Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    332s
  • max time network
    368s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/03/2024, 22:42

General

  • Target

    https://gofile.io/d/l55DLk

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Drops file in Drivers directory 15 IoCs
  • Sets service image path in registry 2 TTPs 2 IoCs
  • Executes dropped EXE 14 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Drops file in System32 directory 15 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 52 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/l55DLk
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4912
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffc8b5f9758,0x7ffc8b5f9768,0x7ffc8b5f9778
      2⤵
        PID:3220
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:2
        2⤵
          PID:4860
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
          2⤵
            PID:424
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
            2⤵
              PID:4924
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
              2⤵
                PID:1812
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
                2⤵
                  PID:4464
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4628 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
                  2⤵
                    PID:224
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
                    2⤵
                      PID:3488
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
                      2⤵
                        PID:4772
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1616 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
                        2⤵
                          PID:3516
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
                          2⤵
                            PID:3624
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3252 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
                            2⤵
                              PID:4164
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:8
                              2⤵
                                PID:2080
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:2172
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3496 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
                                2⤵
                                  PID:3108
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3500 --field-trial-handle=1896,i,7270219565560940937,3024072836751795334,131072 /prefetch:1
                                  2⤵
                                    PID:3668
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:3416
                                  • C:\Program Files\7-Zip\7zG.exe
                                    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap24023:76:7zEvent23224
                                    1⤵
                                    • Suspicious use of FindShellTrayWindow
                                    PID:2972
                                  • C:\Users\Admin\Desktop\loader.exe
                                    "C:\Users\Admin\Desktop\loader.exe"
                                    1⤵
                                    • Drops file in Drivers directory
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    PID:628
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c cls
                                      2⤵
                                        PID:4472
                                      • C:\Windows\system32\cmd.exe
                                        C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
                                        2⤵
                                          PID:3524
                                          • C:\Windows\system32\certutil.exe
                                            certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5
                                            3⤵
                                              PID:376
                                            • C:\Windows\system32\find.exe
                                              find /i /v "md5"
                                              3⤵
                                                PID:1684
                                              • C:\Windows\system32\find.exe
                                                find /i /v "certutil"
                                                3⤵
                                                  PID:2524
                                              • C:\Windows\system32\cmd.exe
                                                C:\Windows\system32\cmd.exe /c cls
                                                2⤵
                                                  PID:4960
                                                • C:\Windows\system32\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c cls
                                                  2⤵
                                                    PID:2372
                                                  • C:\Windows\system32\cmd.exe
                                                    C:\Windows\system32\cmd.exe /c cls
                                                    2⤵
                                                      PID:4600
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c color c
                                                      2⤵
                                                        PID:3712
                                                      • C:\Windows\system32\cmd.exe
                                                        C:\Windows\system32\cmd.exe /c cls
                                                        2⤵
                                                          PID:3764
                                                        • C:\Windows\system32\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Windows\System32\mz.krn.exe C:\Windows\System32\drivers\vuldrv2.sys
                                                          2⤵
                                                            PID:3112
                                                            • C:\Windows\System32\mz.krn.exe
                                                              C:\Windows\System32\mz.krn.exe C:\Windows\System32\drivers\vuldrv2.sys
                                                              3⤵
                                                              • Sets service image path in registry
                                                              • Executes dropped EXE
                                                              • Suspicious behavior: LoadsDriver
                                                              PID:3996
                                                          • C:\Windows\system32\cmd.exe
                                                            C:\Windows\system32\cmd.exe /c cls
                                                            2⤵
                                                              PID:1804
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c exit
                                                              2⤵
                                                                PID:2756
                                                            • C:\Users\Admin\Desktop\loader.exe
                                                              "C:\Users\Admin\Desktop\loader.exe"
                                                              1⤵
                                                              • Drops file in Drivers directory
                                                              • Executes dropped EXE
                                                              • Drops file in System32 directory
                                                              PID:4960
                                                              • C:\Windows\system32\cmd.exe
                                                                C:\Windows\system32\cmd.exe /c cls
                                                                2⤵
                                                                  PID:2420
                                                                • C:\Windows\system32\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
                                                                  2⤵
                                                                    PID:4448
                                                                    • C:\Windows\system32\certutil.exe
                                                                      certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5
                                                                      3⤵
                                                                        PID:3804
                                                                      • C:\Windows\system32\find.exe
                                                                        find /i /v "md5"
                                                                        3⤵
                                                                          PID:4616
                                                                        • C:\Windows\system32\find.exe
                                                                          find /i /v "certutil"
                                                                          3⤵
                                                                            PID:4032
                                                                        • C:\Windows\system32\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c cls
                                                                          2⤵
                                                                            PID:3548
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c cls
                                                                            2⤵
                                                                              PID:876
                                                                            • C:\Windows\system32\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c cls
                                                                              2⤵
                                                                                PID:4864
                                                                              • C:\Windows\system32\cmd.exe
                                                                                C:\Windows\system32\cmd.exe /c color c
                                                                                2⤵
                                                                                  PID:2952
                                                                              • C:\Users\Admin\Desktop\loader.exe
                                                                                "C:\Users\Admin\Desktop\loader.exe"
                                                                                1⤵
                                                                                • Drops file in Drivers directory
                                                                                • Executes dropped EXE
                                                                                • Drops file in System32 directory
                                                                                PID:768
                                                                                • C:\Windows\system32\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c cls
                                                                                  2⤵
                                                                                    PID:4172
                                                                                  • C:\Windows\system32\cmd.exe
                                                                                    C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
                                                                                    2⤵
                                                                                      PID:2108
                                                                                      • C:\Windows\system32\certutil.exe
                                                                                        certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5
