f63801a874a87df3b446504ecf5ed56a9f0a7c8d32c2d560c0358a7ec544f19c

Analysis

max time kernel
171s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-20240412-uk
resource tags

arch:x64arch:x86image:win10v2004-20240412-uklocale:uk-uaos:windows10-2004-x64systemwindows
submitted
21-04-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Sus pass1.7z
Size

225KB
MD5

ae60415f2bba4bf8b3c0b5ae687ab79b
SHA1

a0918e35ca8a7293bf4ad926d4f6d2b66643a889
SHA256

f63801a874a87df3b446504ecf5ed56a9f0a7c8d32c2d560c0358a7ec544f19c
SHA512

02326ffc3581d7d71595eedad7523d36d931434a495a30f7c4eecb40383858b598d5dcac6b4a61791cd9750cf6e54d0bacab85b22e31466e2d61b475f637d6c3
SSDEEP

6144:s2mVC8Bf6RNzxAI1X5RBEmd+6mEMMLRx98dLkSA:hWC8BSvfB3AEfVxiNkJ

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
624	7zFM.exe
5184	7zFM.exe

Loads dropped DLL 3 IoCs

pid	Process
3432	Process not Found
624	7zFM.exe
5184	7zFM.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\an.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\sr-spl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	msiexec.exe
File created	C:\Program Files\7-Zip\7-zip.chm	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\fr.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\hi.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\uz.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\af.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\kk.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\nb.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\tg.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\tt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\be.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\sl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	msiexec.exe
File created	C:\Program Files\7-Zip\7z.dll	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ba.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\fa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\gu.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\kaa.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	msiexec.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI8373.tmp	msiexec.exe
File created	C:\Windows\Installer\e588315.msi	msiexec.exe
File created	C:\Windows\Installer\e5882a8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5882a8.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{23170F69-40C1-2702-2404-000001000000}	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000003013bddf4a62308e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff0000000027010100000800003013bddf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff0000000007000100006809003013bddf000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d3013bddf000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff0000000000000000000000003013bddf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tgz	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.lzh\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,6"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.xz\ = "xz Archive"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.xz\shell\open\	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bz2\ = "7-Zip.bz2"	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.gzip\shell\open\command	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\PackageCode = "96F071321C0420724240000020000000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz2\ = "7-Zip.tbz2"	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.esd	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.txz\shell\open\	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.esd\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,15"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.001	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.iso\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,8"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xz\ = "7-Zip.xz"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.gz\ = "gz Archive"	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.tpz	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "7-Zip.z"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.apfs\shell\open\	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\96F071321C0420724240000010000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.cpio	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.bzip2	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.fat\DefaultIcon	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.hfs\ = "7-Zip.hfs"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.apfs\ = "apfs Archive"	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.iso	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.lzh\ = "lzh Archive"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.lha\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,6"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.swm\ = "7-Zip.swm"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wim\ = "7-Zip.wim"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\96F071321C0420720000000040000000\96F071321C0420724240000010000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.lzma\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,16"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tzst\shell\open\command\ = "\"C:\\Program Files\\7-Zip\\7zFM.exe\" \"%1\""	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.gz\shell\	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.fat\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,21"	7zFM.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.7z	7zFM.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\.TAR\PERSISTENTHANDLER	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bzip2\ = "7-Zip.bzip2"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.tbz\ = "7-Zip.tbz"	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.zip\shell\open\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.rpm\shell\open	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\7-Zip.wim	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.xar\shell\	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000\ProductName = "7-Zip 24.04 (x64 edition)"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.bzip2	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.gz\DefaultIcon	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.001\shell\	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.001\shell\open\command	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.xz	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tar\shell\open\	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420724240000010000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.7z\ = "7z Archive"	7zFM.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.rar	7zFM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.dmg\DefaultIcon\ = "C:\\Program Files\\7-Zip\\7z.dll,17"	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-1132431369-515282257-1998160155-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.zip\shell\open\command	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.rar	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\7-Zip.z	7zFM.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.rar\shell\open	7zFM.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.tzst\DefaultIcon	7zFM.exe
Key created	\REGISTRY\MACHINE\Software\Classes\7-Zip.arj	7zFM.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\7z2404-x64.msi:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5752	msedge.exe
5752	msedge.exe
4732	msiexec.exe
4732	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
3876	OpenWith.exe
6868	OpenWith.exe
624	7zFM.exe
5184	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	firefox.exe
Token: SeDebugPrivilege	2640	firefox.exe
Token: SeDebugPrivilege	2640	firefox.exe
Token: SeDebugPrivilege	2640	firefox.exe
Token: SeShutdownPrivilege	6152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6152	msiexec.exe
Token: SeSecurityPrivilege	4732	msiexec.exe
Token: SeCreateTokenPrivilege	6152	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	6152	msiexec.exe
Token: SeLockMemoryPrivilege	6152	msiexec.exe
Token: SeIncreaseQuotaPrivilege	6152	msiexec.exe
Token: SeMachineAccountPrivilege	6152	msiexec.exe
Token: SeTcbPrivilege	6152	msiexec.exe
Token: SeSecurityPrivilege	6152	msiexec.exe
Token: SeTakeOwnershipPrivilege	6152	msiexec.exe
Token: SeLoadDriverPrivilege	6152	msiexec.exe
Token: SeSystemProfilePrivilege	6152	msiexec.exe
Token: SeSystemtimePrivilege	6152	msiexec.exe
Token: SeProfSingleProcessPrivilege	6152	msiexec.exe
Token: SeIncBasePriorityPrivilege	6152	msiexec.exe
Token: SeCreatePagefilePrivilege	6152	msiexec.exe
Token: SeCreatePermanentPrivilege	6152	msiexec.exe
Token: SeBackupPrivilege	6152	msiexec.exe
Token: SeRestorePrivilege	6152	msiexec.exe
Token: SeShutdownPrivilege	6152	msiexec.exe
Token: SeDebugPrivilege	6152	msiexec.exe
Token: SeAuditPrivilege	6152	msiexec.exe
Token: SeSystemEnvironmentPrivilege	6152	msiexec.exe
Token: SeChangeNotifyPrivilege	6152	msiexec.exe
Token: SeRemoteShutdownPrivilege	6152	msiexec.exe
Token: SeUndockPrivilege	6152	msiexec.exe
Token: SeSyncAgentPrivilege	6152	msiexec.exe
Token: SeEnableDelegationPrivilege	6152	msiexec.exe
Token: SeManageVolumePrivilege	6152	msiexec.exe
Token: SeImpersonatePrivilege	6152	msiexec.exe
Token: SeCreateGlobalPrivilege	6152	msiexec.exe
Token: SeBackupPrivilege	6884	vssvc.exe
Token: SeRestorePrivilege	6884	vssvc.exe
Token: SeAuditPrivilege	6884	vssvc.exe
Token: SeBackupPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe
Token: SeTakeOwnershipPrivilege	4732	msiexec.exe
Token: SeRestorePrivilege	4732	msiexec.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2640	firefox.exe
2640	firefox.exe
2640	firefox.exe
2640	firefox.exe
6152	msiexec.exe
6152	msiexec.exe
5184	7zFM.exe
5184	7zFM.exe
5184	7zFM.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2640	firefox.exe
2640	firefox.exe
2640	firefox.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe
3876	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 4376	3876	OpenWith.exe	95
PID 3876 wrote to memory of 4376	3876	OpenWith.exe	95
PID 4376 wrote to memory of 2640	4376	firefox.exe	97
PID 4376 wrote to memory of 2640	4376	firefox.exe	97
PID 4376 wrote to memory of 2640	4376	firefox.exe	97
PID 4376 wrote to memory of 2640	4376	firefox.exe	97
PID 4376 wrote to memory of 2640	4376	firefox.exe	97
PID 4376 wrote to memory of 2640	4376	firefox.exe	97
PID 4376 wrote to memory of 2640	4376	firefox.exe	97
PID 4376 wrote to memory of 2640	4376	firefox.exe	97
PID 4376 wrote to memory of 2640	4376	firefox.exe	97
PID 4376 wrote to memory of 2640	4376	firefox.exe	97
PID 4376 wrote to memory of 2640	4376	firefox.exe	97
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 4456	2640	firefox.exe	98
PID 2640 wrote to memory of 2400	2640	firefox.exe	99
PID 2640 wrote to memory of 2400	2640	firefox.exe	99
PID 2640 wrote to memory of 2400	2640	firefox.exe	99
PID 2640 wrote to memory of 2400	2640	firefox.exe	99
PID 2640 wrote to memory of 2400	2640	firefox.exe	99
PID 2640 wrote to memory of 2400	2640	firefox.exe	99
PID 2640 wrote to memory of 2400	2640	firefox.exe	99
PID 2640 wrote to memory of 2400	2640	firefox.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Sus pass1.7z"
1⤵
PID:1520

