe	130
PID 2196 wrote to memory of 1096	2196	cmd.exe	130
PID 2196 wrote to memory of 1096	2196	cmd.exe	130
PID 1528 wrote to memory of 1544	1528	MikeStore.exe	131
PID 1528 wrote to memory of 1544	1528	MikeStore.exe	131
PID 1528 wrote to memory of 1544	1528	MikeStore.exe	131
PID 1528 wrote to memory of 1020	1528	MikeStore.exe	133
PID 1528 wrote to memory of 1020	1528	MikeStore.exe	133
PID 1528 wrote to memory of 1020	1528	MikeStore.exe	133
PID 1528 wrote to memory of 4800	1528	MikeStore.exe	135
PID 1528 wrote to memory of 4800	1528	MikeStore.exe	135
PID 1528 wrote to memory of 4800	1528	MikeStore.exe	135
PID 1528 wrote to memory of 2364	1528	MikeStore.exe	137
PID 1528 wrote to memory of 2364	1528	MikeStore.exe	137
PID 1528 wrote to memory of 2364	1528	MikeStore.exe	137
PID 1528 wrote to memory of 3868	1528	MikeStore.exe	138

C:\Users\Admin\AppData\Local\Temp\MikeStore.exe
"C:\Users\Admin\AppData\Local\Temp\MikeStore.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\limpar_residuos_.bat"
  2⤵
  PID:1756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4_Limpar_Cache_de_Navegador.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "ccleaner64.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "ccleaner.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- - C:\Windows\SysWOW64\takeown.exe
    takeown /A /R /D Y /F C:\Users\Admin\AppData\Local\Temp\
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:2196
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\ /grant administradores:F /T /C
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:4656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Deletar_Arquivos_Temporarios.bat"
  2⤵
  PID:3520
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Limpador_de_Cache.bat"
  2⤵
  PID:2964
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Limpeza_automatica.bat"
  2⤵
  PID:756
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Painel_Clean.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\SysWOW64\mode.com
    MODE 50,17
    3⤵
    PID:4444
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\limpar_residuos_.bat"
  2⤵
  PID:3312
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\4_Limpar_Cache_de_Navegador.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "ccleaner64.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:436
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM "ccleaner.exe"
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3940
- - C:\Windows\SysWOW64\takeown.exe
    takeown /A /R /D Y /F C:\Users\Admin\AppData\Local\Temp\
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1504
- - C:\Windows\SysWOW64\icacls.exe
    icacls C:\Users\Admin\AppData\Local\Temp\ /grant administradores:F /T /C
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:1096
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Deletar_Arquivos_Temporarios.bat"
  2⤵
  PID:1544
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Limpador_de_Cache.bat"
  2⤵
  PID:1020
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Limpeza_automatica.bat"
  2⤵
  PID:4800
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desativar_Diagnostico_e_Telemetria.reg_ex=65fae9f2&is=65e874f2&hm=c6a0d5b02e02d91c6c2720bfbd3c4f51703a8768fcdeaa186f7f0cfcb727aa94&"
  2⤵
  - Runs .reg file with regedit
  PID:2364
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Ajustes_de_Registro.reg_ex=65fae9f2&is=65e874f2&hm=d125db065583f4cc0c3ff7fb2002cc2dd2c7f6dc3090514bbfebf979ad788b16&"
  2⤵
  - Runs .reg file with regedit
  PID:3868
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Painel_Clean.bat"
  2⤵
  PID:4208
- - C:\Windows\SysWOW64\mode.com
    MODE 50,17
    3⤵
    PID:4520
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Aumentar_Capacidade_de_Resposta.reg_ex=65fae9f2&is=65e874f2&hm=df6165717b607c5f87771df8cd46e5e65023cc6c07e923c0518c24642fe5340c&"
  2⤵
  - Runs .reg file with regedit
  PID:2728
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Aumente_FPS_nos_Jogos.reg_ex=65fae9f3&is=65e874f3&hm=b0fdca45e45de57b65aea2e54bafc5d3e84fcdabe099507010c72738179e8b7d&"
  2⤵
  - Runs .reg file with regedit
  PID:2440
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desabilitar_AMS.reg_ex=65fae9f3&is=65e874f3&hm=86a184eb7c98d7a500758a678ca56ed586260836af74df148da73e0ce130ddc0&"
  2⤵
  - Runs .reg file with regedit
  PID:3276
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desabilitar_gerenciador_de_mapas.reg_ex=65fae9f3&is=65e874f3&hm=1337082ba339c0397b357aeead04e2a5460f11009768a42214bdca6e52d8e223&"
  2⤵
  - Runs .reg file with regedit
  PID:1604
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desabilitar_servicos_do_Xbox.reg_ex=65fae9f3&is=65e874f3&hm=1c009cb6ddade04641601cc9cd70cdd2a81fde80f01438efe71abff876a75ff2&"
  2⤵
  - Runs .reg file with regedit
  PID:3800