                                                                                        3⤵
                                                                                          PID:2492
                                                                                        • C:\Windows\system32\find.exe
                                                                                          find /i /v "md5"
                                                                                          3⤵
                                                                                            PID:4400
                                                                                          • C:\Windows\system32\find.exe
                                                                                            find /i /v "certutil"
                                                                                            3⤵
                                                                                              PID:396
                                                                                          • C:\Windows\system32\cmd.exe
                                                                                            C:\Windows\system32\cmd.exe /c cls
                                                                                            2⤵
                                                                                              PID:4472
                                                                                            • C:\Windows\system32\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c cls
                                                                                              2⤵
                                                                                                PID:1436
                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                C:\Windows\system32\cmd.exe /c cls
                                                                                                2⤵
                                                                                                  PID:184
                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c color c
                                                                                                  2⤵
                                                                                                    PID:1112
                                                                                                • C:\Users\Admin\Desktop\loader.exe
                                                                                                  "C:\Users\Admin\Desktop\loader.exe"
                                                                                                  1⤵
                                                                                                  • Drops file in Drivers directory
                                                                                                  • Executes dropped EXE
                                                                                                  • Drops file in System32 directory
                                                                                                  PID:3504
                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                    C:\Windows\system32\cmd.exe /c cls
                                                                                                    2⤵
                                                                                                      PID:3236
                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
                                                                                                      2⤵
                                                                                                        PID:632
                                                                                                        • C:\Windows\system32\certutil.exe
                                                                                                          certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5
                                                                                                          3⤵
                                                                                                            PID:2900
                                                                                                          • C:\Windows\system32\find.exe
                                                                                                            find /i /v "md5"
                                                                                                            3⤵
                                                                                                              PID:2480
                                                                                                            • C:\Windows\system32\find.exe
                                                                                                              find /i /v "certutil"
                                                                                                              3⤵
                                                                                                                PID:4572
                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c cls
                                                                                                              2⤵
                                                                                                                PID:3284
                                                                                                              • C:\Windows\system32\cmd.exe
                                                                                                                C:\Windows\system32\cmd.exe /c cls
                                                                                                                2⤵
                                                                                                                  PID:724
                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c cls
                                                                                                                  2⤵
                                                                                                                    PID:320
                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                    C:\Windows\system32\cmd.exe /c color c
                                                                                                                    2⤵
                                                                                                                      PID:3736
                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c cls
                                                                                                                      2⤵
                                                                                                                        PID:4740
                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Windows\System32\mz.krn.exe C:\Windows\System32\drivers\vulnerabledrv.sys
                                                                                                                        2⤵
                                                                                                                          PID:4468
                                                                                                                          • C:\Windows\System32\mz.krn.exe
                                                                                                                            C:\Windows\System32\mz.krn.exe C:\Windows\System32\drivers\vulnerabledrv.sys
                                                                                                                            3⤵
                                                                                                                            • Sets service image path in registry
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious behavior: LoadsDriver
                                                                                                                            PID:1476
                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c pause
                                                                                                                          2⤵
                                                                                                                            PID:4064
                                                                                                                        • C:\Users\Admin\Desktop\loader.exe
                                                                                                                          "C:\Users\Admin\Desktop\loader.exe"
                                                                                                                          1⤵
                                                                                                                          • Drops file in Drivers directory
                                                                                                                          • Executes dropped EXE
                                                                                                                          • Drops file in System32 directory
                                                                                                                          PID:336
                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                            C:\Windows\system32\cmd.exe /c cls
                                                                                                                            2⤵
                                                                                                                              PID:4248
                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5 | find /i /v "md5" | find /i /v "certutil"
                                                                                                                              2⤵
                                                                                                                                PID:3496
                                                                                                                                • C:\Windows\system32\certutil.exe
                                                                                                                                  certutil -hashfile "C:\Users\Admin\Desktop\loader.exe" MD5
                                                                                                                                  3⤵
                                                                                                                                    PID:2108
                                                                                                                                  • C:\Windows\system32\find.exe
                                                                                                                                    find /i /v "md5"
                                                                                                                                    3⤵
                                                                                                                                      PID:3624
                                                                                                                                    • C:\Windows\system32\find.exe
                                                                                                                                      find /i /v "certutil"
                                                                                                                                      3⤵
                                                                                                                                        PID:744
                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c cls