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Sus pass1.7z"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Sus pass1.7z"
    3⤵
    - Checks processor information in registry
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2640.0.873424347\277204873" -parentBuildID 20230214051806 -prefsHandle 1820 -prefMapHandle 1704 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {443478f1-6983-4439-848b-8fbda52adf5b} 2640 "\\.\pipe\gecko-crash-server-pipe.2640" 1900 1ddb9f23758 gpu
      4⤵
      PID:4456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2640.1.1258569057\708534290" -parentBuildID 20230214051806 -prefsHandle 2464 -prefMapHandle 2460 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3b653eb8-dc95-4cf7-a08b-697c2704a245} 2640 "\\.\pipe\gecko-crash-server-pipe.2640" 2492 1ddad28b258 socket
      4⤵
      PID:2400
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2640.2.482648460\1308974730" -childID 1 -isForBrowser -prefsHandle 3140 -prefMapHandle 3136 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3e1bc65-7e3c-40fc-8365-05b36b691b37} 2640 "\\.\pipe\gecko-crash-server-pipe.2640" 3152 1ddb8f91d58 tab
      4⤵
      PID:800
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2640.3.1137825443\602150870" -childID 2 -isForBrowser -prefsHandle 3540 -prefMapHandle 3556 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {203e3659-2168-47da-81ac-bf7ca4a9bfe8} 2640 "\\.\pipe\gecko-crash-server-pipe.2640" 3532 1ddad27be58 tab
      4⤵
      PID:4212
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2640.4.538774633\1252150701" -childID 3 -isForBrowser -prefsHandle 5428 -prefMapHandle 5424 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6a7d17aa-409f-44c1-954d-b87a29432e31} 2640 "\\.\pipe\gecko-crash-server-pipe.2640" 5440 1ddc0da6958 tab
      4⤵
      PID:3520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2640.5.1738875672\1182639750" -childID 4 -isForBrowser -prefsHandle 5576 -prefMapHandle 5580 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0def337f-0b20-47eb-9e00-a901b95a634f} 2640 "\\.\pipe\gecko-crash-server-pipe.2640" 5568 1ddc1707858 tab
      4⤵
      PID:4284
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2640.6.68064143\76253492" -childID 5 -isForBrowser -prefsHandle 5852 -prefMapHandle 5848 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a25b7cb-9a28-4fb7-a8c2-6f5ac3ba220b} 2640 "\\.\pipe\gecko-crash-server-pipe.2640" 5860 1ddc1708458 tab
      4⤵
      PID:4344
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2640.7.2033248885\1586145847" -childID 6 -isForBrowser -prefsHandle 6304 -prefMapHandle 6300 -prefsLen 27816 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0707444-94b6-48f4-b587-5b5af9dcba56} 2640 "\\.\pipe\gecko-crash-server-pipe.2640" 3196 1ddbf3e5158 tab
      4⤵
      PID:5628
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2640.8.1080371985\1496937191" -childID 7 -isForBrowser -prefsHandle 5464 -prefMapHandle 5452 -prefsLen 28081 -prefMapSize 235121 -jsInitHandle 1308 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3678b81d-0243-4789-95c7-8a87acdc9917} 2640 "\\.\pipe\gecko-crash-server-pipe.2640" 5436 1ddad288558 tab
      4⤵
      PID:5604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault8308f634h96ffh4069h8e7bhb925dea7bafe
1⤵
PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7fffd2c646f8,0x7fffd2c64708,0x7fffd2c64718
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,15497984514778691190,10224898659183316661,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,15497984514778691190,10224898659183316661,131072 --lang=uk --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,15497984514778691190,10224898659183316661,131072 --lang=uk --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:5892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc
1⤵
PID:6752

C:\Windows\System32\FodHelper.exe
C:\Windows\System32\FodHelper.exe -Embedding
1⤵
PID:5684

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\7z2404-x64.msi"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6152

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4732
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1612

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:6884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:6868

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:624

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1168

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Sus pass1.7z"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:5184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5882a9.rbs

Filesize
32KB

MD5
e66bf15b665b5b4a93d3a5abc0885470

SHA1
cfdc206c9ad948f8510e9603b855d7b73540ee29

SHA256
e300279ba8503f7251830918ef93350e3a2e03b7a17460527d33a00999064bc4

SHA512
b4aefe88ecaa756310b818e9747536b8f3ed51bf94fcfb25e5dc76b3e7c656d5bd09e894766f3cb73872b3491521de48d465882ba19905f1dfe91e91e83518dd

Download Submit
C:\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
fe487725998a00de2ecd41b1357ca0bc