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desabilitar_servicos_extras_desnecessarios.reg_ex=65fae9f3&is=65e874f3&hm=5ee15e5419e06ded87f813df69ded2d8f121873c2cdc63e81493b02e421ab054&"
  2⤵
  - Runs .reg file with regedit
  PID:468
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desabilitar_telemetria_e_diagnosticos.reg_ex=65fae9f3&is=65e874f3&hm=f0f7f2008e7ac49465c4cb566da64a72f058774331d0885ebbd661106cc897af&"
  2⤵
  - Runs .reg file with regedit
  PID:4092
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\DESABILITAR_POWER_THROTTLING.reg_ex=65fae9f3&is=65e874f3&hm=bb964de40bb006f9efb071ba8bf74cc38e2c82dbf5ae36c750040702c4b61f0c&"
  2⤵
  - Runs .reg file with regedit
  PID:388
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desativar_Power_Throttling.reg_ex=65fae9f6&is=65e874f6&hm=27bcdc096487385b183605d452cb383187c7e7e10aed94098be01f895fe2118a&"
  2⤵
  - Runs .reg file with regedit
  PID:3600
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desativar_Power_Throttling2.reg_ex=65fae9f6&is=65e874f6&hm=5587e4f5f19b9ac42d6f6b21882f131042e415a710df3817c36d0cdc617eb56e&"
  2⤵
  - Runs .reg file with regedit
  PID:4188
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desativar_Servicos_Extras_Desnecessarios.reg_ex=65fae9f6&is=65e874f6&hm=c4c5c893ee9ac5530f4743d5eabe483f3cc52a748b2922ea523a72c9d02416c5&"
  2⤵
  - Runs .reg file with regedit
  PID:3724
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desativar_Diagnostico_e_Telemetria.reg_ex=65fae9f2&is=65e874f2&hm=c6a0d5b02e02d91c6c2720bfbd3c4f51703a8768fcdeaa186f7f0cfcb727aa94&"
  2⤵
  - Runs .reg file with regedit
  PID:4656
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Ajustes_de_Registro.reg_ex=65fae9f2&is=65e874f2&hm=d125db065583f4cc0c3ff7fb2002cc2dd2c7f6dc3090514bbfebf979ad788b16&"
  2⤵
  - Runs .reg file with regedit
  PID:4452
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Aumentar_Capacidade_de_Resposta.reg_ex=65fae9f2&is=65e874f2&hm=df6165717b607c5f87771df8cd46e5e65023cc6c07e923c0518c24642fe5340c&"
  2⤵
  - Runs .reg file with regedit
  PID:4288
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Aumente_FPS_nos_Jogos.reg_ex=65fae9f3&is=65e874f3&hm=b0fdca45e45de57b65aea2e54bafc5d3e84fcdabe099507010c72738179e8b7d&"
  2⤵
  - Runs .reg file with regedit
  PID:3096
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desabilitar_AMS.reg_ex=65fae9f3&is=65e874f3&hm=86a184eb7c98d7a500758a678ca56ed586260836af74df148da73e0ce130ddc0&"
  2⤵
  - Runs .reg file with regedit
  PID:3312
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desabilitar_gerenciador_de_mapas.reg_ex=65fae9f3&is=65e874f3&hm=1337082ba339c0397b357aeead04e2a5460f11009768a42214bdca6e52d8e223&"
  2⤵
  - Runs .reg file with regedit
  PID:2192
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desabilitar_servicos_do_Xbox.reg_ex=65fae9f3&is=65e874f3&hm=1c009cb6ddade04641601cc9cd70cdd2a81fde80f01438efe71abff876a75ff2&"
  2⤵
  - Runs .reg file with regedit
  PID:1952
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desabilitar_servicos_extras_desnecessarios.reg_ex=65fae9f3&is=65e874f3&hm=5ee15e5419e06ded87f813df69ded2d8f121873c2cdc63e81493b02e421ab054&"
  2⤵
  - Runs .reg file with regedit
  PID:2780
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desabilitar_telemetria_e_diagnosticos.reg_ex=65fae9f3&is=65e874f3&hm=f0f7f2008e7ac49465c4cb566da64a72f058774331d0885ebbd661106cc897af&"
  2⤵
  - Runs .reg file with regedit
  PID:3744
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\DESABILITAR_POWER_THROTTLING.reg_ex=65fae9f3&is=65e874f3&hm=bb964de40bb006f9efb071ba8bf74cc38e2c82dbf5ae36c750040702c4b61f0c&"
  2⤵
  - Runs .reg file with regedit
  PID:3672
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desativar_Power_Throttling.reg_ex=65fae9f6&is=65e874f6&hm=27bcdc096487385b183605d452cb383187c7e7e10aed94098be01f895fe2118a&"
  2⤵
  - Runs .reg file with regedit
  PID:4424
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desativar_Power_Throttling2.reg_ex=65fae9f6&is=65e874f6&hm=5587e4f5f19b9ac42d6f6b21882f131042e415a710df3817c36d0cdc617eb56e&"
  2⤵
  - Runs .reg file with regedit
  PID:4356
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Desativar_Servicos_Extras_Desnecessarios.reg_ex=65fae9f6&is=65e874f6&hm=c4c5c893ee9ac5530f4743d5eabe483f3cc52a748b2922ea523a72c9d02416c5&"
  2⤵
  - Runs .reg file with regedit
  PID:2356
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Fix_delay.reg_ex=65faf16e&is=65e87c6e&hm=c10b718ca13d4ec380e26ce2cd880f07a48b2c76059d45f674866f73a446aa1d&"
  2⤵
  - Modifies data under HKEY_USERS
  - Runs .reg file with regedit
  PID:2112
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Correcao_de_tela_inteira.reg_ex=65faf16e&is=65e87c6e&hm=a431613bca659e231fa03024153900f6e006250d74190eb98143673dcbf656b1&"
  2⤵
  - Runs .reg file with regedit
  PID:3780
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\DELAY_TELA.reg_ex=65faf16e&is=65e87c6e&hm=3453271cda331dcb2cc177c5647e97cd8299a96e2c1b0dca1c285722ad361d53&"