                                                                                                                                      2⤵
                                                                                                                                        PID:3360
                                                                                                                                      • C:\Windows\system32\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c cls
                                                                                                                                        2⤵
                                                                                                                                          PID:3644
                                                                                                                                        • C:\Windows\system32\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c cls
                                                                                                                                          2⤵
                                                                                                                                            PID:888
                                                                                                                                          • C:\Windows\system32\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c color c
                                                                                                                                            2⤵
                                                                                                                                              PID:2324
                                                                                                                                            • C:\Windows\system32\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c start C:\Windows\System32\NetFixer.bat
                                                                                                                                              2⤵
                                                                                                                                                PID:2808
                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /K C:\Windows\System32\NetFixer.bat
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2524
                                                                                                                                                    • C:\Windows\system32\cmd.exe
                                                                                                                                                      C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
                                                                                                                                                      4⤵
                                                                                                                                                        PID:2452
                                                                                                                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                          wmic nic where physicaladapter=true get deviceid
                                                                                                                                                          5⤵
                                                                                                                                                            PID:2980
                                                                                                                                                          • C:\Windows\system32\findstr.exe
                                                                                                                                                            findstr [0-9]
                                                                                                                                                            5⤵
                                                                                                                                                              PID:884
                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                            REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01"
                                                                                                                                                            4⤵
                                                                                                                                                              PID:2132
                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                              REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001"
                                                                                                                                                              4⤵
                                                                                                                                                                PID:5104
                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001"
                                                                                                                                                                4⤵
                                                                                                                                                                  PID:3100
                                                                                                                                                                • C:\Windows\system32\reg.exe
                                                                                                                                                                  REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001" /v NetworkAddress /t REG_SZ /d 02-2C9ACA2922A /f
                                                                                                                                                                  4⤵
                                                                                                                                                                    PID:3584
                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c wmic nic where physicaladapter=true get deviceid | findstr [0-9]
                                                                                                                                                                    4⤵
                                                                                                                                                                      PID:4876
                                                                                                                                                                      • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                        wmic nic where physicaladapter=true get deviceid
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:2724
                                                                                                                                                                        • C:\Windows\system32\findstr.exe
                                                                                                                                                                          findstr [0-9]
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:3236
                                                                                                                                                                        • C:\Windows\system32\reg.exe
                                                                                                                                                                          REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\01"
                                                                                                                                                                          4⤵
                                                                                                                                                                            PID:1508
                                                                                                                                                                          • C:\Windows\system32\reg.exe
                                                                                                                                                                            REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\001"
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:632
                                                                                                                                                                            • C:\Windows\system32\reg.exe
                                                                                                                                                                              REG QUERY "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:4188
                                                                                                                                                                              • C:\Windows\system32\reg.exe
                                                                                                                                                                                REG ADD "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002bE10318}\0001" /v PnPCapabilities /t REG_DWORD /d 24 /f
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:5072
                                                                                                                                                                                • C:\Windows\system32\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c "wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv"
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:1172
                                                                                                                                                                                    • C:\Windows\System32\Wbem\WMIC.exe
                                                                                                                                                                                      wmic nic where (netconnectionid like '%') get netconnectionid,netconnectionstatus /format:csv
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:2148
                                                                                                                                                                                    • C:\Windows\system32\netsh.exe
                                                                                                                                                                                      netsh interface set interface name="Ethernet" disable
                                                                                                                                                                                      4⤵
                                                                                                                                                                                        PID:228
                                                                                                                                                                                  • C:\Windows\system32\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c pause >nul
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:4264
                                                                                                                                                                                  • C:\Windows\System32\svchost.exe
                                                                                                                                                                                    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:3140