SHA1
cffe7d83767b3334533f9525bea67e34dcb2b632

SHA256
e0625e017c02038cf25b60d03f3c46da44b4232bf9c664cf30bcf67af81229b1

SHA512
173191f2678a4e73457ce4a4008c432080e050004fe034f93cf05281be6be670c54e0c37f23b90d4f9f6cce4de82fbff71cec817bf301d4d84405ea238f1c730

Download Submit
C:\Program Files\7-Zip\7z.dll

Filesize
1.8MB

MD5
29f6d49053de1408586f48681864ca5f

SHA1
1071e887849cb92776f4a6d4cb6d0dd1ec264b65

SHA256
84d2bcf774aba77e938d3f36bfe020e0d49cfb3074ad9de69b5af78054602b7e

SHA512
dcdb5252e660b0d186c8db508db3fdaab22d33bc20dcaca2b41d5d5e64d5780b25f2242389227ddefff96978f373f89942389673c737b3102778982b91ca6f32

Download Submit
C:\Program Files\7-Zip\7zFM.exe

Filesize
960KB

MD5
246da2a8b76013599e3d11b9f6f03515

SHA1
6a10aa64297e68fb5bb5abb940338d5a51c0e81c

SHA256
996e8436a50a1818b574a7ecb078d4f3566d6666fc4defb2493ec7f0c08538a8

SHA512
df9d86b41bca8e90ae212267b3cdac24e5c506dec0d88832b3a7f407f7f9057f23bb5c341137727f593088eb33a811eaddc445ecf1bd61b89cb1777837b0f1f8

Download Submit
C:\Program Files\7-Zip\Lang\af.txt

Filesize
4KB

MD5
df216fae5b13d3c3afe87e405fd34b97

SHA1
787ccb4e18fc2f12a6528adbb7d428397fc4678a

SHA256
9cf684ea88ea5a479f510750e4089aee60bbb2452aa85285312bafcc02c10a34

SHA512
a6eee3d60b88f9676200b40ca9c44cc4e64cf555d9b8788d4fde05e05b8ca5da1d2c7a72114a18358829858d10f2beff094afd3bc12b370460800040537cff68

Download Submit
C:\Program Files\7-Zip\Lang\an.txt

Filesize
7KB

MD5
f16218139e027338a16c3199091d0600

SHA1
da48140a4c033eea217e97118f595394195a15d5

SHA256
3ab9f7aacd38c4cde814f86bc37eec2b9df8d0dddb95fc1d09a5f5bcb11f0eeb

SHA512
b2e99d70d1a7a2a1bfa2ffb61f3ca2d1b18591c4707e4c6c5efb9becdd205d646b3baa0e8cbd28ce297d7830d3dfb8f737266c66e53a83bdbe58b117f8e3ae14

Download Submit
C:\Program Files\7-Zip\Lang\ar.txt

Filesize
12KB

MD5
5747381dc970306051432b18fb2236f2

SHA1
20c65850073308e498b63e5937af68b2e21c66f3

SHA256
85a26c7b59d6d9932f71518ccd03eceeba42043cb1707719b72bfc348c1c1d72

SHA512
3306e15b2c9bb2751b626f6f726de0bcafdc41487ba11fabfcef0a6a798572b29f2ee95384ff347b3b83b310444aaeec23e12bb3ddd7567222a0dd275b0180ff

Download Submit
C:\Program Files\7-Zip\Lang\ast.txt

Filesize
4KB

MD5
1cf6411ff9154a34afb512901ba3ee02

SHA1
958f7ff322475f16ca44728349934bc2f7309423

SHA256
f5f2174daf36e65790c7f0e9a4496b12e14816dad2ee5b1d48a52307076be35f

SHA512
b554c1ab165a6344982533cceed316d7f73b5b94ce483b5dc6fb1f492c6b1914773027d31c35d60ab9408669520ea0785dc0d934d3b2eb4d78570ff7ccbfcf9c

Download Submit
C:\Program Files\7-Zip\Lang\az.txt

Filesize
9KB

MD5
3c297fbe9b1ed5582beabfc112b55523

SHA1
c605c20acf399a90ac9937935b4dbdb64fad9c9f

SHA256
055ec86aed86abbdbd52d8e99fec6e868d073a6df92c60225add16676994c314

SHA512
417984a749471770157c44737ee76bfd3655ef855956be797433dadc2a71e12359454cc817b5c31c6af811067d658429a8706e15625bf4ca9f0db7586f0ae183

Download Submit
C:\Program Files\7-Zip\Lang\ba.txt

Filesize
10KB

MD5
387ff78cf5f524fc44640f3025746145

SHA1
8480e549d00003de262b54bc342af66049c43d3b

SHA256
8a85c3fcb5f81157490971ee4f5e6b9e4f80be69a802ebed04e6724ce859713f

SHA512
7851633ee62c00fa2c68f6f59220a836307e6dde37eae5e5dca3ca254d167e305fe1eb342f93112032dadafe9e9608c97036ac489761f7bdc776a98337152344

Download Submit
C:\Program Files\7-Zip\Lang\be.txt

Filesize
11KB

MD5
b1dd654e9d8c8c1b001f7b3a15d7b5d3

SHA1
5a933ae8204163c90c00d97ba0c589f4d9f3f532

SHA256
32071222af04465a3d98bb30e253579aa4beceaeb6b21ac7c15b25f46620bf30

SHA512
0137900aeb21f53e4af4027ea15eed7696ed0156577fe6194c2b2097f5fb9d201e7e9d52a51a26ae9a426f8137692154d80676f8705f335fed9ae7e0e1d0a10e

Download Submit
C:\Program Files\7-Zip\Lang\bg.txt

Filesize
17KB

MD5
7e72ddda5c9c36ff524237c6e9e04966

SHA1
579efd005bb150983ff9e45836412d5b0f4ff619

SHA256
e1459219f199f991d31baab97e8dc98de86dd263062cc8968193211f24eeec3b

SHA512
413ede16d362fcbab3b40268d9a87ca805a77e643b0716288779fd0487c9db2e462a9e98dfd4ee686b303a9171017e6505d5139938fdead0104bfdff3583d1cb

Download Submit
C:\Program Files\7-Zip\Lang\bn.txt

Filesize
14KB

MD5
771c8b73a374cb30df4df682d9c40edf

SHA1
46aa892c3553bddc159a2c470bd317d1f7b8af2a

SHA256
3f55b2ec5033c39c159593c6f5ece667b92f32938b38fcaf58b4b2a98176c1fc

SHA512
8dcc9cc13322c4504ee49111e1f674809892900709290e58a4e219053b1f78747780e1266e1f4128c0c526c8c37b1a5d1a452eefba2890e3a5190eebe30657ba