  2⤵
  - Runs .reg file with regedit
  PID:4876
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\16GB_Ram.reg_ex=65faf641&is=65e88141&hm=17dce702b1bde56d8148b833ae3c02b3d067607ed54d859ef5ff0bc0945cd82e&"
  2⤵
  - Runs .reg file with regedit
  PID:3776
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\BOOST_PING.reg_ex=65faf2fe&is=65e87dfe&hm=71dce47654197a835e2c42fdefa38ad624b57a6b00fa201014ab619d0c0bcc4b&"
  2⤵
  - Runs .reg file with regedit
  PID:3724
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\latencia_ultra_baixa.reg_ex=65faf2fe&is=65e87dfe&hm=9bb4a29dbe1942a5805e45d25f6eb39c7fbb054c3301b09a7d0b06dcc57a4120&"
  2⤵
  - Runs .reg file with regedit
  PID:1288
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SO_PRA_WINDOWNS_10.bat"
  2⤵
  PID:5104
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Fix_delay.reg_ex=65faf16e&is=65e87c6e&hm=c10b718ca13d4ec380e26ce2cd880f07a48b2c76059d45f674866f73a446aa1d&"
  2⤵
  - Modifies data under HKEY_USERS
  - Runs .reg file with regedit
  PID:2952
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Fix_delay.reg_ex=65faf16e&is=65e87c6e&hm=c10b718ca13d4ec380e26ce2cd880f07a48b2c76059d45f674866f73a446aa1d&"
  2⤵
  - Modifies data under HKEY_USERS
  - Runs .reg file with regedit
  PID:3096
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Correcao_de_tela_inteira.reg_ex=65faf16e&is=65e87c6e&hm=a431613bca659e231fa03024153900f6e006250d74190eb98143673dcbf656b1&"
  2⤵
  - Runs .reg file with regedit
  PID:3808
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Correcao_de_tela_inteira.reg_ex=65faf16e&is=65e87c6e&hm=a431613bca659e231fa03024153900f6e006250d74190eb98143673dcbf656b1&"
  2⤵
  - Runs .reg file with regedit
  PID:2012
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Fix_delay.reg_ex=65faf16e&is=65e87c6e&hm=c10b718ca13d4ec380e26ce2cd880f07a48b2c76059d45f674866f73a446aa1d&"
  2⤵
  - Modifies data under HKEY_USERS
  - Runs .reg file with regedit
  PID:2696
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\DELAY_TELA.reg_ex=65faf16e&is=65e87c6e&hm=3453271cda331dcb2cc177c5647e97cd8299a96e2c1b0dca1c285722ad361d53&"
  2⤵
  - Runs .reg file with regedit
  PID:4940
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\DELAY_TELA.reg_ex=65faf16e&is=65e87c6e&hm=3453271cda331dcb2cc177c5647e97cd8299a96e2c1b0dca1c285722ad361d53&"
  2⤵
  - Runs .reg file with regedit
  PID:2100
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Correcao_de_tela_inteira.reg_ex=65faf16e&is=65e87c6e&hm=a431613bca659e231fa03024153900f6e006250d74190eb98143673dcbf656b1&"
  2⤵
  - Runs .reg file with regedit
  PID:1992
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Fix_delay.reg_ex=65faf16e&is=65e87c6e&hm=c10b718ca13d4ec380e26ce2cd880f07a48b2c76059d45f674866f73a446aa1d&"
  2⤵
  - Modifies data under HKEY_USERS
  - Runs .reg file with regedit
  PID:3556
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\DELAY_TELA.reg_ex=65faf16e&is=65e87c6e&hm=3453271cda331dcb2cc177c5647e97cd8299a96e2c1b0dca1c285722ad361d53&"
  2⤵
  - Runs .reg file with regedit
  PID:2092
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Fix_delay.reg_ex=65faf16e&is=65e87c6e&hm=c10b718ca13d4ec380e26ce2cd880f07a48b2c76059d45f674866f73a446aa1d&"
  2⤵
  - Modifies data under HKEY_USERS
  - Runs .reg file with regedit
  PID:3832
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Correcao_de_tela_inteira.reg_ex=65faf16e&is=65e87c6e&hm=a431613bca659e231fa03024153900f6e006250d74190eb98143673dcbf656b1&"
  2⤵
  - Runs .reg file with regedit
  PID:432
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\DELAY_TELA.reg_ex=65faf16e&is=65e87c6e&hm=3453271cda331dcb2cc177c5647e97cd8299a96e2c1b0dca1c285722ad361d53&"
  2⤵
  - Runs .reg file with regedit
  PID:2672
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Fix_delay.reg_ex=65faf16e&is=65e87c6e&hm=c10b718ca13d4ec380e26ce2cd880f07a48b2c76059d45f674866f73a446aa1d&"
  2⤵
  - Modifies data under HKEY_USERS
  - Runs .reg file with regedit
  PID:1828
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Correcao_de_tela_inteira.reg_ex=65faf16e&is=65e87c6e&hm=a431613bca659e231fa03024153900f6e006250d74190eb98143673dcbf656b1&"
  2⤵
  - Runs .reg file with regedit
  PID:2416
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\Correcao_de_tela_inteira.reg_ex=65faf16e&is=65e87c6e&hm=a431613bca659e231fa03024153900f6e006250d74190eb98143673dcbf656b1&"
  2⤵
  - Runs .reg file with regedit
  PID:2340
- C:\Windows\SysWOW64\regedit.exe
  "C:\Windows\System32\regedit.exe" /s "C:\Users\Admin\AppData\Local\Temp\DELAY_TELA.reg_ex=65faf16e&is=65e87c6e&hm=3453271cda331dcb2cc177c5647e97cd8299a96e2c1b0dca1c285722ad361d53&"
  2⤵
  - Runs .reg file with regedit
  PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16GB_Ram.reg_ex=65faf641&is=65e88141&hm=17dce702b1bde56d8148b833ae3c02b3d067607ed54d859ef5ff0bc0945cd82e&