                                                                                                                                                                                    Network

                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                    Downloads

                                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      471B

                                                                                                                                                                                      MD5

                                                                                                                                                                                      8c3079c9837342ec5747ce3b1b5f5370

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      72e5aced39046c780b09df80e17c3e2f691a53e1

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      fdebe461d97b5b06a1dfc51564b7fd09d71606e347b38af8ebe9a0243a788cfa

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      f04ea7a7b3e32d6fd8120b785fa31bd4178f488beb101ecfa9c934804224ab8cff89d3b95df5ca90038a8574a00bd3b89d61633af7bc35194c7b1b500c35f613

                                                                                                                                                                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      412B

                                                                                                                                                                                      MD5

                                                                                                                                                                                      87cbddc44f213e32287cd3c179be2edb

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      202cc8966dabed8f8996b584d612bd73c3a940b2

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      6d3a11357014f3836696b70635e394caaf7b378d5d53a71e8efddae6c8407346

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      0c0db1a70c833986a53a05a25c3bc0fd4bc7b112618545a63540ab9a94745fbfdc56af16a793f53ef83956fc3e1fe8f6a1026c5ecf11d3ad01e976bda7825009

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      288B

                                                                                                                                                                                      MD5

                                                                                                                                                                                      53095d91dfe5e55ca8c31900a478f51a

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      f2e26ace05663d7788859ef3d3a14a592d4cbd5e

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      df732fd2e7680dfbaa6e03902d47ac21f8e257df655d8fd4ff20c54e7bbdda34

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      6cd8793305a71afd26e05473bd6f4c201bf1d6814be8c4e886074caff45d965ab2e8a8ef504ab9e0655b64ca55000a15516ba953415eb92516a630f15587c861

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      6c08ca043d75bc4efd5d53a0aa0f736a

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      8674f8ebbe85e135bd0e87da0598e4c11d539817

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      82541ce684a9aab70273d74f4b04535b4d44f8ed0f9f3b4075947521a4a168e5

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      cb24b7789848321c8a692e1d01a0adf6feffca623413d3c2f1f266e9447a60c7b287c01130ae39d1cb157bf3f0cf3c9bfd5eda4a38adfe9e6f6ed84082770ba1

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      b1ed31f4a010be453b67c6e200a32708

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      a45a8957ffe4bd52b95a8f697851f8831be52ae8

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      e2199550e39e073962fe43bffe6aae68ffbd1f26c6802a409443e501df585e8c

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      cb729e42b7d7ed548110110925b3a99b8ea7c70edaf274b24ff75b995e4df057dedfec7a1ee5edad8b2b17f730cff7ed84562b5c316e547c74004e4f062804e4

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      705B

                                                                                                                                                                                      MD5

                                                                                                                                                                                      6984ef0771a84cda834c6ef88613d506

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      ca9fb490f961ab002464608cdbced78e9ab623fa

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      2f3a1dc28654fb6f628b6a162d14a07bae9393480d41ad581e65d7353cab8138

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      11270d4cbe668bcbc663ed492a61d9cae73bd3385e7d857cb832a9977b9a0be23734455b45f67d45ae938eb32878e7b94adf373d0a0b681308791abe2bed1b0b

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      705B

                                                                                                                                                                                      MD5

                                                                                                                                                                                      5a90cc97a678560275bb21a6f4577917

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      7f0c781b03c23379c0066f1aa5098bec5a82291e

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      9b516d4ce4f0d8b10b2418bce73b275f4275799446f99c4fd0c02d089199b713

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      b9f5ac7b1a7a4cf6b90eb81088886e92fe8c8acc7a71096a6a361f7f8af9e8fd1b00d8bcf63e35badf3756af0039704f59ea208403c161f68d166d1245eb9abd

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      6KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      5a434c092b656fab30bfc94dd87759e3

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      48e463627482ec892af8ba89b2f4b69672cb85a4

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      b3cfd6253f7419883fa3961c412acefbba35af318b6b929980a73e72b695d4f3

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      86b8729a599a24f6aa69206b419e6b3d8003b382acfe5794f67723c53dd59408ec21d0ce330538d483dd3b13a3ac6b639695adf60a21db99f40783df736ae701

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      6KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      a102381039a9035a5192326bdc5050c2

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      3a93be37abff9daf37b2adde5f33c44770eb83a8