Download Submit
C:\Program Files\7-Zip\Lang\br.txt

Filesize
4KB

MD5
07504a4edab058c2f67c8bcb95c605dd

SHA1
3e2ae05865fb474f10b396bfefd453c074f822fa

SHA256
432bdb3eaa9953b084ee14eee8fe0abbc1b384cbdd984ccf35f0415d45aabba8

SHA512
b3f54d695c2a12e97c93af4df09ce1800b49e40302bec7071a151f13866edfdfafc56f70de07686650a46a8664608d8d3ea38c2939f2f1630ce0bf968d669ccc

Download Submit
C:\Program Files\7-Zip\Lang\ca.txt

Filesize
8KB

MD5
264fb4b86bcfb77de221e063beebd832

SHA1
a2eb0a43ea4002c2d8b5817a207eb24296336a20

SHA256
07b5c0ac13d62882bf59db528168b6f0ffdf921d5442fae46319e84c90be3203

SHA512
8d1a73e902c50fd390b9372483ebd2ec58d588bacf0a3b8c8b9474657c67705b6a284bb16bba4326d314c7a3cc11caf320da38d5acb42e685ed2f8a8b6f411f4

Download Submit
C:\Program Files\7-Zip\Lang\co.txt

Filesize
11KB

MD5
7ddb2afb758fe102ef8d4d19c2c26219

SHA1
ada803d73bb7919a4ec71802d1a0e9f4793face8

SHA256
c18b8b5ccb88795eb92a4ed54b5dc66e8d8ff036adfcf6d74e63317b304c408f

SHA512
f2e0ec180f50ae141be8e4a62ac0cfd341bd85798fda3defdf78c6d224029c9f1da9534337790e26e4dab554ab2c55e02a43a7b0963058969c777c047050999f

Download Submit
C:\Program Files\7-Zip\Lang\cs.txt

Filesize
9KB

MD5
dbdcfc996677513ea17c583511a5323b

SHA1
d655664bc98389ed916bed719203f286bab79d3c

SHA256
a6e329f37aca346ef64f2c08cc36568d5383d5b325c0caf758857ed3ff3953f2

SHA512
df495a8e8d50d7ec24abb55ce66b7e9b8118af63db3eb2153a321792d809f7559e41de3a9c16800347623ab10292aac2e1761b716cb5080e99a5c8726f7cc113

Download Submit
C:\Program Files\7-Zip\Lang\cy.txt

Filesize
4KB

MD5
6bdf25354b531370754506223b146600

SHA1
c2487c59eeeaa5c0bdb19d826fb1e926d691358e

SHA256
470eaf5e67f5ead5b8c3ecc1b5b21b29d16c73591eb0047b681660346e25b3fb

SHA512
c357b07c176175cc36a85c42d91b0cada79dbfb584bdf57f22a6cb11898f88aecf4392037d5cea3e1bc02df7493bb27b9509226f810f1875105bbc33c6ae3f20

Download Submit
C:\Program Files\7-Zip\Lang\da.txt

Filesize
7KB

MD5
c397e8ac4b966e1476adbce006bb49e4

SHA1
3e473e3bc11bd828a1e60225273d47c8121f3f2c

SHA256
5ccd481367f7d8c544de6177187aff53f1143ae451ae755ce9ed9b52c5f5d478

SHA512
cbbece415d16b9984c82bd8fa4c03dbd1fec58ed04e9ef0a860b74d451d03d1c7e07b23b3e652374a3b9128a7987414074c2a281087f24a77873cc45ec5aadd2

Download Submit
C:\Program Files\7-Zip\Lang\de.txt

Filesize
9KB

MD5
38582f79994872087e949087be309007

SHA1
7476974870949207739664d3a05ee3369b68763b

SHA256
50eb1f3dfbf20f03ed7b5edebc7b510fc94520e4c5c8d960f001427740b1fe71

SHA512
940f413f249e02010634041e2ca7f1e8320c13ef63929d08b77fd7935eaa1babc375d5441553116ad3b1192016fe048f477169ec3474d196a417cca8cfb0e48b

Download Submit
C:\Program Files\7-Zip\Lang\el.txt

Filesize
17KB

MD5
a5c9c5b3d31b480140022ac5d63b2a8f

SHA1
1c3bb0e61798073b490eb2786cdd05cf46f0becc

SHA256
8bee6dab891c8ca0c42d83b922b883acb9b32ed9f21abc32c4c4a58a29fb7cc8

SHA512
554b664b94398202eef6ce7c496d4a0d688e7e85d876c40b24cb47e1fb8c88380e1bfdcc7cf05af41671ea9df4830046a066f21a9f29314676915bd289b0ff25

Download Submit
C:\Program Files\7-Zip\Lang\en.ttt

Filesize
7KB

MD5
bf2e140e9d30d6c51d372638ba7f4bd9

SHA1
a4358379a21a050252d738f6987df587c0bd373d

SHA256
c218145bb039e1fd042fb1f5425b634a4bdc1f40b13801e33ed36cfdbda063ed

SHA512
b524388f7476c9a43e841746764ff59bdb1f8a1b4299353156081a854ee4435b94b34b1a87c299ec23f8909e0652222595b3177ee0392e3b8c0ff0a818db7f9a

Download Submit
C:\Program Files\7-Zip\Lang\eo.txt

Filesize
4KB

MD5
29caad3b73f6557f0306f4f6c6338235

SHA1
d4b3147f23c75de84287ad501e7403e0fce69921

SHA256
a6ef5a5a1e28d406fd78079d9cacf819b047a296adc7083d34f2bfb3d071e5af

SHA512
77618995d9cf90603c5d4ad60262832d8ad64c91a5e6944efd447a5cc082a381666d986bb294d7982c8721b0113f867b86490ca11bb3d46980132c9e4df1bd92

Download Submit
C:\Program Files\7-Zip\Lang\es.txt

Filesize
9KB

MD5
fd726a88e03aa84943ed42d2237ebec3

SHA1
41bc25feb77bcd83789219930218b66fafef79d9

SHA256
b1572724702a48dc1aaa6c0a34c63ddac5ee1f849b0239bc4d7b4a2f04665a1e

SHA512
f037eb12b0e9661295ca2a8ad30e94f90d82e5d395f239035ae03413854b3b24ae4071ad0de9f135f93d2f906ca606b88d9f0efddf0713b3d85daa7516a52ea3

Download Submit
C:\Program Files\7-Zip\Lang\et.txt

Filesize
6KB

MD5
d6a50c4139d0973776fc294ee775c2ac

SHA1
1881d68ae10d7eb53291b80bd527a856304078a0

SHA256
6b2718882bb47e905f1fdd7b75ece5cc233904203c1407c6f0dcdc5e08e276da

SHA512
0fd14b4fd9b613d04ef8747dcd6a47f6f7777ac35c847387c0ea4b217f198aa8ac54ea1698419d4122b808f852e9110d1780edcb61a4057c1e2774aa5382e727