Path C:\Users\Admin\AppData\Local\Temp\16GB_Ram.reg_ex=65faf641&is=65e88141&hm=17dce702b1bde56d8148b833ae3c02b3d067607ed54d859ef5ff0bc0945cd82e&
Size 137B
SHA256 a27cf71bd1a628a48ea81aaca3f3665acdbbc77cce85c9a97ce4634ddb26f963
MD5 ffdf200411c966acec75b96b695d7b56
SHA1 3d09a59e0210478a862ead643d2de354dc76ae66
SHA512 107a593abf311bafad7a9ec41ebd0bdead3c7b6a7da647d14df7e924ebb9c6bd111bcce6e732e43716bf9783314cd208d2b837297fa4f606087e4a5e61ac16a6
MD5 SHA1 SHA512

Submit Download

4_Limpar_Cache_de_Navegador.bat

Path C:\Users\Admin\AppData\Local\Temp\4_Limpar_Cache_de_Navegador.bat
Size 12KB
SHA256 a62aa8843d3abb7308ac89cf1d109bf47073949a8e6fa77f12fe4c98e4d08d6a
MD5 280a2bb1d32aa4cb7de26c4433f88c10
SHA1 48b285ccb69358c25b7ce68c3436e31c506389d4
SHA512 f64ffb1d88d33066e39ebfcc19fc10ee40c28380389674b7af57e8d13a434cb8acc2bdbdbe63e3aca2435df636e65850d34a247b1f96043b11916c69c6e0c7cf
SSDEEP 192:FgYUxl+6v3eD6TdzEwiDp3dnrInfBk0msnsmQfJX9nLgd3C:FbeY6v3ZdzuMIEd3C
MD5 SHA1 SHA512 SSDEEP

Submit Download

Ajustes_de_Registro.reg_ex=65fae9f2&is=65e874f2&hm=d125db065583f4cc0c3ff7fb2002cc2dd2c7f6dc3090514bbfebf979ad788b16&

Path C:\Users\Admin\AppData\Local\Temp\Ajustes_de_Registro.reg_ex=65fae9f2&is=65e874f2&hm=d125db065583f4cc0c3ff7fb2002cc2dd2c7f6dc3090514bbfebf979ad788b16&
Size 1KB
SHA256 7ef7b6062f3adf01d35d48e6cb9b91ab9fdbbf204bb28f9f95879bfc4d8aebd5
MD5 bcff2d78f496c517c275738f4e3d24a3
SHA1 8d0985f2d79c093cf0b2d640972af39bcb4a1a98
SHA512 ced78e5924d177a73ee36b16231781023a095d15a10a02573816bbea7f6023ce48eeb17d1f6487457c25c2a5e0858b6eff11c914de8c2e76a69521ae437b164e
MD5 SHA1 SHA512

Submit Download

Aumentar_Capacidade_de_Resposta.reg_ex=65fae9f2&is=65e874f2&hm=df6165717b607c5f87771df8cd46e5e65023cc6c07e923c0518c24642fe5340c&

Path C:\Users\Admin\AppData\Local\Temp\Aumentar_Capacidade_de_Resposta.reg_ex=65fae9f2&is=65e874f2&hm=df6165717b607c5f87771df8cd46e5e65023cc6c07e923c0518c24642fe5340c&
Size 545B
SHA256 297bfbed6e72f2bff70cf74124720dbccc5e672a60207167d55005438e809002
MD5 c1e6f84cf8ce8ab5aa8e1efd100f3cfe
SHA1 93daeab2ccad66c67242619215e9447d5021bf1b
SHA512 bc22e44ec348f5d12b59ab67fc16a017e1c6900dc4f6960af71e8a85689cdbc87101a0c9002459bd8ea79ed6c4904c851c7ec15b7e2586b25419cff873d2ba94
MD5 SHA1 SHA512

Submit Download

Aumente_FPS_nos_Jogos.reg_ex=65fae9f3&is=65e874f3&hm=b0fdca45e45de57b65aea2e54bafc5d3e84fcdabe099507010c72738179e8b7d&