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      530bf6721f420a56e7e86f42f28a2d3df6b50abb8ad0ed963af94ca6ef8ffddd

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      5bb0c3dbc5b6c84ed7f9939c4ffb747d507ca1ae10349bd1612fee21bdc2a1a95620489674f11c17788e2f51f7be277dc7799fc19b9aef09a5a491181f48c6d7

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      6KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      6d6e36682534a0c5e8a2880ed24578e1

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      89b9b40a8c7acda517d0eff32381ac17ed178ab9

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      858c758ad99187b2a1d85156316d3cedf6583b4d0a1379884dc742a5a171824c

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      35b2ae796e73787ffda5b6963a23e772d07a773cc79f0ad07e7e0d1779d44c450fc97a5bf1be16cea69b21cb6ae05388451db7cd8b0edc4ae76ddb72c34a15e4

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      6KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      7e323852773d4a5754dd9363647cb16f

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      b9db4dc308a5ff603547295825fae7ff6be851e4

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      f74017245d4c575c86755124b1cc410c7207f9082cea0092a1452a96b717bc77

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      c5fbef7c715fbc90894f8e174bef81dc661099b50461c8df9c36a84d6cc5351aacf718303a86e3bd433baa91539dba8a87cb5c18580e5927bdd9961bc82e0712

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      128KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      5132bf78a7f51d7cc5758d9b853b027d

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      15a16458c9fc91541dc049b3f456f555714ab656

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      19cd13657b5b581d1ccf42cf6480325bf8d71f1f87646a1aa2abfec2116062cf

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      8b71aa88200e48ec6f8a6fe20b12492f1699f66cf58ecf748376c263f685c06b5cfff1a83f8c7b874a0e9acb719db198a969d515366017ced641dc73e800e165

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      128KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      ae2189cbe281b977cc1a7b42c0ce2f70

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      9654fc165b2df8dc1528fefc533c79f5e617c3d8

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      63a3621f030c19f24e6b9e25dfb0d5bfb23657bd55a057a1daef26768af2c0cb

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      50e9d4838d8b4046163d5813ab14a0955271203525b4aef56a677ff7da5c91ec436c9ebfbd4e0059a2588bfe0813af034454e02fa30b111aada76320961dc5c9

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      103KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      4ad1b62c1842630273d9975fc5cc5bbe

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      cb16c206f0a0686b55c67053e19436cf9fcb5faf

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      4204000645cac0ba631e1f3d7bed28c49fb4fdb7c97bd788fa3e883e479edb8b

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      81ae3ec771bdf78f6020453cb9c269212f9fa41d2599589e80f67fc1ecb60ae3c55fb2fe290d6ffa5fe455025e02aa18bd8739f48da5ee92b60183d7eaae46a3

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      102KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      3fbf691af4e5de70f25904fa32aaeeab

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      f68846da198e7b3cf3cc23aa076094f630c66596

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      6e3d47d8a625b33ac653f9e92b47f96fbb7d1e7f3cd260ceccdc75027cde8377

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      2c8639f8a0c4413d87d005b9c8951f055778eec217b53f1720d2f4ba7880cbb613311ce45025fc940dc5a7024c13f5ea42abbcabeac179ed27ce352311fecafd

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe583da0.TMP

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      96KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      bd76d9eda28c9d844b3513d8867c9714

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      d14fd778563fbae87053b41f5d77e269d6f726c9

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      0b7edeffa9e95a247536fc6fb1caac0d90adb7bdd39a4fad077a8f4b6a656098

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      47d8cbf32b0550cee681facc11c6941d863e45505387d7cc3340a59ab7e740f495ce45a3ff7571c5524cc080aef299bbeac30b298b1cc938685ec4dd01379766

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2B

                                                                                                                                                                                      MD5

                                                                                                                                                                                      99914b932bd37a50b983c5e7c90ae93b

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C52098XD\KernelDRV[1].sys

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      14KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      a884ab4c1edd178b6907d382e36725bc

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      08d97ddfd6e7316e9a3db8d292811ec091616148

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      6de4a54b0a4d6132f3bae37df1392be40dccfb2df71d57d33aca24f8783ac609

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      fe344e09240401b6ed9522d7664490c20cf97318bd85c7882e1f93aa700804be001ce14710eb08d07883602619a5eab1837573964121d70de69bd4ccee9e35e8

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\C52098XD\sclolrat[1].bat

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      855B

                                                                                                                                                                                      MD5

                                                                                                                                                                                      ece2939ad25113b64f41e1f59c0b6e70

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      2170a6d2b173bffd776d20385bbc86cec1f776da