Download Submit
C:\Program Files\7-Zip\Lang\eu.txt

Filesize
8KB

MD5
c90cd9f1e3d05b80aba527eb765cbf13

SHA1
66d1e1b250e2288f1e81322edc3a272fc4d0fffc

SHA256
a1c9d46b0639878951538f531bba69aeddd61e6ad5229e3bf9c458196851c7d8

SHA512
439375d01799da3500dfa48c54eb46f7b971a299dfebff31492f39887d53ed83df284ef196eb8bc07d99d0ec92be08a1bf1a7dbf0ce9823c85449cc6f948f24c

Download Submit
C:\Program Files\7-Zip\Lang\ext.txt

Filesize
7KB

MD5
459b9c72a423304ffbc7901f81588337

SHA1
0ba0a0d9668c53f0184c99e9580b90ff308d79be

SHA256
8075fd31b4ebb54603f69abb59d383dcef2f5b66a9f63bb9554027fd2949671c

SHA512
033ced457609563e0f98c66493f665b557ddd26fab9a603e9de97978d9f28465c5ac09e96f5f8e0ecd502d73df29305a7e2b8a0ad4ee50777a75d6ab8d996d7f

Download Submit
C:\Program Files\7-Zip\Lang\fa.txt

Filesize
12KB

MD5
741e0235c771e803c1b2a0b0549eac9d

SHA1
7839ae307e2690721ad11143e076c77d3b699a3c

SHA256
657f2aceb60d557f907603568b0096f9d94143ff5a624262bbfeb019d45d06d7

SHA512
f8662732464fa6a20f35edcce066048a6ba6811f5e56e9ca3d9aa0d198fc9517642b4f659a46d8cb8c87e890adc055433fa71380fb50189bc103d7fbb87e0be5

Download Submit
C:\Program Files\7-Zip\Lang\fi.txt

Filesize
8KB

MD5
a04b6a55f112679c7004226b6298f885

SHA1
06c2377ac6a288fe9edd42df0c52f63dce968312

SHA256
12cc4a2cef76045e07dafc7aec7cf6f16a646c0bb80873ec89a5ae0b4844443b

SHA512
88c7ed08b35558d6d2cd8713b5d045fba366010b8c7a4a7e315c0073cd510d3da41b0438f277d2e0e9043b6fcb87e8417eb5698ab18b3c3d24be7ff64b038e38

Download Submit
C:\Program Files\7-Zip\Lang\fr.txt

Filesize
9KB

MD5
fea8b58345c4df966c6e594149a131dc

SHA1
2ba9036a09b76e6a3eea425200ae96aee1b0cd0d

SHA256
e3c81a807bc965f97bbf349a602c6208e25a55611f8d1def85c2ea99ec12c7cd

SHA512
d4f91b6c7c37fb0a97e1b4a573e6aa8cf8f72fddf7b4175502d521db8bc671f87ad685b1056886d6a815085fd1b6896385b69c86f621cac98ad8230e41d1d192

Download Submit
C:\Program Files\7-Zip\Lang\fur.txt

Filesize
6KB

MD5
06b08fe12c0f075d317cf9a2a1dd96bc

SHA1
0062ba87b9207536b9088e94505d765268069f63

SHA256
6ba88938c468e7217bd300b607d7a730530e63d1f97562604ec0bb00d66a06c9

SHA512
9f9fb1c045d92c1f8035d547554457e3466ae861a04f1cd3f57965e4a92f0fc433b2a7b3e9e1e71588e97f8c73d5914a750deded5d3056e327d7efe19a220198

Download Submit
C:\Program Files\7-Zip\Lang\fy.txt

Filesize
5KB

MD5
03d38f09189799a0d927727d071c54b6

SHA1
17ff3a2c83e6a0b0733f2a9a8ce6b83af4f1b137

SHA256
c1c050ed6fe2f8fbc048fd7d82944b8ada784415b6e62316d590c3c7aa45e112

SHA512
e511c1a271a3d78cb7f6111759eec4d7cfc2d46f71f87aa3c4ac1bb11cd4e55e7d4dbe54f9c5107025ffe8c5fcadad4359dc673bc802b82388e74a8f2fa60ff7

Download Submit
C:\Program Files\7-Zip\Lang\ga.txt

Filesize
7KB

MD5
236cfc435288002763c68c4bbee7b39d

SHA1
e74a2402c2cb744dbed8ac1c2154fb1de38148f9

SHA256
b18730124208d26e5e88b76bb99985bf61938d7a994b626b2de5230557d2d8dd

SHA512
fa6941594454cda55e081f15f367f430559849d218895b0b157a2204e8b30ae95db99c62981a9c30a152a63d1bdb8edd975bf06ee5adf1f31b42a2c10cf11580

Download Submit
C:\Program Files\7-Zip\Lang\gl.txt

Filesize
8KB

MD5
6cd7c2b4d6bba163b1623035feb4297d

SHA1
5df07bcfd1edbd448b566aea5789ef251303de69

SHA256
9280ab90261b0c8f206eef7196d7531e4e4932c9174ab899cee4f8ed97cc87c6

SHA512
7ed13085ebc2545b434f5671f958f7a5faa1bc29f7c10721a972afd2c886fc39f0a6e290e70f1f8ea798199ca26974257eaf9b8445652c9b02c789e198191a3e

Download Submit
C:\Program Files\7-Zip\Lang\gu.txt

Filesize
16KB

MD5
93cdc8832328a22e198920630d597268

SHA1
315e5b1c77fb4e2d0c3cc1f48b6db4c79ce9488a

SHA256
c6e54e2a93b821bc974209cd7e2d10e9fbc4ff07d238ae84f552e4ade271702c

SHA512
e8355a42f3a3b5f21d5d4c7a21324433c997ad39412b3bcdcf26edbd5ef882179168b2b5618f9fe631b88407608ab1a83bf139db05c09b608fddf01694b710df

Download Submit
C:\Program Files\7-Zip\Lang\he.txt

Filesize
10KB

MD5
0771f160d56b1890a1cdc2ca040d2616

SHA1
36e69202682bf6993273b521424ec082998f6ca9

SHA256
03b4ea89cce3aa4193a7e3e1e6180dab8359388df3b574379935ea39d7b8d723

SHA512
b452c75292c7d365aa5759fb3f49de674255e839caa687436474b782f615b2ad86a11a58809a5bb60115b070c9b738a461db24e70502598a3bfeccf373220dbb