Path C:\Users\Admin\AppData\Local\Temp\Aumente_FPS_nos_Jogos.reg_ex=65fae9f3&is=65e874f3&hm=b0fdca45e45de57b65aea2e54bafc5d3e84fcdabe099507010c72738179e8b7d&
Size 2KB
SHA256 d7bde3f4047a9d3f056561abfc2c9564a14684fa31c61284da7b0d0ed5f65931
MD5 556f113e7ab0cd6ff9786419d52db540
SHA1 49f738ed0bde4ba7ee127e28a2268665eecdefbe
SHA512 43f5808918287bf3cb709333b0c024b0cc34b1c90518bfbc70e10f6e177dcb4e75c40bd65abcc24e68aff0ecc2fee3b1db1c8bd0b1ab723e1114230a2344b652
MD5 SHA1 SHA512

Submit Download

BOOST_PING.reg_ex=65faf2fe&is=65e87dfe&hm=71dce47654197a835e2c42fdefa38ad624b57a6b00fa201014ab619d0c0bcc4b&

Path C:\Users\Admin\AppData\Local\Temp\BOOST_PING.reg_ex=65faf2fe&is=65e87dfe&hm=71dce47654197a835e2c42fdefa38ad624b57a6b00fa201014ab619d0c0bcc4b&
Size 582B
SHA256 7c007a70bf7548469aebe6d7381c8eda966d9958aacb8c54a62cee879890aadd
MD5 f477d82dd392483e1a21ada25a74b686
SHA1 e235f896752d2402c0e289244082976f2f56d120
SHA512 134ddfeef872eec62837884d0de8a35ce87b962f39ddd4dc7e107852cec946966889d7826c6de28f59d0f8a3302d90fbfb9690772cfbeeae79b7119ef0837099
MD5 SHA1 SHA512

Submit Download

Correcao_de_tela_inteira.reg_ex=65faf16e&is=65e87c6e&hm=a431613bca659e231fa03024153900f6e006250d74190eb98143673dcbf656b1&

Path C:\Users\Admin\AppData\Local\Temp\Correcao_de_tela_inteira.reg_ex=65faf16e&is=65e87c6e&hm=a431613bca659e231fa03024153900f6e006250d74190eb98143673dcbf656b1&
Size 279B
SHA256 7628f075e97778b7db2934c93867e7215a15e72245fe5cf60516d65555e54d39
MD5 1efa1f60f8b3847337395c99b52aa7cc
SHA1 71800f784787d4a51538e267cfe80c7eeac73f20
SHA512 ff00dc633c51dd903db4795c18791ca64240a77181a9014a8a4137a7c725d07f775b56bd6302408b38e9ebb077aa1fc095629649c782e0799a48375fe742e01c
MD5 SHA1 SHA512

Submit Download

DELAY_TELA.reg_ex=65faf16e&is=65e87c6e&hm=3453271cda331dcb2cc177c5647e97cd8299a96e2c1b0dca1c285722ad361d53&

Path C:\Users\Admin\AppData\Local\Temp\DELAY_TELA.reg_ex=65faf16e&is=65e87c6e&hm=3453271cda331dcb2cc177c5647e97cd8299a96e2c1b0dca1c285722ad361d53&
Size 824B
SHA256 fc6716f45a621d203764c4386402d6edb0ff749929de58750500368535d66c5e
MD5 b3f892eed310b4474886c017a7bc625f
SHA1 01604bee1bb85201f9970678a8c5f4564c4e941d
SHA512 71ceabcb9645f5b7ed49c5a09a2536f71287b4e1b4dfa50f2521cfdf0258068be6c9953607203c9c784a065ac6fac7e48481a7ba85d8e5b0e023e4137d2d270f
MD5 SHA1 SHA512

Submit Download

DESABILITAR_POWER_THROTTLING.reg_ex=65fae9f3&is=65e874f3&hm=bb964de40bb006f9efb071ba8bf74cc38e2c82dbf5ae36c750040702c4b61f0c&

Path C:\Users\Admin\AppData\Local\Temp\DESABILITAR_POWER_THROTTLING.reg_ex=65fae9f3&is=65e874f3&hm=bb964de40bb006f9efb071ba8bf74cc38e2c82dbf5ae36c750040702c4b61f0c&
Size 152B
SHA256 ea80154db4d06c26acd384576f83d1eb05ea0bf6e38199fbb764e4e1e78f8593
MD5 7648619f39a1f30b7ac71f236ba01798
SHA1 343e39b8d3b54ffb2d6e765f3d6248f9c2a6cfc3
SHA512 01492ba609ff03524e32fc99d364a83866334006a9e442dcc88ff9623abdc203926ebd4e092c551ae53836d79bfdd7c79bb7712cd90f7237c774ace0cd97990d
MD5 SHA1 SHA512

Submit Download

Deletar_Arquivos_Temporarios.bat

Path C:\Users\Admin\AppData\Local\Temp\Deletar_Arquivos_Temporarios.bat
Size 228B
SHA256 aff91a4ea10ed45c89fd9f3a458750b6e8ef20fc1f183badc9f8146db96aa097
MD5 113d18ab90d083d64af29e80c86a6c49
SHA1 daf71c0f1a767b4f3011fe6d68b369d284dc0357
SHA512 4dc0b89012da0167f9a5872a1e28beb56ff7807814f0d1bedb0747ff29006a7d971b6fbad9e9df4751f15b5eb21b0b4704e201989cab36f1dc27c8626ef51d44
MD5 SHA1 SHA512