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      1a16fb2e456ed05de6aa53e58b7aeddba522af47670fd5fe315952a02aa1891f

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      f1936a1ae852ca16d20393c90b64d5c48367ec2e1440a313bcfaad3a9e0cb0958c46cd22dc32d9aff4322f86376116752f2d2875cd4c47fc39b5517ca1f2d922

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\G7TWCMRP\NetFixer[1].bat

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      189dbc488495dbb7b4bc313bbf777116

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      476e49b7383544e7f1e5d4c080e528fd406906d1

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      6b564fd712451bab4446c4beca68635843dfbbeb38a3430b162098e9204ce40b

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      ae6464807f10f4b0ca869c253b7036ae5e7f14b24e8079f8a3481816e4457e036747fdfbbfa26c9f85795f7dcb57f1e839811a327f326799bdc5b5820106c38e

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MF25FY4A\driver[1].sys

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      901KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      591b99be71c9c6c7667b0d7fb9c34b5e

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      919d60a0955b592819b6cdcf9fb3c1e9b88372d1

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      fcb83460f68e3ec9a5efc1ce873417ad8715f420e422d629b62aeac4ed34f807

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      a469efb0fb834c634520d84fd4685c0960ad2f2b044b57a596186635066ea313c627777efa96cc69ffe0d28ea6e88e58257c2ab4314f6f21cd1bf7a9c3cfc895

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MF25FY4A\pc_name_list[1].txt

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      2KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      c6b52fcf7549522450608aea9f374411

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      405b10c1c668081c742a7d2a7856ce273fee493f

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      192fcaf861054d9463379ec211ab450f7a8406ce0302b7073b68c8e742bacfa9

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      7b101443cf8c4eee302961a8c0be9729f87409391f7f7b288104a8c374f97c57491518ee55029435c7445bf79ecc2beef06c8d5a9c3793558bafda7cdcbb630a

                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\OCSF5S5B\pc_username_list[1].txt

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      1KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      b81225da913287b2800f4e204bc824f2

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      5da7494f895af85b7243a7329debf200bddbf8e6

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      b613333592c1ee02923d04f3dfa096ec83f1f09a5fddead9725a8eca46c065d5

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      c20586fa39e1fba13f72664efc78d6123181ed6366e152b4ae813cacafe9081106e49cfdf0fceaefffc2e3d5dab0aa891bfe9b97dcb07319a2dd847cbbbc3d46

                                                                                                                                                                                    • C:\Users\Admin\Desktop\loader.exe

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      545KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      5a8c4e69376ce15ea3a659211afc9ea6

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      4f3d622bebc61f36a4dfbaedeb33ef713b198353

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      b574a49f0682b725bc9e48a213251c517ed9a25a3f6ba03aa7f588287474e3b5

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      a581648b6bdf17b9d019c79c20ff75f55aaa74691d0c6be568df55c7d9aea60ada25b0e0cea6bfe2a81a7ba7e5940d12a352a8174eefc9037f844ee252de6eca

                                                                                                                                                                                    • C:\Users\Admin\Downloads\Release.rar.crdownload

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      238KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      b76586851ed8ea2694f2de326130aa7c

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      f8088a8c058030f2c22ae1d2c49f1a59d69fe720

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      14e95b1807ce526b71fa9c2003d0a2954426dee6783de65adcd72187871185a3

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      1421bcba0263e2fd5dd10a459d26f7e01f0f432d89a94799e59fcd76e691d122be40b79466ae736be7ea6abc538f457b8a9144655585d41bf4c7ff2e574dc08e

                                                                                                                                                                                    • C:\Windows\System32\mz.krn.exe

                                                                                                                                                                                      Filesize

                                                                                                                                                                                      119KB

                                                                                                                                                                                      MD5

                                                                                                                                                                                      324330f343df4ac2f7f20db2c15f5e11

                                                                                                                                                                                      SHA1

                                                                                                                                                                                      835f87e709702252065348bc7cf2f5d531c2ba38

                                                                                                                                                                                      SHA256

                                                                                                                                                                                      b84a7b9233e5f6f2182535c0de85deb2375c6218fda5070b624710fcd7e74878

                                                                                                                                                                                      SHA512

                                                                                                                                                                                      ec8c085a0305b72bade63f020df73dcb79da736418ac0c70d9dd4fb79415a6d6e5dd78d733e06062019f6a28412295581774035aae4a0aacecbcd703c53f71b9