Download Submit
C:\Program Files\7-Zip\Lang\hi.txt

Filesize
17KB

MD5
18d9c82f12e07b71e03d6086deba0dc3

SHA1
c6c11c6f1fc00a25dd53e1c78f207f6c8c8b8b13

SHA256
5f79ae167a917860f95f73e5ed007fe250f30af794bcfce17941f9ef87d22a05

SHA512
196a859d52a1a742b98460eaf113552dce2cfc63378b19d2902beabc1e66cbd9e26bf37fc26453832aa10929aaf0196ed9211332e63c830b0e5946013c82bdc1

Download Submit
C:\Program Files\7-Zip\Lang\hr.txt

Filesize
7KB

MD5
9d8216183493ac2190a4d6e142ecab9a

SHA1
e534ebb714dbae2a9e12accbe96c6f2568b814c4

SHA256
210af273246d30cfde87295cd5f4ff135b0bdfb04fe7173bb60f935e685b8e10

SHA512
5b56560ad70652c9c6287f939b25676d8149c000c2388365197354dbe38c5cba5c25f0a3a529f0601a5b5d964b7278ab3a668e8469cf0ec718821fdabcf044bc

Download Submit
C:\Program Files\7-Zip\Lang\hu.txt

Filesize
9KB

MD5
a5e899ee18c546e3080d10bcf60aaca3

SHA1
18d4f8f22325ed0d646cfc0aedf76a2e0e753c40

SHA256
486f622e2ed81e2110b7c2a2a53809c46c86b6712e2c58b1e1b6c0b65a4e429e

SHA512
6dcff6573196bb2fdb69c1e190979926f8907708788d0d810d685e281faaa33d8f21f0b850a26bd062206ae234e513f30656a7d2ea8a4d54bbc1e7748482b4b4

Download Submit
C:\Program Files\7-Zip\Lang\hy.txt

Filesize
13KB

MD5
fe73c2aacf07d5120aedd08792cb8268

SHA1
2c6e7d2ff42c5f65ef5f4c27600819354caa03b0

SHA256
91aac9368bd116ab11fda0b70ee4d75911a65713a272a3ba55d1435c33250f5a

SHA512
79dbd84fe71888b7c9fdbcd23f2d4735f731e3c2c7724fbd531c3ca531b1992e756b13b66889af30ec46770d350fcfaef2d7abe607594a2b4b92f60ed326d537

Download Submit
C:\Program Files\7-Zip\Lang\id.txt

Filesize
7KB

MD5
58114b39c4b854f90867ae2448ea72f9

SHA1
d2cac0cfa076896e5b40102d28caf06ceaffa94f

SHA256
c65026fb9297bd7e83535a57e640326e83e876494f4eabb41b3ee0bb10380849

SHA512
ec7e5c48287475b4882c2a01132985812f1f6388f755121a5d988db802f69fb60bed1146b42ec08ed358f57b0ccb71d994fbd59397fc8ddabf7260a7a3f5fd94

Download Submit
C:\Program Files\7-Zip\Lang\io.txt

Filesize
4KB

MD5
0861ae63da2d00590369bb11b3857551

SHA1
8272f4761a3f2aca2bfaec6fcf08c82a9f36a65a

SHA256
b87a4fca8a0024a915ae86e36951cb7cea442948d9982d4247e49492445ba664

SHA512
70997d6775e1c91d021fda2143c831fe8396094e50337da3c4897da70636b7f10b363f35b997213a462b467fe6754d2c33e009e84363063eced871a2591cce88

Download Submit
C:\Program Files\7-Zip\Lang\is.txt

Filesize
8KB

MD5
c8f31d6adee368ca0aa00350df0d82df

SHA1
4146c7c62dd46b2c43c92cdf33e45fa7e2272d04

SHA256
dc61090369e1269a68c75e472d863aaf42207f702b3d3e12ca48d2852e1478e3

SHA512
758af54a33dc243992324974f01707c8027be7bdc7d07187a28038f4c9d8f7681d989b66f56a13b86e99c8bc74d80a70fa44bd5dd9532c99b78df7985b397ed8

Download Submit
C:\Program Files\7-Zip\Lang\it.txt

Filesize
9KB

MD5
6e341ea845d0db371828d4213a72d973

SHA1
bf9be33da5967e479c29e85f24772bdbaf399ee0

SHA256
e2648d873b9b6fe5a13ede9d25c5110058e84e14b5b9e416bb4f976754cb965c

SHA512
24d0bcdc4ee5e91f1648bde6fbfc96700d3cf666576c2df4e8bc0195a20af7ed2fae8fbf30fa60998dce9486174faa9bc9d7cefcc4f374632c20c7fa33f4fc64

Download Submit
C:\Program Files\7-Zip\Lang\ja.txt

Filesize
11KB

MD5
8629c76cc39b2dfea035d862948e7b9c

SHA1
1a6620c22439953d68f6d5c72a2471a01c5abd92

SHA256
86ef36a9fd080423af19517f7965c3c3fb2a4d89c8a7b5e2bdde774847dea064

SHA512
2e827a706f8c3c20133ee315ccbc116d5a6abd5ed656b9bee8cfad6077c18240101fd7978e854c858645b23449023b215c7d553a9244f567d30055450a657d59

Download Submit
C:\Program Files\7-Zip\Lang\ka.txt

Filesize
17KB

MD5
c99e6572f5638599dbca2ceac337a320

SHA1
73c64554a00c6d5a3dab8a2e7bd50426d6c7b6f4

SHA256
8dd6073b585dd2e9d8cdd8e0fce7dfeaf2f5a2d8bfc3059f67eaa3d8b5eb2d9e

SHA512
cde3d44793d1abab3b8d0ba71d1af85c7ca49b37f4331b43d546d1f2022fc9cedd1188869acee5bf9b74046788daf26f4e4658af86663065339103d2a602f7aa

Download Submit
C:\Program Files\7-Zip\Lang\kaa.txt

Filesize
7KB

MD5
ffc17520fb68fe464650b2f78e15ab5d

SHA1
2b83034ac04640160ddaa8e797faa5d8c80f956b

SHA256
24f7325271dd7ad2b63e977841d2f06ed0194bd9257f0db460df32baeeec4746

SHA512
4f1483796a8ef95b2be61811a6566ea2e19564f37733647b6eb4e1c82a8da8fa927afdf024a247fc7e70088f63133a7843fe6129b77b2ada01e39a1e814429c7

Download Submit
C:\Program Files\7-Zip\Lang\kab.txt

Filesize
7KB

MD5
5af10c5616e0487d236c8cbe2f23a7a4

SHA1
2049e1a82a0af13a8ed2cf9e4eb51f1dfd377480

SHA256
f249930089c374eab59078cf16b8652d443cf2a47485d737ae5a9fca2957d6b9

SHA512
8e2db2769d8c9d4af435986bc58f66f570c4d85bf7c8a2b9369f546cf45c0848a07986582e8e7f76a9aed569da2774e5b19706ec77bfd41bb6b4af86abcfcefe