Submit Download

Desabilitar_AMS.reg_ex=65fae9f3&is=65e874f3&hm=86a184eb7c98d7a500758a678ca56ed586260836af74df148da73e0ce130ddc0&

Path C:\Users\Admin\AppData\Local\Temp\Desabilitar_AMS.reg_ex=65fae9f3&is=65e874f3&hm=86a184eb7c98d7a500758a678ca56ed586260836af74df148da73e0ce130ddc0&
Size 322B
SHA256 08cc5dbfb93de534e59974b2d35a9bd3e700d579eb884b33c241659af0773d25
MD5 66ffb562a36cadd895cf4469cab69658
SHA1 f74ef7ef38647bca947619127053fb199ad258a9
SHA512 baaac32642c3dc29177306ce0edc8b14a626f7eb9696d3b193a5ec3f0127277844cc90df0927248699a643d1c66fa46ee1a7c56d9d811c3affa8cd9fc06afc4b
MD5 SHA1 SHA512

Submit Download

Desabilitar_gerenciador_de_mapas.reg_ex=65fae9f3&is=65e874f3&hm=1337082ba339c0397b357aeead04e2a5460f11009768a42214bdca6e52d8e223&

Path C:\Users\Admin\AppData\Local\Temp\Desabilitar_gerenciador_de_mapas.reg_ex=65fae9f3&is=65e874f3&hm=1337082ba339c0397b357aeead04e2a5460f11009768a42214bdca6e52d8e223&
Size 354B
SHA256 57f1c79ef4929d5246b196f6f7db9fc95cdbb5379627170fde6e390eb26909b3
MD5 3e0e9fcd20fc2bd38f5b0eb3efc282d4
SHA1 76179bcc36016bf8dd0566320005df91a082dfcf
SHA512 0d29c6ad8b8be419d5db1e4cf52eca00aaa7f9a73f5cff8817efcfc1aee2738cee37693f668eea1e6e44c5d2117ef1e2b105e2f0a74e667a4e7f085d68a666d3
MD5 SHA1 SHA512

Submit Download

Desabilitar_servicos_do_Xbox.reg_ex=65fae9f3&is=65e874f3&hm=1c009cb6ddade04641601cc9cd70cdd2a81fde80f01438efe71abff876a75ff2&

Path C:\Users\Admin\AppData\Local\Temp\Desabilitar_servicos_do_Xbox.reg_ex=65fae9f3&is=65e874f3&hm=1c009cb6ddade04641601cc9cd70cdd2a81fde80f01438efe71abff876a75ff2&
Size 787B
SHA256 92533ff3527f364359a39be02999e2c9bd3638bfda0058bdaf2e0524dbdee59b
MD5 1c9f493edc27438382f56e0d3db74571
SHA1 15c3592cd3f8dff834fa0f00e5d772aec9a84365
SHA512 b03b88960a0d2fc40193b9dd3cbd778a7287d8ffd7582f33af11114e34f94f077096f56c7087dde9e2f392ee344bda44a9b532d74e58085601d39b74967214a1
MD5 SHA1 SHA512

Submit Download

Desabilitar_servicos_extras_desnecessarios.reg_ex=65fae9f3&is=65e874f3&hm=5ee15e5419e06ded87f813df69ded2d8f121873c2cdc63e81493b02e421ab054&

Path C:\Users\Admin\AppData\Local\Temp\Desabilitar_servicos_extras_desnecessarios.reg_ex=65fae9f3&is=65e874f3&hm=5ee15e5419e06ded87f813df69ded2d8f121873c2cdc63e81493b02e421ab054&
Size 1KB
SHA256 7dc7038c754f1fd2799ba6d4e09ce71d3e42970364ba10ead303c6e538b2e96a
MD5 a24b71a05f46cba8404c173401eb871b
SHA1 9013ce0be4774e40bef0fefadd4aca58e4bba647
SHA512 186165e1a924a8fb9e967cc383a6d57fee7c02caa917010154262295a29c6802ee3a94506b58541d1203f054bca05d2118d5d5c42fae8a4c26aa7d3aee05037b
MD5 SHA1 SHA512

Submit Download

Desabilitar_telemetria_e_diagnosticos.reg_ex=65fae9f3&is=65e874f3&hm=f0f7f2008e7ac49465c4cb566da64a72f058774331d0885ebbd661106cc897af&

Path C:\Users\Admin\AppData\Local\Temp\Desabilitar_telemetria_e_diagnosticos.reg_ex=65fae9f3&is=65e874f3&hm=f0f7f2008e7ac49465c4cb566da64a72f058774331d0885ebbd661106cc897af&
Size 1KB
SHA256 cc9a7213b918ee12fe92aa0afd4bef4645de80dfec97cff4446a8fe8ec30678c
MD5 91ef7ad21383c9d98de76ac2b5a1139f
SHA1 f300b7c21a73236388322e9ce4a2c44ea057bc82
SHA512 c18444f6491c12e2046ded3f5f2130d7938f7a145cda3e6a3c3861efb993c5839a7ac4555d8fefa07893a648cf1f7978c2684133d45cc35772b23628acf9cbfa
MD5 SHA1 SHA512

Submit Download

Desativar_Diagnostico_e_Telemetria.reg_ex=65fae9f2&is=65e874f2&hm=c6a0d5b02e02d91c6c2720bfbd3c4f51703a8768fcdeaa186f7f0cfcb727aa94&

Path C:\Users\Admin\AppData\Local\Temp\Desativar_Diagnostico_e_Telemetria.reg_ex=65fae9f2&is=65e874f2&hm=c6a0d5b02e02d91c6c2720bfbd3c4f51703a8768fcdeaa186f7f0cfcb727aa94&
Size 1KB
SHA256 f557a74e857c3b02577f7fbb105c37eebc9a798172be3216d99d9240c816063b
MD5 bad9a84e048fe168f1ec9e1ca8e1549f
SHA1 364667b8567eb30c84f4e94ab44e163106b0fb5c
SHA512 60970dbf641f6bc4a6a7bc86ad4685e4d405ae0c833d12635995dd513c4e6fe1215365f6155ce8459e376e92188e01e2d325e5a5d9199fb2fe43cc9a3fd741d3
MD5 SHA1 SHA512

Submit Download

Desativar_Power_Throttling.reg_ex=65fae9f6&is=65e874f6&hm=27bcdc096487385b183605d452cb383187c7e7e10aed94098be01f895fe2118a&

Path C:\Users\Admin\AppData\Local\Temp\Desativar_Power_Throttling.reg_ex=65fae9f6&is=65e874f6&hm=27bcdc096487385b183605d452cb383187c7e7e10aed94098be01f895fe2118a&
Size 1KB
SHA256 39336e4da196672cffc27d01b7a5b9f7358a919605dba440b011d67ed4c79b0a
MD5 475622ab39f8f5889da7b6d83ce3bf39
SHA1 13a863ec7237e7a7a919a8d87ed25ec575e7cc9c
SHA512 6a7abaca11499714bb056a6785b1b7de284f305dab0b6c02fc8c6314f761b400b1bae7d3addfb12baf8ee6c1ca2c1131d130c5c3c2807037fac5556a80d2ba9c
MD5 SHA1 SHA512

Submit Download

Desativar_Servicos_Extras_Desnecessarios.reg_ex=65fae9f6&is=65e874f6&hm=c4c5c893ee9ac5530f4743d5eabe483f3cc52a748b2922ea523a72c9d02416c5&

Path C:\Users\Admin\AppData\Local\Temp\Desativar_Servicos_Extras_Desnecessarios.reg_ex=65fae9f6&is=65e874f6&hm=c4c5c893ee9ac5530f4743d5eabe483f3cc52a748b2922ea523a72c9d02416c5&
Size 1KB
SHA256 b3e89f97f5b5b3d64f528ef788484a623563fef8db2052f6bd3daf363e7649b6
MD5 2c51577162e31aa48322b7a48b5682c5
SHA1 d141f1570cf42455af71414cbfd466289c677057
SHA512 ad8bcb44acd11941c7bffd550d3a3bc03f0da58d626791c6af9865973491459fb56b835ad1ca939d3588a9257b4907fe88ba1db3e25f26363fc13ea51c0c6427
MD5 SHA1 SHA512

Submit Download

Fix_delay.reg_ex=65faf16e&is=65e87c6e&hm=c10b718ca13d4ec380e26ce2cd880f07a48b2c76059d45f674866f73a446aa1d&

Path C:\Users\Admin\AppData\Local\Temp\Fix_delay.reg_ex=65faf16e&is=65e87c6e&hm=c10b718ca13d4ec380e26ce2cd880f07a48b2c76059d45f674866f73a446aa1d&
Size 549B
SHA256 df188d1be79d14accfb19af7477dccb4043b780a9ac3049213262696c815be56
MD5 8669d125c81ed14d2ff722e5c86df072
SHA1 ee9ec858483d04a7cdbbb4f69803ed299e0a39fb
SHA512 e366d71ccc7894df1975a5803213473793b82345b363b8a43dd2d44bee1e04c16ce701ba35907ab7a15a79fe7a1cc6af3e00c4ac44984e331bad862addc8897a
MD5 SHA1 SHA512

Submit Download

Limpador_de_Cache.bat

Path C:\Users\Admin\AppData\Local\Temp\Limpador_de_Cache.bat
Size 818B
SHA256 23fcccb30f22d62fc0298cd5b30438bdbb1306ee805d7eda9c9f89cf0f8d1390
MD5 2c2fa1a1b68ab3009c4005796c5fe33b
SHA1 c99e99b62fe3e5319805a3652ba9c0b9d2281788
SHA512 083f7171e7e9f0e7f7b74aac33d3daf4848780b50dd1e0db00442a023007e372bada84d14bd1a9f290dcfbc7869ac30cf6d94cf747f37edc89019c11689193fc
MD5 SHA1 SHA512