Download Submit
C:\Program Files\7-Zip\Lang\kk.txt

Filesize
10KB

MD5
407130a212cfac68fa4873b0381b2cb1

SHA1
c0c9b84cc79619d27536e9f50f25d81237b234d3

SHA256
f813eac0b284edce156dd1e6b7ea75b027f4342e04d8b8db1131894a227a4562

SHA512
e80afdf726ccc5d495f62a9b289ee31703f151ea01eba32ad7d2da306c2c07de2f9049dc6592c3c962b7cc2cbe352b8b7a19e9dbcf7b3c6b61dcc4026b70c151

Download Submit
C:\Program Files\7-Zip\Lang\ko.txt

Filesize
9KB

MD5
c7fbec5c3ad0df7ab062b1d28f7d58f6

SHA1
c80cb9b662eca8cbe5670d7bb6b07370e2305e20

SHA256
6fb715d85cfef1cbdaba7436a175499ffe1d054bab259ba670240c2df7baa282

SHA512
e502ffd34b0218d798b538884307d20fc5264998c0702b17b011cf79de4e1f2bf50e29c275adc7474b0934fb5e3b0fd72ccb2d95a01321999e1d917249fa5eff

Download Submit
C:\Program Files\7-Zip\Lang\ku-ckb.txt

Filesize
11KB

MD5
8c3f9ad9c824dcf74a09c9d406db22e7

SHA1
0c683bb56a13c3fbca664f1e4c6c98d0f7aec8bc

SHA256
b8b7db8c139b19d414cef35ae96d854d5a8364c32b0c3fdc4cac331b5af44c16

SHA512
da33d4098679a14d2f434221ef968951407727126b12404c8b6c3e2ad6fa346d9d515dea940f9109d5d196e648583124f31a1d27cf518ab19e3dcad673c027cf

Download Submit
C:\Program Files\7-Zip\Lang\ku.txt

Filesize
5KB

MD5
28e69dd6e397fa98c07088e4cdbef1f4

SHA1
56e4a46b5c7360f609683562e617c75c28cd447c

SHA256
57ae544f3f9e8bf5d96ce1f9cfe5648eb6c1e2f5604da6eb0c80ae24bc1a40d7

SHA512
6bde04f3bbd42e73ea3e0a93e8ef69149f25dae491051d1655a85718af4d51f5247c610d87c20227f94beeeba038d54f7b213b0443382d080e87722485941aae

Download Submit
C:\Program Files\7-Zip\Lang\ky.txt

Filesize
11KB

MD5
e50c04d913dc92251aa6781c02e0bd45

SHA1
57e68c80b23a9b1bd689ccd81cbcd91e0cae6aac

SHA256
9a9e4ddacc494eaaa386f1220837020f332a49e7fff7f0bf8c38c847390dab18

SHA512
c428caf314f79d533246cee4015411102ed836d0173f67f3b2f4c61c3f3f81be7fb2fff7d3e863e999617ba05fd6f7fef4b67cff8557e1d0c86035ed29daa2ce

Download Submit
C:\Program Files\7-Zip\Lang\lij.txt

Filesize
7KB

MD5
58ff044fe195453f797dd1ac6903abf9

SHA1
4b8dae21dd14ac6daa1decf804336a1aae169aa9

SHA256
d9bb6bfc127938c47b43290241378887085314ad1326095934a362cd9836b560

SHA512
861300fe39ff0daca00b4cb56c4075afba2bb3a1654bcf35713251237630206f06bc63d7f339ecff040c9ea1f5b7094a11fe57c5848e91db9000f48d166ab1be

Download Submit
C:\Program Files\7-Zip\Lang\lt.txt

Filesize
8KB

MD5
b8056cba4edeb98d298d16edbc34d678

SHA1
a4d39c3eda31f8ce72c62e1db91deeabc884ceb0

SHA256
9c15db408e32dc699f598aab30f539f91a212e5fbaee2095022e24b3f1f09ecd

SHA512
5c3fb76a5502c7c0312a32cff38f99c303225c31c3e5c6041765bc2beb0e9d5ac9cb4f543b80eca969d54723a52122601b2074afa8991ad64b92cfda91104dc6

Download Submit
C:\Program Files\7-Zip\Lang\uk.txt

Filesize
14KB

MD5
162c1449a17cd04659f498be06874a8b

SHA1
b3c68326ec4cd166c33e48245db3f390ef18f7af

SHA256
f5e6d2022a1eb4ee4c8c967fd716bca9a09f8b4dbfdcba6f63fdb8aefceb59ed

SHA512
f40cf5de42c21702b90f8141e01a9c31c18bdae411655936419fdc7cd9be4e9d1bb73093ebbe91a2c4e4309634238d1fd15b2c45dcd2d508689982bc2dc8eef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
38f87fd78f19c19cbe7a276e12f232ca

SHA1
2f3236f6fec6758beeac633a40926bd32619595e

SHA256
c45c2f8a9159714c642a4d323e15ee8ed97c50cce76fab8c3209b34c81d1a51f

SHA512
3fb16a9c0f9519b1ba70fdf073a72c04aa7473579f0715fa17b8ba6f6f9a744057b3baabd47a615aea252ddfef337e101e5a284593a45fa35dd37743709588bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f998e33ed49d596f864313f7d877e112

SHA1
b397bbef4b94bb8803ddd258a8b071102fa68b9b

SHA256
05dbdc5f73f64d273e24724068ab95a4bb0ec26cd90e02e143499da98b7849ba

SHA512
827020f354d9a640b93090fa4e7e6a1784c7da7f1d6c212717dc5606e1a5a43d8221d004b14ad613379698dddac411f379418e9a8f8480e59a593792f381a9ab

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\activity-stream.discovery_stream.json.tmp

Filesize
26KB

MD5
8467a62a928151e9162ee72e9ed5d83a

SHA1
1026298c6f36025530098d5496cc287841094bce

SHA256
84aad134e9b7893d6000b66ac52850e0296e305468a8dad48ead9542d2978c0e

SHA512
73de2aa51a7158fa307579fcc53d8c844392506cad5e7e871a8af9d489a2d5dacc685310293948e33b0c8e23b9790d13cedbf0590dea4f29fcf1096c29257182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs-1.js

Filesize
6KB

MD5
d64a8d4c1f2d3989a4623b293f1a48a5

SHA1
8a783f696502f74056b95b518ad3afad4541750e

SHA256
1f19024d1aab7f12b681037b8f5ae975b22b275539170a0ad203aee70af71000

SHA512
28e65e6859a34db5ceb28e797d66636b706f7b104edef3476b256e244c35006843e83f913591ef9ddb1be9ae2da8e6a1fd9d0f86fab96a53beacce096b59ee6c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs.js

Filesize
7KB

MD5
f5f233fd26ae3650df4cd67556d59a55

SHA1
52148f7f978a0edc5604507c3a5b06ef7b0c6ee2

SHA256
4576478ce5c0041ef1eee2e1808ee48f95d8382728901d1e95778916d43c5323

SHA512
2c8f260ee09c58b20f7b78e4046b5638c893d80735d04711e6115329078263627a76d198b552aefb41df7cd3674b19b96b043b78e63e3de702534575f8c87439

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs.js

Filesize
6KB

MD5
c6a4b0c6579f87943cc08b2287ca53ef

SHA1
f847fc700ccdf0c203071d15be2c9328bdd9172e

SHA256
92050c1e76e52f6ee540833a8afeee1928fbb49c992c3c0b5831612cc5ac6bd9

SHA512
ba22451347046fc8b615fb4b299ba6ddbaf622dae315500b54930382047938f5a414373875a956e11b386011ef52f24c4f9540308fe3e1b815b6c0322868469b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\prefs.js

Filesize
6KB

MD5
e2beeee632ad10047fbda7cfd8cd36ba

SHA1
6ba35cc6519cf8a92b6fa07d531cc0ced0d804dd

SHA256
4662c26f214841c91878af98f41e450e5b871841679581061b2b5af90b373a6d

SHA512
92f6cc9c39f94c3b6dba8e34b9740bfb41b0dfa7507fa164cb546a8032d5f5306597d74bcaae8bfa0bf3f70c4e139f2d6c49be10948f62d457512f5a8484ac96

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
2KB

MD5
8b356cc2bcb40cb1637e948e0703d4e3

SHA1
f51159ed90d2533538ba32562b3daea0ac1649c8

SHA256
0834b7b52f4ddf18c0198988168f78f56fdb3727860b5d833d7b1c3c6f5e7ed0

SHA512
b4eaa807405aa9c9b9933520d18606aece8206bfd7327ca6ccae0c0f9c33c296f19224f9138b87bd05a8ad23cda32f174263c8d31dd1ac51945f22231de68435

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
51d7bedb7e45a4740e2ecadf070e707e

SHA1
52828bee336147fd7643b54d215d6ea478c07411

SHA256
d4acb9b2308af505959e277369e66501fa50db8a08a8320fc24b78c35ba87a6c

SHA512
27377eb4a1a595aa0d201224b15a985b6986aa419f7cc04bfd1d26977a673ca7d78aad024730842fc8fecf9df34bb10d4c7ad5347208f27b128c54a4f2a55b9f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
4KB

MD5
ea7b1e41cff83c3657a865de152a6a64

SHA1
125ebe1247bfcf10a12d82857f0a5a96af52aa5c

SHA256
0c805c2a500cbc42eddc49d07a11b3b6dce0684fb6659bb43ef6c47925999a68

SHA512
3bb0a12bb02999303dee2a4fba37e1010a29e86dbb4111b89fa2035a7be1e7b52765dcd18748b42c4f0a298885b416b446ea4005c4fc7dfca08287ddc5cd8e16

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ebbvs5n9.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
88367cb0ef21d0aa6006d94764172a81

SHA1
ec7523ed97e4f4973e75413e8c1977367e17d3f2

SHA256
cb8d1b45050187d2f489188bc49e19a924c2f428978ac51a04a32e815a675f10

SHA512
8fa46fa791be924a9ae106f7ac43b89f5f9cfaed78818f8e50e00341c3bc7281921b290031a660124225a0150cb9266489845537e61eec3e5c097a0b4057c5b8

Download Submit
C:\Users\Admin\Downloads\7z2404-x64.msi

Filesize
1.9MB

MD5
ba4633cb8d60913b9391969c20178ba5

SHA1
4b4e7cf0594c070b7a21a113495c4b8f3a2caedd

SHA256
6a9088743ae698b6c329576769d131a29ee7abb85ac36972fffaf21d8bf8dbaa

SHA512
8154f22da5354c8c4358610c3d658d3293a2e0a3bfb9762ea0ba333b5d375b33cab14726772cbcdeebc9a55257679f0efb2e9226bbfc9bd6de41ad5f81352229

Download Submit
C:\Users\Admin\Downloads\7z2404-x64.x55Gp9Qc.msi.part

Filesize
63KB

MD5
aafcca7d8239503bc97e969ce1d217f9

SHA1
f3fe9f71b37d43c676972aea821618f1c9e9a590

SHA256
29eb2b4b2d667fa439323e47726fd68371a0f6a7c6b0e51dcdd682a0f3eca5e2

SHA512
2b647a0add1773a0b099a4906d0938e004f1993319ba69576df8d7c047296ea5921cd72f586973f8a6a928be5bf1981ee99e31cfddc7529697fca77dd972f268

Download Submit
C:\Users\Admin\Downloads\puW3xm4C.7z.part

Filesize
225KB

MD5
ae60415f2bba4bf8b3c0b5ae687ab79b

SHA1
a0918e35ca8a7293bf4ad926d4f6d2b66643a889

SHA256
f63801a874a87df3b446504ecf5ed56a9f0a7c8d32c2d560c0358a7ec544f19c

SHA512
02326ffc3581d7d71595eedad7523d36d931434a495a30f7c4eecb40383858b598d5dcac6b4a61791cd9750cf6e54d0bacab85b22e31466e2d61b475f637d6c3

Download Submit
\??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2

Filesize
23.7MB

MD5
f31b8a9c78ba0ae9c2d9aec2d35d8a2b

SHA1
f135df6aa5550e0062d8ea5fed43df0e41c6219a

SHA256
5e71ae34f8404733f1a3b04785a394e67e8dbc18e19f0e2e991413283b01739a

SHA512
8486cc41e832828bba7bfce06685d80b7f01d4c17ebc2855f3df2473f50cfabc8af12247923448e421d6642c2074381a223bf5044a9524343aef79deba7d2cdc

Download Submit
\??\Volume{dfbd1330-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{8015f829-3be2-495a-a3d0-6d23cb051124}_OnDiskSnapshotProp

Filesize
6KB

MD5
bd5d9436ebc40ae7f72aa04bea062c6c

SHA1
07d33944c2d56929e16c452d0b0b158e4d7b763c

SHA256
b8d980681ecc4961313027b9a6779e0cb8ce1c66db50cb22f5689d69df59e971

SHA512
62817cfe1e998d61daf5717a15ab8326bb039a2150c92797c03b7edb167c86834f5ddb63c194f7295eaefdb55a701a6318dea9d2e6dba25e70777ce2a9018ffc

Download Submit