Submit Download

Limpeza_automatica.bat

Path C:\Users\Admin\AppData\Local\Temp\Limpeza_automatica.bat
Size 824B
SHA256 e0d757843483dadf7e2f51a526f8dbdfa2091e3a32133833535c0622ea082f84
MD5 b741f2a2026378cfc69acc3393eba109
SHA1 1066d6b0b1648d291a635f0dd0ca3b3d3e68b8a8
SHA512 def0b6a0e2fc776051e54fe95818b7a7a68905c3c38824d691ff092bb62c5502084d2f435cf4935e5c49fc131165efac03c116ab1f6ef8aaeb5e0a003067c63f
MD5 SHA1 SHA512

Submit Download

Painel_Clean.bat

Path C:\Users\Admin\AppData\Local\Temp\Painel_Clean.bat
Size 12KB
SHA256 5ba6427dead66427f6e543888305b57c294d8388f5b9d59ce5e6183d5bf74324
MD5 9a5833524990f15c3816903b4445a5b6
SHA1 e4cd8951424ae046306b2345fe62aded76015ca5
SHA512 d972c588bb997139f1de67c23853c706f20585c7bce92b033ff6672c38a8c840f7435ae0a75708abf1de716a30fa0bce837c2ffff98beea10f404247eb9ee016
SSDEEP 192:pcKk+zi1fLE/4XayT2h8/+hRCB4fmghJQCZLTbrZLyG:p3k+zi1fLE/4qC2h8nI7LQCZLnrZLyG
MD5 SHA1 SHA512 SSDEEP

Submit Download

SO_PRA_WINDOWNS_10.bat

Path C:\Users\Admin\AppData\Local\Temp\SO_PRA_WINDOWNS_10.bat
Size 784B
SHA256 13417a9f8069db2ef364fceb14ae8f7fe8677b33233d5a875ae279d50376fd89
MD5 b181bd58d14e911789130277feea4ee2
SHA1 75a42db5cffaeea2e987d72f8e645b69f3f01a26
SHA512 b1672b662e57abbe93386945903b22e9ccba0ccfbf1c05b53b0ae8bc1e80d692066f0ab179fc033edf091020eb5a63a90bdb744c5e67b75456961f3af9766b10
MD5 SHA1 SHA512

Submit Download

latencia_ultra_baixa.reg_ex=65faf2fe&is=65e87dfe&hm=9bb4a29dbe1942a5805e45d25f6eb39c7fbb054c3301b09a7d0b06dcc57a4120&

Path C:\Users\Admin\AppData\Local\Temp\latencia_ultra_baixa.reg_ex=65faf2fe&is=65e87dfe&hm=9bb4a29dbe1942a5805e45d25f6eb39c7fbb054c3301b09a7d0b06dcc57a4120&
Size 712B
SHA256 ba35f79ce9a189ce9ea27e172a66abdc3c1b9624ca1b1a5954a17570838f4688
MD5 c7f291dd50f8e18c98be91c7bba9d95b
SHA1 3913b3e0adcdd0f7e89c2ed09c6e3b1f09dbd66d
SHA512 531d300da9464865bb0e5ee5b38854088a76f047267aeb3467f9198c9f15e1337ff18b46bb813edc2590ff45f31829aa3e9a31fc7dd94c2e75e2f1681cda1d02
MD5 SHA1 SHA512

Submit Download

limpar_residuos_.bat

Path C:\Users\Admin\AppData\Local\Temp\limpar_residuos_.bat
Size 791B
SHA256 9812d96b16b82d44060f4da72a1ef6d49b0d7b25361c57ff9ff251c43027832c
MD5 1d8915bae10aab86945d52d7a0b46454
SHA1 4ceeaf404fdcb418405c6d261f561059f81e129a
SHA512 a0cddb5f97674ecd3067583fa604730095701bf010f294d9007b36d708274c8714aec66e8320fdd3197a9c1c4041b27d18285f73d502d53aa953893833911e86
MD5 SHA1 SHA512

Submit Download

memory/1528-9-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/1528-8-0x0000000005840000-0x0000000005854000-memory.dmp

Download

memory/1528-15-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/1528-14-0x0000000075280000-0x0000000075A30000-memory.dmp

Download

memory/1528-13-0x0000000006E80000-0x0000000006E90000-memory.dmp

Download

memory/1528-12-0x0000000006EF0000-0x0000000006F8C000-memory.dmp

Download

memory/1528-11-0x0000000006D00000-0x0000000006D3C000-memory.dmp

Download

memory/1528-10-0x0000000007960000-0x0000000007972000-memory.dmp

Download

memory/1528-17-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/1528-16-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/1528-7-0x00000000056D0000-0x000000000581E000-memory.dmp

Download

memory/1528-6-0x0000000005E20000-0x00000000061F6000-memory.dmp

Download

memory/1528-5-0x0000000005350000-0x000000000535A000-memory.dmp

Download

memory/1528-4-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/1528-3-0x0000000005360000-0x00000000053F2000-memory.dmp

Download

memory/1528-2-0x0000000005870000-0x0000000005E14000-memory.dmp

Download

memory/1528-1-0x00000000000F0000-0x000000000093C000-memory.dmp

Download

memory/1528-42-0x00000000052B0000-0x00000000052C0000-memory.dmp

Download

memory/1528-0-0x0000000075280000-0x0000000075A30000-memory.dmp

Download

memory/1528-170-0x0000000075280000-0x0000000075A30000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads